Hacker News Reader

No, they don't actually serve all ads. I imagine they know not to pass off a request from a HTTPS page to a HTTP-only server (mixed-content blocking would give a near-100% failure rate) but here is an example of Google's Doubleclick network being used to spread malware: https://blog.malwarebytes.org/threat-analysis/2014/09/google...

I think it can do both. Kind of like how Amazon sells products that ship both from its own warehouses, but also from the vendors directly. But just like with Amazon, there's probably an increasing amount of ads that come directly from the vendors.

This is what surprised me, I assumed Google ran all ads through their own servers.