The mechanics of it are a bit complicated.
When you access a page at the straightdope, you are getting data from the straight dope server (which I’m sure you expected) but the web pages are set up to get data from other servers as well. This is mostly advertising related stuff. The straight dope web page calls a script on an advertising broker’s server. This script generally ends up redirecting the request to the server of an advertiser who has paid the broker for this service.
So basically, the straight dope server itself could be corrupted, in which case you’d expect more users to have problems (especially charter members). Or, the advertising broker’s server could be corrupted, in which case you’d still expect more problems with charter members. And finally, you could have the advertising sites themselves corrupted, which is historically where we’ve had a huge problem around here.
It’s also possible that a DNS server anywhere upstream from an affected user could have a DNS cache poisoning problem. In this case, it’s an ISP level problem and not related at all to the straight dope, advertising brokers, or the advertising sites themselves. What happens is that the straight dope has a link for some advertiser. However, when your computer tries to go to that advertiser, your ISP instead directs you to a malware site.
Even though most of the problems have been at the advertisers level, the straightdope has the ultimate responsibility for all of it, since they are the ones who contracted with the advertising brokers. Other web sites are capable of displaying advertisements without constantly serving up malware, and the powers that be here at the dope have been a little too reluctant (IMHO) to accept responsibility for the problem and instead have been pointing to the advertisers. The advertisers wouldn’t be here if the straightdope hadn’t contracted with the particular brokers that they use. The administrators of the straight dope message board have ultimate control of what does and does not go into their web pages. If the straight dope serves up malware, it doesn’t matter if the malware actually came from someone who is essentially the sub-contractor of a sub-contractor. It’s the straight dope administrator’s fault for using those sub-contractors.
I can’t say for certain that this wasn’t a DNS cache poisoning incident, but I think that is fairly unlikely, especially when the straight dope is known to have malware issues.
This particular incident is a bit disturbing to me simply because so far it seems like all of the malware has come from advertisers, and that should not have been a factor here. I hope this gets some serious attention from the admins here. I don’t think they’ve gotten to the bottom of all of the malware issues around here, and I certainly no longer trust this site. I am basically treating this as a known malware site from now on and will be taking appropriate precautions when surfing here.
