Shooting the messenger feels good but does not help
Perhaps Yahoo and Google should not be blamed for the problems with mainly fraudulent Flash ads to the extent as worked out in this excellent article.
They do not have any part in the endless string of 9+ CVE's served up to an ignorant world by Adobe.
They are not to blame for the fact Microsoft produces operating systems allowing rigged content of a website ending up as executable code in kernel mode.
Going after the ad networks, or any other website, because user generated content abuses security holes in products SOLD by others is not helpful in solving the worlds issues with malware. The fact that this discussion even wasted the time of the honorable Senator McCain, is probably more an indication for effective lobbying by Microsoft, who successfully managed to divert the fire to others.
Perhaps the only thing widely used websites could do is introducing a constant nag mode about outdated or unpatched software used by their users.
Biting the hand that feeds IT
