&quot;Custodian&quot; is a strong word. Let&#x27;s back up.<p>Download.com doesn&#x27;t write the malware, it just serves it. Are they a custodian? The argument here is that download.com knowingly serves malware to make money.<p>By that same argument, if Google knowingly serves a link to download.com to make money, how is this different?<p>At the end of the day, online businesses serve things to customers just as venues serve performing acts and stores sell goods. There is some expectation of due diligence over what they provide.<p>We can argue about whether they should be legally compelled to not serve malware, or whether we should simply stop doing business with companies that serve malware, but it&#x27;s reasonable to consider them responsible for the things they serve to make money.