Finding APIs copyrightable could get extremely interesting if parts of HTML5 or new network protocols count and were implemented in GPL-licenced code first... Would that essentially prevent Microsoft and Apple from legally implementing those standards?

Traditionally, you had "spear phishing" attacks which had attackers sending malware or phishing emails directly to their targets. This is relatively easy to spot and filter. The "watering hole" attacks work by compromising a trusted third-party site used by the targets. For example, if your attacker know you read Slashdot or use some specialised forum site, they could attempt to compromise those sites and use them to host exploits as part of the normal pages (infected banner ads or modified page content).

My ideas on this would work less well, but still be reasonably effective: simply check that any non-withheld numbers are actually valid! I have seen a lot of (admittedly UK and not US) calls apparently coming from numbers that cannot possibly exist. For example you would see calls where the local part is too short, or simply see invalid area codes. If you know all the valid number formats and area codes for domestic calls, you can drop all calls that do not fit. I'd also suggest wildcard-blocking for end users, too.

Another option would be to have the telcos automatically and freely lookup return routes for each call. If the openly announced number has no reverse route the inbound call should be null-routed. You would then have three cases: valid-but-possibly-forged domestic numbers, withheld numbers and international/not-available.

By default, XP allows inbound NTLMv2 authentication from remote clients but does not use it outbound to authenticate to remote servers. The same setting that makes XP refuse LM/NTLM also enables outbound NTLMv2.