The easy solution for sites that need revenue is to abandon this stupid arms race and do two things: 1. Force their ad networks to police ads for malware, movies, tracking code, and slow-loading crap. 2. Stop sharing private user data with others. I would turn off my ad blocker and incognito mode tomorrow if e.g. the Washington Post would take these steps.
If you have your ad blocker on and the WaPo did this, how would you know to turn it off?
First, word of mouth. Second (better solution) a non-profit certification authority something like Underwriters Laboratories that monitors ad networks for malware, and gives its seal of approval for good ones. WaPo could then advertise that seal on their website.
Then of course when an ad network screws up you have a certificate revocation problem, but that's another story.