[ori_b]

> Devil's advocate: where does this line start and stop?

I would say that it stops as soon as the venue starts doing any reasonably in depth vetting -- or even more, actively curating -- what they're serving. In this case, Google already has a malware detection service that is hooked into their browser, and this malware detection service can reasonably be expected to catch sites like download.com that serve trojans.

Download.com actively choses what to provide for download, and actively makes sure it has malware.

> This is not completely analogous to serving malware, but the onus is not on the store to vet the products before selling.

Sure it is. If the store sells low priced crapware, then it's 100% the responsibility of the store. The difference here is that the crap that they sell is legal, non-intrusive, and can generally be returned for a refund.