even so, there's no reason a filtering of software for anti-malware purposes must be conflated with the private entity also arbitrarily deciding what software is and isn't allowed. they could do one without the other