Three signals that lie about whether a security-software exclusion was applied, plus the 8.3 short-name trap