A few things to counter here:

1. Considering the sloppy bullshit that is the root cause of 95%+ security vulnerabilities today, I think talking about "0 security" bugs is a distorting strawman.

2. No one said no recalls. The issue here is Microsoft is going after the exploiter rather than the bug, taking the law into their own hands over dubious pretenses.

  That's somewhere in between taking the drivers licenses of Corvair owners and recalling the Corvairs themselves. (We could make a better anology if a black hat actor triggered the car defect.)

3. This could easily be precedent for scenario:

  1. Security researcher finds bug and discloses it
  2. Big crop declines to pay up / doesn't fix in timely manner, etc.
  3. Security researcher goes public
  4. Malware is made with exploit
  5. Big corp goes vigilante on malware like this *and* sues security researcher, using this trademark justification in *both* cases.

In what sense is Microsoft "taking the law into their own hands"? They filed a lawsuit and convinced the judge to agree with their legal theory. That's how the legal system works.

There is no vigilantism here.

They mention in the article how it spreads via emails not via exploits (in which it would be called a worm, not malware).

Isn't a worm just a type of malware? Wikipedia describes malware as "any software intentionally designed to cause damage to a computer, server, client, or computer network".

Seconded, I've always understood malware to be a broad categorization and not a specific type of attack.

I'd always assumed that malware was malicious software disguised as something else; the layman term for trojan. TIL that it's much more generic than that.

No, just that they need to be willing to accept the consequences of their mistakes rather than blame third parties. If software development is inherently risky then that's still the responsibility of software developers. If that makes some businesses unviable then the system is working as intended because they were unviable anyway, just profiting by passing costs to other people.

There's a separate sentiment floating around (and that _was_ the tone I caught from the parent comment, though I could be mistaken) that portions of Microsoft produce software with major design flaws that create a horde of other security and performance problems and that they should do better, but actually making better software isn't a necessary step in holding software creators accountable.

It seems like, if Microsoft were trying to absolve themselves of responsibility for defects in their products, the thing to do would be to claim that malware is developed by third parties outside of their control, against the terms of the EULA. What Microsoft is actually doing seems a lot more like taking responsibility. They're cleaning up the mess and helping people when they don't really have a legal requirement to do so.

Every time, a few months before product release, downstream teams start filing bugs on us that boil down to the statement: "please continue to add features, but stop adding bugs".

Oh, sweet summer child: features are bugs.