Slashdot Mirror


Symantec Patents Virus Updates

An anonymous reader wrote in to tell us that News.com is reporting that Symantec has a patent for updating their virus definitions incrementally. Symantec has recently informed their competitors of this fact. According to the article, Trend Micro fears not, because they have their own "technology."

75 of 211 comments (clear)

  1. rsync by adric · · Score: 2

    That sounds a lot like how rsync works... checksum the file(s), piece by piece, and transfer only the portions which are different. It's been able to do that for several years now, if I'm not mistaken.
    --

    --
    not plane, nor bird, nor even frog...
  2. Re:Excellent. Now I can sue them. by Christianfreak · · Score: 2
    Hehe, how about a virus that makes that stupid Office PaperClip evil (like giving him horns and have him make fun of the user when they make a mistake). Patent that, sue Symantic and make the world a generally funnier place by telling every Office user how stupid they truely are! :)

    "One World, one Web, one Program" - Microsoft promotional ad

  3. Re:Companies that can't compete by Fjord · · Score: 2

    Gee, you'd think that patents were created so that they could allow companies to compete in a market where a competitor could easily reproduce their product. How shameless a twisting of the original intent this is.

    That is sarcasm.

    --
    -no broken link
  4. There still is a difference betwixt Virus and Worm by Christopher+B.+Brown · · Score: 2
    Worms aren't as bad as viruses, whether in the "Animal Kingdom" or in the (actually remarkably good) analogies of the "Computer Kingdom."

    Remember that a virus is much tinier, more pervasive, and more invasive than a worm.

    We see such viruses as Ebola and Lassa that are tremendously fatal. The same is not so true for the worms that likely only live in the GI tract.

    Once invaded by a virus, there is very little that can be done, whether in biological or computer systems; it can potentially get anywhere in the system, and readily be impractical to stamp out. There is no cure to Ebola, for instance.

    In contrast, while worms may cause serious problems, by being largely restricted to the GI tract, and by being vastly larger, they are much more amenable to being flushed out.

    My conclusion would be that viruses are quite a lot worse than worms...

    --
    If you're not part of the solution, you're part of the precipitate.
  5. One word.... by Jaysyn · · Score: 2

    ...Computer Associates. (Ok 2 words) Their _Free_ (as in beer) virus scanner picks up stuff that neither NAV or Mcaffee will.

    http://www.ca.com

    Jaysyn

    --
    There is a war going on for your mind.
  6. Re:Who uses antivirus software anyways? by AaronStJ · · Score: 2

    Who uses antivirus software anyways?

    They hog system resources, they slow down pretty much EVERYTHING, they require CONSTANT updating, they interfere with installers, and on top of that, they don't fix anything!


    Antivirus software can be very *very* helpful, if they're configured correctly. I worked for the local school district a couple sumemrs ago doing basic software upgrades/configuration on all of the district's PC. Every computer had McAfee installed, but it was almost always poorly configured. The software was often disabled, or not configured to retrieve updates automatically, which made it basically worthless.

    And, suprise surprise, we'd find "nests" of viruses in the labs with poorly configured (or no) virus protection. The PCs, as a result, were baerly functioning. We'd bring McAfee back up to speed, give the computer a thorough scan, and eliminate every trace of trouble, almost with no problem (the most infected machine had over 300 infected files, and it got up and worked fine after a thorough scan). On machines so crippled McAfee couldn't be installed, it was a simnple matter to share it's hardrives across the network, and have McAfee scan the drive remotely, which worked like a charm.

    While AV software might not be as useful on the home PC, I would say it is essential in corporations and large business. And I would recomend getting AV software at home, too, if for nothing else than to scan downloaded files.

    --
    Stupid like a fox!
  7. Here is the Link to the Patent by ||Deech|| · · Score: 3

    Here is the link to the patent, if anyone is interested...
    http://www.delphion.com/details?pn=US06167407__

    I couldn't quite wrap my head around it.. but I think they are basically using several different incremental versions of the update, compare it to the current data and then applying the update that is most appropriate.

    i.e. say you start with data version 1.
    you update to version 2
    you wait a while and now they are up to version 5
    when you tell the software to update itself it goes and looks to the server and on the server are 5 different incremental updates:
    1 to 5, 2 to 5, 3 to 5, and 4 to 5
    it realizes that it needs the incremental update from 2 to 5 and loads that one...
    of course, I could be completely off, please correct me if I am wrong..(of course you will, this is /.)
    HAND.

    --
    Run. I like water. Push My rutabaga.
  8. Re:Moderators, please correct the moderation by fatphil · · Score: 3

    You haven't thought about what AND-ing and OR-ing really mean. _This is a linguistic issue_.

    If X1 and X2 are claims in one patent and Y1 and Y2 are claims in another patent, then a patent application consisting of X1 and Y2 and Z is a perfectly valid. Novelty to the whole patent can be by the introduction of one novel claim (i.e. a logical OR). However, a violation would need to be a violation of all three things.

    Violation(Patent)
    = Violation(Claim1) AND Violation(Claim2)

    Novelty(Patent)
    = Novelty(Claim1) OR Novelty(Claim2)

    This is why to get over Ericsson's vibrating phone patent, Nokia patented the vibrating battery, only one thing was changed, and it was suddenly a new thing.

    So I'd avoid trying to use these simple AND and OR terms to blithely summarise everything about how patents work, the brush is too broad.

    FatPhil
    -- Real Men Don't Use Porn. -- Morality In Media Billboards

    --
    Also FatPhil on SoylentNews, id 863
  9. Re:Hold your horses by werdna · · Score: 2
    No, I won't hold my horses, because I've just read Claim 1 of patent 6,052,531. That claim is very general, and there is tons of prior art.

    If what you say is true, and there's "tons of prior art" covered by the claim, what's the problem? Patent isn't valid -- go home. (Unless one of the dependent or narrower independent claims survives because there isn't the prior art to defeat it, in which case, what's the problem?) If what you say isn't true, and either the claim isn't valid or the art isn't there, what's the problem?

    You can't read the claim in the abstract -- the terms are defined in and have meaning derived from the prosecution history and the specification. I don't know what does or does not infringe, and would never presume to know without more research and study. This much I do know -- its always best to wait and see before leaping to conclusions.

    The claim does appear to be quite broad, I agree. "Update source" in the specification is defined as a server, but I don't think the term is unclear. The patches must have the required state properties, and be applied in the manner set forth in the claim, as those terms are defined in the spec. How they are construed for trial remains an open question, and it seems that those limitations will be key to any infringement litigation. However, any construction of these claims must be understood in the light that the patentee seems to distinguish CVS and related updating technologies in its discussion of the prior art:


    Some computer software publishers update their software "applications" (computer programs and data files associated with the programs) frequently. For some types of software applications, such as virus protection software, these updates are particularly frequent. Virus protection software applications are designed to detect computer viruses on a computer system, and may also remove viruses which are found. An example of such a software application is Norton Anti-Virus, published by Symantec Corporation of Cupertino, Calif. Because these virus protection software applications rely on data about specific viruses, and new viruses are constantly being written to avoid current virus detection capabilities, it is necessary to update virus protection software applications on a regular basis to account for the newest viruses. Frequent updating of data files is also necessary for some database publishers, who must put up-to-date information in their databases, and remove obsolete information therefrom. Periodic updating of general software applications to expand capabilities and eliminate "bugs" is also common.

    Currently, several methods are used to update software applications. The simplest of these is to distribute one entire software application to replace an older one. This method, the "full update" method, is simple, but expensive and inconvenient. Typically the software is distributed on some type of removable media, such as floppy disks or CD-ROMs, which are costly to produce and distribute. The time an end user must wait for the removable medium to arrive and the time it takes for the software application to install itself on a computer system are inconvenient. This inconvenience is compounded where updates occur frequently. Because of the large size of software applications it is generally not feasible to distribute such updates over computer networks, such as the Internet. When full updates are distributed over the Internet, they often cause such high loads on servers that other users suffer slow-downs on the network, and the servers have trouble meeting the demands.

    In order to bypass many of the problems associated with this type of software updating, some software publishers distribute "incremental updates." These updates do not contain entire software applications, but rather only that information necessary to transform a given version of a software application to a newer version. Among the methods available to perform such incremental software updating is binary patching, performed by programs such as RTPatch, published by Pocket Soft, Inc. A binary patcher replaces only those binary bits of a software application which are different in a newer version. Because most software updates involve changes to only a small portion of a software application, a binary patcher needs, in addition to the old software application, only a small data file including the differences between the two versions. The smaller data files distributed for a binary patch update are often less than 1% of the size of a full update, taking advantage of the large amount of redundancy in the two versions.

    The use of incremental update methods allows for smaller updates which can be distributed by means that are not conducive to the distribution of full updates, such as distribution over the Internet. The smaller incremental updates also make distribution by floppy disk more feasible where a full update would have required many disks, and an incremental update may require only one. However, incremental update methods introduce another problem: the incremental update is specifically useful for updating only one particular version of a software application to another particular version. When updates occur frequently, as with virus protection software applications, end users may often update from an arbitrarily old version to the newest version, skipping over several previously released versions. An incremental update for the newest version of a software application will update only from the most recent version, however.

    One solution to this problem has been for software publishers to group a number of binary patch data files together into one distribution. The user of an arbitrarily old version can then apply each incremental update, one at a time, to update to the newest version. However, the number of incremental updates may be large, due to the fact that the grouping covers a large number of versions. The benefits of smaller distributed update files begin to disappear, as the size of the grouped-together incremental updates grows. This method of updating applications can also be cumbersome, as a series of update patches need to be selected from the group and applied to the software application one after another.

    Another solution to the problem of incremental update version-specificity has been to create a unique patch file for transforming every previous version of the application to the most current version. Some users may not wish to update their software applications to the most current version, however, for a number of reasons. Some may be within a corporate setting, where an information services department allows updates only to versions it has had a chance to test and approve. Others may have older computer systems which do not support the increased resource requirements of the newest version of an application. For these reasons, publishers of software updates using this method must generally keep updates available from every previous version of an application to a large number of more recent versions. This results in a geometrically growing number of update patch files to produce, store and maintain for users. In the case of publishers who update their applications frequently, such as publishers of virus-protection software applications, this may quickly become untenable.

    One alternative to the methods described above is the use of "push" technology, in which servers maintain databases of what versions of a software application each user has. The servers then send the necessary updates to each user, as they become available. This system requires "smart" servers, however, to monitor user configurations, determine what each user needs, and send the appropriate update information. This results in a server-intensive system which can cause a drain on server resources comparable to that experienced in the full update scheme, when many users are simultaneously requesting full updates.

    What is needed is a system for updating software applications from an arbitrary first version to an arbitrary second version which does not require a large amount of information to be stored and maintained by a software publisher, does not require the user to acquire a large amount of data to perform such an update, and does not require the use of "smart" servers.
  10. Re:patch by Stephen+Samuel · · Score: 2
    On second thought: This patent isn't quite what RCS/CVS systems do. It's rather like a cross between RCS/CVS and the BSD Dump/Restore incremental backup/restore system. You have multiple 'layers' of updates. Using the 'dump' analogy they would be equivalent to 'daily', 'weekly' and 'monthly' patch sets. To do an update from the March 17 versions, you'd grab the dailies from March 17 to the end of the week, the weeklys to the end of March and the monthlys to the most recent month. You'd then get the last couple of weeklies and dailies to get to today's version.

    In my mind, the most 'interesting' aspect of this patent is the layering mechanism. On the other hand, I don't know if there's enough unique ideas between the RCS type stuff, incremental backups and this patent to make this into a patentable improvement. Definitely, I don't see this as being anything like the basic patent that they seem to be making it out to be.
    --

    --
    Free Software: Like love, it grows best when given away.
  11. And with this... by dave-fu · · Score: 3

    ...we all get that much closer to realizing The Onion's dream of seeing Microsoft patent ones and zeroes.

    --
    Easy does it!
    This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
  12. patch by wiredog · · Score: 2

    Actually, I think, from a cursory look through the pages, that this is different from the way that the common "patch" program works. Oh well, I run SuSe, so I don't use Symantecs stuff anyway.

    1. Re:patch by Stephen+Samuel · · Score: 2
      This would be more like
      cnews3.5-4.1.patch
      This would be a patch file to update version 3.5 to 4.1 . This sort of update-series patches was one of the methods used to distribute changes to things like news readers, compilers, etc. (pre-CVS).

      From what I can see, the biggest differences are:

      1. It's automated
      2. It seems to specify updates of only binary files.
      3. It may include files describing precisely how the update occurs (This may have been just part of their example)

      --
      --
      Free Software: Like love, it grows best when given away.
    2. Re:patch by Mr+Z · · Score: 2
      Actually, I think, from a cursory look through the pages, that this is different from the way that the common "patch" program works.

      It is, but it's not that much different than how RCS and CVS work. The main difference is that the differences are generated between the version of software being updated and the desired version. Since there could (theoretically) be hundreds of "versions" out there, there needs to be some way of finding out the starting version, and then applying the appropriate patches.

      If I do a cvs update -ttag in my CVS work area, the CVS software looks at my Entries files and determines what versions I presently have checked out of the various files CVS controls. It then queries the server, which sends tailored diffs that will bring my work area in sync with the version specified by the provided tag. (Or, I can leave off the tag and be up-to-date with the most current version.) These diffs are generated specifically between the desired version and the currently checked out version. Additionally, CVS will try to merge differences if any of the patches don't apply cleanly (such as on files that I've edited locally, but have not checked in).

      That sounds an awful like what the virus vendors are claiming to do, and I think RCS (upon which CVS is originally based) has definite prior art here. The oldest reference I've found to RCS is: Walter F. Tichy, RCS--A System for Version Control, Software--Practice & Experience 15, 7 (July 1985), 637-654. (Type man rcs if you have RCS installed.)

      --Joe
      --
  13. is that light I see? by tewwetruggur · · Score: 2
    my god, has a company actually filed for a patent for a specific purpose?

    It's kinda hard to tell, unless I missed something in the article, but it really looks like a perfectly good reason to file for a patent: a process that does something specific. Wow, who'd-a-thunk-it? This one may really have been done "right"... based on prior art, but improving upon it, with a specific purpose - what more can you ask for in a patent... (rhetorical question).

    I am eager to see what else spawns from this - whether it be lawsuits (bad), cross-lisencing (acceptable), or nothing (fine by me). Until then, I await further news.

    --
    Hi! This is the Sig, blatantly attached to the end of this comment.
  14. Re:Hold your horses by FattMattP · · Score: 3

    Oh, like diff and patch. Thanks for the insight. Way to "innovate" there.

    --
    Prevent email address forgery. Publish SPF records for y
  15. Re:Hold your horses by redhog · · Score: 3

    More like rsync probably...

    --
    --The knowledge that you are an idiot, is what distinguishes you from one.
  16. Not to worry.. by proxima · · Score: 2

    This doesn't really bother me, even the article states:

    Yet incremental updates have been around for a long time, most likely for longer than the Internet has been around.

    While the patent is pretty stupid, I've got a feeling that no competitor of Symantec's will need to license whatever updating technology they use. One of the patents seems incredibly vague to me, stating:

    A software application (110) is updated to a newer version by means of incremental update patches (122). The incremental update patches (122) each contain that information necessary to transform one version of an application to another version. Any version of an application (110) may be upgraded to any other version of the application, through the use of a series of incremental update patches (122). The appropriate incremental update patches (122) are distributed in a multi-tiered manner, such that some update patches (122) update the application (110) by only one version, and others update the application (110) by several versions.

    Perhaps others can shed some light on this one (the multi-tiered patent), but it sounds to me like similar technology to update patches used everywhere - small chunks downloaded to update a program from one version to another. Oh well, we'll see what happens.

    --
    "The universe seems neither benign nor hostile, merely indifferent." --Carl Sagan
  17. Re:Hold your horses by TechLawyer · · Score: 2

    You participated in the development of intellectual property? Admitting that around here is like drawing a target on your forehead.

  18. Re:Wrong. Claims are ORed. by mcoletti · · Score: 3
    Have you actually read the reference you use?

    Here's a relevent quote:

    For example, there might be a claim specifying that the speaker cone angle is between 40 and 45 degrees, and that the speaker magnet is made of an alloy of iron and nickel, in which nickel makes up at least 5% of the alloy by weight (clearly I am just making this up, and I don't know anything about speaker cones, magnets or metallurgy). In order for the claim to be allowed by the Patent Office, a patent examiner must be unable to find an example of a speaker with a cone of the claimed shape and with a magnet of the claimed type. To infringe that claim, a speaker must have both these claim elements. Any speaker with both elements is an infringing device, and any speaker without both elements is (probably) not an infringing device.

    (Emphasis added is mine.)

    So it is NOT OR; it's AND .

    Furthermore, you should probably best refer to the USPTO as a canonical reference and not a /. article.

    --

    MAC | A polar bear is a cartesian bear after a coordinate transform.

  19. Fatality != Deep Penetration by Christopher+B.+Brown · · Score: 2
    Yes, rm -rf * is a bad security penetration. And someone who dies of starvation due to a bad worm is every bit as dead as someone who succumbs to Lassa fever.

    The worm is still not so pervasive as a virus that resides in virtually every cell of the body.

    --
    If you're not part of the solution, you're part of the precipitate.
  20. Re:Patent for protection or profit? by Chairboy · · Score: 2

    Do you really think we're gonna sue anybody? Probably not. Heck, apparently our legal department doesn't care about www.liveupdate.com, a Crescendo site named after our updater (the name of which we have trademarked).

    I know you're looking for an example of some huge evil corporation intent on squashing everybody like bugs using a mighty system of patents, but Symantec is a company run by and composed of people. Darth Vader does not roam the halls.

  21. And now, a word from our sponsor... by ackthpt · · Score: 2
    Let me speak on behalf of Semantec, by thanking all those hard working individuals who create virii and dilligently strive to keep one step ahead. Without your tireless efforts to display your 31337 5ki11z, revealing the truth of ugly, shabby, bloated and loophole-ridden software, we wouldn't have such wonderful entertainment in the news every few months and Semantec wouldn't be making the biggy-whopper-bucks, thus feeling the urge to protect their invention. No problems with prior art, either, I expect.

    All said with a straight face. I've had my meds today...

    --

    --

    A feeling of having made the same mistake before: Deja Foobar
  22. Re:Hold your horses by JoeBuck · · Score: 5

    No, I won't hold my horses, because I've just read Claim 1 of patent 6,052,531. That claim is very general, and there is tons of prior art. Claim 1 tries to conver any system in which there is more than one patch to be applied, at least one "update source", with no qualifications on what that update source is, containing the patches, and finally, a client "disposed to receive transmitted patches from each update source". Guess what: CVS infringes, except that it is prior art. Even the Linux script for seeking out and applying patches infringes.

    You may have patentable technology here, but only if the claims are rewritten so as not to cover anything that already exists.

  23. Patent system... by DeepDarkSky · · Score: 2
    I don't know enough about the patent system and how people do patent searches and how the PTO grants patents.

    That said, it seems to me that the number of patent applications would be increasing. It also seems to me that the number of prior patents that must be searched by patent attorneys and PTO clerks is also constantly increasing. As patents expire, of course, that number decreases as well, but nonetheless, it just seems to me that the system is going to be more and more difficult to work with and more and more inefficient.

    Of course, it the patents are categorized hierarchichically and cross-categorized, then the amount of searches required can by much more efficient and smaller...but again, I don't know how it works. Does anybody have any idea of how this works?

  24. Re:what's going on here? by tchuladdiass · · Score: 2
    Basicaly, it's like this: A patent examiner has a limited amount of time to process a patent. The patent office gets money for each patent they grant (whether or not it's overturned later). The examiner only looks for published prior art (such as trade journals). They typically can't refuse a patent based on the "obvious to one skilled in the art" clause (unless it is something blatently obvious), because that would constitute the individual examiner making a judgement call based on her personal opinion... there's just too much room for inconsistencies among the various examiners. Therefore, they let the courts decide whether the patent has merrit.

    Also, just because someone has used a technique before, it only constitutes prior art if the technique was published. If the technique is kept secret (i.e., closed source), then it is considered a "trade secret", in which another party is free to discover the technique on her own (and subsequently patent the discovery). If I recall correctly, it used to be the case that if someone got a patent on something you held as a trade secret, they could come after you and charge royalties for using their patent, even though you've been using the "invention" for a number of years. This clause has been recently cleared up, so that any previous inventors of a patented invention can continue to use said invention in their own products, they just can't license it out to other parties.

  25. Re:Wrong. Claims are ORed. by Sodium+Attack · · Score: 3
    Have you actually read the reference you use?

    Have you actually read the very reference you quoted????!!!!

    Elements within a claim are ANDed. That's what your reference means by "claim elements." (Gee, "claim elements" is not the same as "claims." Who'd'a thunk it?)

    The claims themselves are ORed. (Note that the reference you quote talks about "a claim," not "claims."

    So if a patent reads:

    I claim:

    1. A device consisting of A, B, and C.

    2. A device consisting of D, E, and F.

    You are infringing that patent if and only if you are doing ((A and B and C) or (D and E and F)).

    Clear now?

    --

    Never take moderation advice from sigs, including this one.

  26. Re:Moderators, please correct the moderation by Sodium+Attack · · Score: 2
    You're correct that the determination of novelty is different than the determination of infringement. However, you're confusing claims with claim elements.

    If X1 and X2 are claims in one patent and Y1 and Y2 are claims in another patent, then a patent application consisting of X1 and Y2 and Z is a perfectly valid.

    If a single claim in the new patent is a combination of X1 and Y2 and Z, then yes, it is valid.

    If the new patent has X1 in one claim, Y2 in another, and Z in a third, it is not. Each claim is like a little mini-patent in its own right. In patent validity cases, it's common for the judge to uphold some of the claims in a patent while striking down others.

    Violation(Patent) = Violation(Claim1) AND Violation(Claim2)

    Simply untrue. Violation(Patent)=Violation(Claim1) OR Violation(Claim2). I believe you are confused because within a claim, there can be multiple elements: Violation(Claim1)=Violation(Element1A) AND Violation(Element1B) AND Violation(Element1C).

    Novelty(Patent) = Novelty(Claim1) OR Novelty(Claim2)

    Technically, speaking of the "novelty" of a patent is meaningless, because each claim is evaluated for novelty on its own. If Claim1 is not novel, Claim1 would be struck down in a court case (in a perfect world). If Claim2 is not novel, Claim2 would be struck down in a court case. If none of the claims in a patent are novel, the entire patent could be struck down, but as far as the legal effect goes that's just the same as every claim in the patent being struck down.

    Novelty(Claim3)=Novelty(Element3A) OR Novelty(Element3B) OR Novelty(Element3A + Element3B)

    By which I mean by the last part, even if 3A and 3B are both known, Claim3 can still be valid if it combines 3A and 3B in a non-obvious way.

    --

    Never take moderation advice from sigs, including this one.

  27. Elements in a claim vs. claims in a patent by yerricde · · Score: 2

    To infringe that claim, a speaker must have both these claim elements. Any speaker with both elements is an infringing device, and any speaker without both elements is (probably) not an infringing device.

    Said quote refers to one claim. To infringe a claim, a device must have all the elements of the claim. But infringing even one claim of the patent is sufficient to infringe the patent.

    refer to the USPTO

    I found some general patent information on the USPTO's site. But I also found this on uspatentagent.com (not affiliated with USPTO) and this ruling in which damages of $324.4 million were awarded for infringement of one claim of a patent with six claims.


    Like Tetris? Like drugs? Ever try combining them?
    --
    Will I retire or break 10K?
  28. Re:A Letter to Symantec CEO John W. Thompson by TheBracket · · Score: 2
    Great, now they'll try and sue Mr. Torvalds. ;-p Seriously, I share the sentiments of your letter. Is there a foundation dedicated to overturning ludicrous patents, yet? Sounds like a worthy cause to me.

    --
    Lead developer, http://wisptools.net
  29. Re:Can I patent... by Enoch+Root · · Score: 2

    Sorry dude. You're truly barking up the wrong tree. Ask anyone around here who knows me. Relax... Pleasing everyone is just a waste of time.

  30. A Letter to Symantec CEO John W. Thompson by cliffy · · Score: 5
    Here's the text of a letter that I will be mailing to Symantec CEO John W. Thompson today. Please feel free to use the body of the letter yourself. Note that I am mailing this the old-fashioned way. A storm of email is too easy to launch; it takes dead trees to garner the attention of most CEOs and politicians.

    Dear Mr. Thompson:

    I am writing to express my extreme disappointment with your decision to pursue and attempt to enforce a patent on "microdefinition technology" as discussed in your Feb. 7, 2001, press release.

    The patenting of obvious technology in the face of a preponderance of prior art is a grave threat to true innovation, does a great disservice to the consumer, and has made our patent office the laughing-stock of the technical community. To be clear, the ability to download files that allow incremental patching of existing running software has been available for many years on Unix and Linux systems. Your attempts to enforce a patent on this reflect a complete disregard for your customers and potential customers that is not in accord with what I have come to expect from Symantec.

    I deeply regret that Symantec has chosen to join in the software patent land-grab. Unless Symantec takes action to allow this technology to remain freely available I will have no choice but to remove Symantec from the list of suppliers that my clients and I can trust with our business.

    Very Sincerely,

    Curtis Clifton

  31. Re:Can I patent... by Enoch+Root · · Score: 2
    Rev!

    Where have I been? Switching jobs, working my ass off trying to launch a company, dating an incredibly beautiful and bright woman... You'd post to Slashdot often if you were me? :)

    Any such thing as a secret sid nowadays? Would you care to drop me a note by email and let me know where the action's at? I miss the Old Boys Club...

  32. Re:Someone get larry wall on the phone.. by treke · · Score: 2

    Perl appears to have been around since about 1987, but patch looks like it dates back to about 1984. I'm not certain, but I don't think Norton Antivirus is older, or even that old.
    treke

  33. Re:Where's the patent? by technos · · Score: 2

    The legal definition of "obvious to a person skilled in the art" is "the invention has been described in a publication more than one year before the filing date."

    Let me make this short. No.

    Those are two seperate test clauses you've managed to run together. The important bits are:

    (from 35 U.S.C. 103) "if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains."

    (from 35 U.S.C. 102) "the invention was patented or described in a printed publication in this or a foreign country or in public use or on sale in this country, more than one year prior to the date of the application for patent in the United States"

    In this case, it probably passes the test in 102 (Only Symantec knows) but it fails 103 miserably. Far more than miserably in fact, as I am a programmer of much less than ordinary skill. For me, a compiler is more useful as a spelling / grammar checker than as an actual compiler.

    --
    .sig: Now legally binding!
  34. Re:Hold your horses by Chairboy · · Score: 2

    Right, but unlike you and most of the FP'ers, I actually KNOW what this is about because I was involved. Plus, I _did_ take the time to read the article before I posted.

  35. Re:Patents == bad, but Symantec == good! by RareHeintz · · Score: 5
    They were the first ones to provide what the industry needed for so many years: a centralized repository of information and knowledge about malicious code -- one that hasn't been replicated...

    Um... Not sure if you meant that to be a troll or not. But how about CERT?

    And by the way, Symantec isn't doing these things out of the goodness of their hearts. They're a business, and they do it because (directly or indirectly) it brings in money. Crow about their accomplishments if you like, but don't make them out like they're Mother Teresa's Sisters of Digital Mercy - they're a large business, and therefore (practically by definition) almost certainly amoral.

    Troll point number 2: I don't know why you think it takes more or less skill to detect a virus not in the wild than one in the wild. That's inane. I'd actually think that figuring out the ones in the wild would be harder, since they're the ones original enough to get through emplaced defenses in the first place.

    In the future, remember: Think, then post.

    OK,
    - B
    --

  36. Do you need to patent it? by The+Wookie · · Score: 2


    Couldn't you sue them under DMCA?

  37. I do this every day by Darkstorm · · Score: 2

    well, lets see...most virus checkers call their virus definition files a database...hence a table of viruses and how to identify them. Now last I recall inserting and updating databases have been happening for many many years. And yes this even happens remotely over the internet, or TCP/IP which could be concidered the same thing.

    So it seems to me they are pattening sycronizing a database. Won't hold.

    --
    If ignorance is bliss, the world is full of blissful people
  38. Re:Patents == bad, but Symantec == good! by tewwetruggur · · Score: 3
    A point to add about Symantec: Nowhere has it said that they are going after anyone for violating their patents, which is what is oft seen anymore. Their patent does not seem to be on the "quick cash" bandwagon. The article stated that Symantec did notify their competitors of the patent... this is not unheard of - call it professional courtesy.

    As bad as the patent scene has been lately, its actually nice to see a patent that doesn't seem to be frivolous (aka - instant cash by way of multiple lawsuits). It seems that Symantec felt their process was unique, was a vast improvement upon existing methods, and was important enough to protect. This is what patents are for. Too bad other companies see them as an income source.

    Reform the patent process.

    Yes. Write your Congressmen, write your Senators, let them know that the people who elected them expect more. The US Patent Office won't improve unless the people damand it.

    --
    Hi! This is the Sig, blatantly attached to the end of this comment.
  39. Excellent. Now I can sue them. by miracle69 · · Score: 5

    I currently own the patents on several viruses that use proprietary technology to spread themselves across the internet. Reverse engineering these viruses is explicitly prohibited under the DMCA and I shall now proceed to sue the socks over anyone who reverse engineers my virii and figures out how to bypass or disable them.

    --
    Linux - Because Mommy taught me to Share.
  40. Full Vision Anti-Aliasing by iamriley · · Score: 2

    Full Vision Anti-Aliasing (FVAA) Patent:

    This patent covers a method to smooth edges seen by the human eye. With this method, sharp edges (or "jaggies") normally seen by the human eye are softened by the process of bending the lens of the eye a small amount so that the focal point of the light passing through the lens is just in front of the retina rather than right on it. Since this is simply a readjustment of a sensory input, no additional processing power is required by the brain to smooth out the "jaggies". This a truly amazing breakthrough for human vision.

    (In case you didn't catch it, this is a patent on near-sighted vision.)

    --

    If you can read this, then I forgot to check "Post Anonymously".

  41. Re:Yay Webster... by skt · · Score: 2

    I like this one better...

    jargonfile definition:

    virus

    virus n. [from the obvious analogy with biological viruses, via SF] A cracker program that searches out other programs and `infects' them by embedding a copy of itself in them, so that they become Trojan horses. When these programs are executed, the embedded virus is executed too, thus propagating the `infection'. This normally happens invisibly to the user. Unlike a worm, a virus cannot infect other computers without assistance. It is propagated by vectors such as humans trading programs with their friends (see SEX). The virus may do nothing but propagate itself and then allow the program to run normally. Usually, however, after propagating silently for a while, it starts doing things like writing cute messages on the terminal or playing strange tricks with the display (some viruses include nice display hacks). Many nasty viruses, written by particularly perversely minded crackers, do irreversible damage, like nuking all the user's files.

    In the 1990s, viruses have become a serious problem, especially among Wintel and Macintosh users; the lack of security on these machines enables viruses to spread easily, even infecting the operating system (Unix machines, by contrast, are immune to such attacks). The production of special anti-virus software has become an industry, and a number of exaggerated media reports have caused outbreaks of near hysteria among users; many lusers tend to blame _everything_ that doesn't work as they had expected on virus attacks. Accordingly, this sense of `virus' has passed not only into techspeak but into also popular usage (where it is often incorrectly used to denote a worm or even a Trojan horse). See phage; compare back door; see also Unix conspiracy.

  42. Re:Virus patents by slickwillie · · Score: 2

    Has anyone heard of any patents pending or granted for a computer virus?

    Well, yes, if M$FT has any patents on any Windows technology.

  43. Re:Patents == bad, but Symantec == good! by RareHeintz · · Score: 2
    Touche`. But then again, I hear that has a lot to do with their vendor notification policy on security issues. They are at least in the business of doing the Right Thing, even if they take their sweet time about it.

    And I just thought of another good, centralized repository of virus and security info: Bugtraq. I don't know that they're largest or most authoritative in the world, but I think they're certainly worthy of notice.

    Anyone else have a favorite repository of security info that the original poster in this thread missed?

    OK,
    - B
    --

  44. Lets Patent Virii! by EXTomar · · Score: 2

    I think I should patent the computer virus so those guys who write anti-virus software will have to pay me for doing anything with any virus. I wonder if it will actually get by the USPO?

    1. Re:Lets Patent Virii! by wiredog · · Score: 2
      I wonder if it will actually get by the USPO?

      Why would the United States Post Office care?


  45. Wrong. Claims are ORed. by yerricde · · Score: 3

    Yes, but the claims of a patent are ANDed together. To infringe, you have to have a product that not only falls under Claim 1, but also Claim 2 AND 3 AND 4 AND...

    B*llsh*t. Patent claims are ORed. If you infringe one claim of any of the 2-million-odd unexpired U.S. patents, you can be sued, and if you are an individual, the corporation suing you (lawyers don't sue people; plaintiffs sue people) will run the trial so long that you run out of money to pay your attorney(s).


    Like Tetris? Like drugs? Ever try combining them?
    --
    Will I retire or break 10K?
  46. Moderators, please correct the moderation by JoeBuck · · Score: 3

    The "informative" tag should be immediately removed from gregbaker; he is asserting an outright falsehood. Patent claims are not ANDed. If they were, why would anyone issue a patent with dozens of claims? Because patent claims are ORed, not ANDed, patent lawyers try to claim as many distinct things as possible.

    Drop him down to a -1, with extra negative karma points for assertively claiming something when he has no clue.

  47. rsync by MikeBabcock · · Score: 2

    If the other manufacturers want to make life easy on themselves, they could always just use rsync to update virus signatures. They couldn't* be sued for the method because of the huge amount of prior art (using rsync to update things ... ).

    * Sure, they could be sued ... but ...

    --
    - Michael T. Babcock (Yes, I blog)
  48. If you say so . . . by werdna · · Score: 2

    I have seen these assertions so many times before. If you are right, no problem, the patent is invalid and we are done. If "precisely this technique" has not been used before, however, further analysis (and therefore thought) is required.

    And yes, virtually every patent adds elements to existing prior art. In all of these matters, the devil is in the details.

  49. Fear my patent! by PsychoSpunk · · Score: 2
    I have been watching nearly the entire population of the planet for a year, and I think it is time to inform you that I have a patent for numerical precedence based on ascension. I have felt it was necessary to gather enough evidence that the entire population was infringing on my patent before bringing it to the legal system. It appears that major sites like eBay, PerlMonks, this, among other sites are in non-compliance.

    The primary infringement is that each new item posted to the sites that are non-compliant are numerically assigned a value that has incremented from the last previous item posted to the site. The infringement is not limited to the Internet, however, and it appears that the methods involved with my numerical ascension have been stolen by numerous companies, organizations, and groups. Furthermore, the methods have been provided without my permission for use to be taught to children in our school systems.

    This post (which ironically enough is in non-compliance), will serve as my notice to cease using the methods for determining numerical precedence based on ascension.

    Thank you.

    --
    ALL HAIL BRAK!!!
  50. It's not as specific as you say according... by Sebby · · Score: 3
    ...to the article:

    "Symantec is not only attempting to apply the patents to the antivirus industry but also to the software industry as a whole. In its statement Wednesday, the company noted that 'the technology may be used to update general computer readable files, which may include data files, program files, database files, graphics files, or audio files.' "

    So you're telling us this is somehow different, yet does the same thing as updating "general computer readable files, which may include data files, program files, database files, graphics files, or audio files."

    Excuse me, but this has been done before.

    --

    AC comments get piped to /dev/null
  51. Re:Where's the patent? by technos · · Score: 2

    Did you read the article? (No). What does the article say? To sum it up, "They patented a method of updating virus definition files that is more efficient, using less space than updating the entire file". They said nothing about how. Did I read the patent? If I had, I wouldn't have asked 'Where's the patent'. Now, I just gave you how it is done. Therefore it is obvious.

    In case you misread me again, I'll sum it up in a nice concise all-caps sentance, in bold I may add.

    THE HOW IS OBVIOUS.

    If someone were to ask me how to update any sequence of incrementally changed repeating records with the lowest possible data overhead, I would suggest the same thing; Use a change vector, or as one other poster put it, use a delta. Having now skimmed the patent, it appears to be a multi-part change vector with revision stamping.

    In case you misread me yet again, I'll sum it up in another nice concise all-caps sentance, in bold I may add.

    I TOLD YOU WHAT THE PATENT DID BASED ONLY ON ITS GOAL. IT IS THEREFORE OBVIOUS.

    --
    .sig: Now legally binding!
  52. Symantec == bad too. by milkman1 · · Score: 2

    I don't know, It seems to me that Symantec is not very good company either. While they aren't as big about FUD as say trendmicro, they sell their biggest products (Norton AV) primaily though FUD. Lets face it, virus scanners are not a very good fix to the virus problem, and virus are easy to avoid.

    Additionly most of Symantec's products exist only to fix defficiencies in Windows and MacOS, namely that they don't have any kind of real file protection and they don't have adaquate filesystem management utilities.
    ie
    Norton AV (ugly patch for lack of file protection)
    Norton Utilities (ugly patch for the fact that windows has ugly file and data sturcuites, ie FAT32 and the registry)
    Norton Internet Security (ugly patch for the fact that windows has no access control)
    Norton Ghost (expensive dd clone)
    Basicly their is nothing that Symantec sells that doesn't come with, or isn't needed by Linux or *BSD)

  53. Re:Someone get larry wall on the phone.. by Bob+McCown · · Score: 3

    Its fairly obvious that many of the patents being granted these days have prior art, or violate the "obvious" rule. The patent examiner is noted on the patent. Someone should run through all the silly patents and see if there is a pattern of certain examiners not doing their due dilligence. OR, see if the examiners are being paid off.

  54. just in... virii developer patents virus by ragnar · · Score: 2

    In related news, K00L ACiD, a 13 year old l33t hacker, has announced a patent for his Virus Deployment Apparatus (TM). The system uses an uncanny technique of replicating itself, most often done by the transposing of zeroes and ones from one media to another. When asked how he'll defend the patent, Mr. ACiD explained, "I'll DoS yer sorry ass."

    --
    -- Solaris Central - http://w
  55. Re:Peter Norton by drivers · · Score: 2

    On some Symantec products, they state that the arms-crossed pose of the Holy Pink-shirted One is a trademark of Peter Norton (not Symantec though, Peter Norton is a third party).

    Ah, here it is, from:
    http://www.symantec.com/legal/legal_note.html

    Third Party Trademarks

    Peter Norton, Peter Norton's stylized signature, and Peter Norton's crossed-arm pose are U.S. registered trademarks of Peter Norton.

  56. Re:Can I patent... by Enoch+Root · · Score: 2

    No, and neither can you patent the idea of posting a stupid 'Can I patent something ridiculously common' joke. It's been done to death before by better karma whores than you, and it qualifies as prior art in my book.

  57. wait - prior art from the CDC ... by taniwha · · Score: 2

    why every year they organize the production of a flu vaccine expected to match the viruses live in the general population for that year .... with this long term example of how to handle infectious inofrmation diseases (be they bits or RNA) it would appear to me to be obvious to anyone working in the field ...

  58. cvsup by sirket · · Score: 2

    cvsup, used by FreeBSD to update the system's source code based on CVS trees, is exactly what is described in the first patent. It has the same abilities, including the delta based changes and time based changes.

    In fact, what they talk about is basically a remote revision control system; so how they can claim this as a valid patent is, well, patently absurd.

    This patent needs to be thrown out either because of prior art, or because it is very very vague.

    -sirket

  59. Re:Can I patent... by Enoch+Root · · Score: 2
    Hey, neat!

    I haven't played with my Mindstorms in a little while... I guess they're getting lonely. Last thing I did was a short-term memory buffer using neural networks, to map the room in 2D... Didn't quite work. Nor did the fully mechanical Enigma machine... I think my ideas are better and grander than my building skillz!

  60. Hold your horses by Chairboy · · Score: 4

    I used to be involved in the development of LiveUpdate, and the technology that has the patent here is not simply the updating of programs over the internet, it's a patent on the specific method of how the virus definitions are updated. It's not a simple file replacement methodology, it's closer to a structured delta-based updating technology.

    But I don't expect most of the FP'ers to read the article before they scramble to get a post up in the lucrative first 5 minutes of KarmaHeaven....

    1. Re:Hold your horses by micromoog · · Score: 2
      Posted by CmdrTaco on 12:57 PM
      ...
      by Chairboy (ben@vipmail.com) on 01:03 PM
      ...
      But I don't expect most of the FP'ers to read the article before they scramble to get a post up in the lucrative first 5 minutes of KarmaHeaven....

      Looks like yours came in just over. Sorry, no karma for you.

    2. Re:Hold your horses by Dr.+Dew · · Score: 2

      It's not a simple file replacement methodology, it's closer to a structured delta-based updating technology.

      Next thing you know, folks will be goose-stepping into my computer room demanding my "patent-infringing" differential backups.

      The courts will decide that I can make the backups, which don't actually infringe on the patent. However, I'll have to mail the tapes to the patent-holder, as restoring them would make use of a "structured delta-based updating technology."

  61. Other antivirus vendors? by abischof · · Score: 2

    Along with this and other offenses, I've decided to avoid doing any further business with Symantec. For starters, I've begun to look at other antivirus utilities (primarily for Win2k &#151 stop snickering!). And, so far, Command Antivirus looks to be quite promising, especially since it's available for so many OSs. Any recommendations?

    Alex Bischoff
    ---

    --

    Alex Bischoff
    HTML/CSS coder for hire

  62. Easy solution. by krypt0s · · Score: 2

    If a company pulls crap like this, and it pisses you off... just don't use their software. There's a good, functional, FREE virus scanner at antivirus.cai.com. It seems to detect everything Norton does, and even has a "live update" feature. Grab it while it's still there.

    --
    This is not the sig you're looking for.
  63. Re:Can I patent... by TheReverand · · Score: 2

    hey where you been?

  64. Re:More central to /., how this is good for Linux! by Chairboy · · Score: 2

    Run Norton and Symantec at the same time? Norton Antivirus is MADE by Symantec.

    Difficult to seperate the two....

  65. Prior art: the viruses themselves! by SimHacker · · Score: 2
    Who wants to bet that the viruses themselves implemented and widely dirstributed prior art, of incrementally updating virus software over the net!

    Symantic just copied the idea then patented it.

    -Don

    --
    Take a look and feel free: http://www.PieMenu.com
  66. Haven't we all done this ourselves? by scott1853 · · Score: 2

    Any other programmers out there every had to write anything to update customer data file definitions to a newer version regardless of what the current definition was? I sure have with a few different file formats.

    I sure we can come up with a couple thousand examples of prior art on this one.

    Of course, we must wait until there is a bounty is set.

    Just what the world needs,

  67. Companies that can't compete by khyron664 · · Score: 2

    It seems to me that companies that can't compete or can't find a competitive advantage over the other companies in their field have resorted to patenting things in order to gain this advantage. Virus scanners have been around for a long time, and have been upgrading their databases for a long time, so this patent just seems like an attempt to gain an advantage. The only anti-virus program I found to be any good was AVP, and they're not a major player. I like them because updates were free forever and it could detect more viruses than Norton OR MacCafee. In that business, whoever has the largest virus database the fastest has an advantage. Since most big anti-virus companies are about the same in this regard, is seems Symantec is trying to find another way to get an advantage. Lord forbid they work harder. Course, being a non-windows user means I don't have to worry about things like this, so this really doesn't phase me. :)

    Khyron

  68. Where's the patent? by technos · · Score: 2

    There is only one way I can think of that would be better than a regular UNIXy patch. Using a change vector from another virus. EG, there are fifteen thousand variations on LoveBug and CIM, not to mention the classic Stone-B, each differing only slightly. So, instead of resending the entire definition with each variant, they send a vector that reads 'Variant: STB001. New variant:STB002. New partial search tag at offset 0x003, 0x060F1E667. New partial search signature at offset 0x004, 0x00000000".

    If this is the case, how is it not obvious?

    --
    .sig: Now legally binding!
  69. Peter Norton by FortKnox · · Score: 3

    This is coming from the company that is trying to patent the human being "Peter Norton" (keep in mind he hasn't touched the code for the Norton utilities for several years)... What do you expect?

    --

    --
    Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
  70. Patents == bad, but Symantec == good! by Chuck+Flynn · · Score: 2

    Say what you want about the patent process these days; it's nothing like when I first got started in the industry with IBM back in the day. You can get the slightest piece of crap patented if you write it up well enough and pay a fee, and we all know it.

    But don't demonize Symantec just because you're angry at the US Patent Office. Symantec is a godsend to consumers and industry giants alike, with their rapid proliferation of virus fixes and breaking news about security compromises. They were the first ones to provide what the industry needed for so many years: a centralized repository of information and knowledge about malicious code -- one that hasn't been replicated (much less supplanted) by even the best efforts of free-software advocates. Symantec's virus institute is so sophisticated that they've managed to release updates for viruses that haven't even been spotted in the wild, yet! Now, that takes a lot of skill, so you know they're doing something right.

    Reform the patent process. Don't blame companies who take advantage of whatever they can (before their competitors beat them to it). We'd all be a lot sorrier if someone like Microsoft had gotten this patent than if Symantec had. And we all know it.