Earlier quoted context omitted.
No warping going on. You said “But if you have a cached OCSP response for the cert of a malware author, then you've already launched their app, so it's probably too late. ” I.e. once you have launched the app, the damage is done. This is not the case, and the Zoom situation is a clear counterexample. Even if a problematic app has been launched one or more times, it is still worth preventing subsequent launches if you…
> This is not the case, and the Zoom situation is a clear counterexample. I was talking about MALWARE. As I said before, Zoom is not malware, so no, it's not a counterexample. This is my last reply to you. You're clearly not interested in having a good faith conversation, you continue to misinterpret me and want to score "internet points" or something. I'm done.
Zoom is not malware in that as far as we know it isn’t Zoom’s intent to cause harm.
However in this instance it exhibited a behavior which many forms of malware exhibit - opening an insecure or exploitable port. It was shut down because it was behaving the way some malware behaves.
It’s a perfectly reasonable example of using these types of mechanism to mitigate a real security issue.
You can’t seriously be claiming that malware never opens ports, or that malware always does all of its harm on the first run.
Therefore the use of the distinction ‘malware’ is arbitrary and irrelevant.
The mechanism is useful to protect against vulnerabilities, regardless of whether the vulnerabilities were intentional or not.