Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Patents

Symantec Patents Virus Updates 211

An anonymous reader wrote in to tell us that News.com is reporting that Symantec has a patent for updating their virus definitions incrementally. Symantec has recently informed their competitors of this fact. According to the article, Trend Micro fears not, because they have their own "technology."
This discussion has been archived. No new comments can be posted.

Symantec Patents Virus Updates

Comments Filter:
  • by adric ( 91323 )
    That sounds a lot like how rsync works... checksum the file(s), piece by piece, and transfer only the portions which are different. It's been able to do that for several years now, if I'm not mistaken.
    --
  • Linux doesn't get virii

    I leave it as an exercise to the reader to spot the deliberate mistake!

  • Hehe, how about a virus that makes that stupid Office PaperClip evil (like giving him horns and have him make fun of the user when they make a mistake). Patent that, sue Symantic and make the world a generally funnier place by telling every Office user how stupid they truely are! :)

    "One World, one Web, one Program" - Microsoft promotional ad

  • sadly true. another reason why I would love to see an end to lobbyists... but that's another really ugly issue.

  • No kidding, eh? A virus description file is just a special case of a general file (by definition). The delta diffs, etc, claimed by Symantec have been used for ages to update 'general computer readable files'. Back in the DOS days, anyone remember the patch files for Doom? The patent _does_ say you can patch from any version to any other version (which the Doom patches didn't do), but unlike, say, Microsoft(r) WindowsUpdate(tm) and Service Packs(tm) which download the entire new files the Doom updates were really diffs. Which of course brings up something that has been around for ages, and that is rsync. If generates the differences between any two versions of 'general files' is has indexed and lets you download and apply them to local files.
  • hate the game.


    --
  • gee, I didn't know that we were talking about Linux and *BSD... I could have sworn the discussion was about Symantec and their patent.

    When you're responsible for a large network with a lot of non-tech-savvy people using it, you need virus protection. Yes, obviously educating the user is the best method, but that requires you to take the time and resources to do that. Most companies don't have the time, or can't spent the time. So what options are left...? Say, a program like the variety from Symantec?

    Bash Windows and MacOS all you want. In the end it doesn't matter, especially when its not what we're discussing.

  • The USPTO has no pro-Symantec bias. If another company had come forward with this first, THEY would have the patent and SYMANTEC might be getting sued.

    It's all well and good to complain about the stupid way the Patent Office is handling things (I agree 100%), but corporations can't just sit on their laurels and say "this is a terrible shame", they either work with the system or they go bust.

    In many of these cases, the registering company is registering the trademark just so none of their competitors will get it. The way patents are being handed out for a nickel apiece, it's first come first served. I think the board of directors of Symantec would agree with me that this was their only option.

    Don't be mad at one specific corporation, be mad at the system. Corporations don't have a lot of leeway in how they act, after all. If it were a friendly and happy system, corporations would be friendly and happy (though poor).

    -Kasreyn,
    hoping I made some sense...

  • Gee, you'd think that patents were created so that they could allow companies to compete in a market where a competitor could easily reproduce their product. How shameless a twisting of the original intent this is.

    That is sarcasm.
  • Worms aren't as bad as viruses, whether in the "Animal Kingdom" or in the (actually remarkably good) analogies of the "Computer Kingdom."

    Remember that a virus is much tinier, more pervasive, and more invasive than a worm.

    We see such viruses as Ebola and Lassa that are tremendously fatal. The same is not so true for the worms that likely only live in the GI tract.

    Once invaded by a virus, there is very little that can be done, whether in biological or computer systems; it can potentially get anywhere in the system, and readily be impractical to stamp out. There is no cure to Ebola, for instance.

    In contrast, while worms may cause serious problems, by being largely restricted to the GI tract, and by being vastly larger, they are much more amenable to being flushed out.

    My conclusion would be that viruses are quite a lot worse than worms...

  • ...Computer Associates. (Ok 2 words) Their _Free_ (as in beer) virus scanner picks up stuff that neither NAV or Mcaffee will.

    http://www.ca.com

    Jaysyn

  • I would agree with you except for one thing. They're not just getting them as a preventative measure. If that were the case, there wouldn't be lawsuits about these stupid patents (Amazon's enforcement of 1-click patent comes to mind). They would get the patent and sit on it. The companies realize they can get money from the patents and are using them as such. If Symantec was just getting this patent to prevent from being sued then they wouldn't be talking about pursuing their rights. I could have mis-read the article, but I gathered that they were going to enforce this patent in not just virus updates, but in many other areas. That doesn't sound like a company getting a patent for preventative measures. Just because all the other companies are getting patents and suing doesn't mean any single one has to. It appears that this practice (patenting something after it's widely used) has become a source of revenue, which is sad. I'm not saying not to be mad at the USPTO for creating a scenario that allows this, but the corporations are the ones attempting to uphold their patents. No one is forcing them to sue. If they're getting a patent just for prevenative measures, why would they care if it gets invalided because they don't enforce it? I'd say be angry at both equally.

    Khyron
  • Honestly, please point to the technological innovation preventing Linux from contracting a virus? Post source code showing where this is at.

    Seriously, explain your position. My Win2000 box has never caught a virus. I use Outlook 2000 for my mail, and even have it set up to show executable attachments. We had a breakout of the Prolin trojan last week (and I'd like to thank the particular member of the Linux community who tossed THAT little bundle of joy at me), and my machine didn't catch it. Yet you don't see me trumpeting, "Windows doesn't catch virii!"

    Just because it hasn't doesn't mean it can't.
  • I had one of their soundcards. It was marketed by Reveal (the now bankrupt hardware company that didn't make any hardware). I hated the thing for years because it claimed to be SoundBlaster compatible and was a 16-bit sound card, which led me to believe it was compatible with a SB16. Bzzt! I couldn't play MP3's for a while in Linux until I found a program that jumped the card into MSS compatiblity mode (which was 16 bit). I was quite happy to get it out of my computer when a friend gave me an old SB16.

    Enough rant...

  • Thus spake technos:

    I TOLD YOU WHAT THE PATENT DID BASED ONLY ON ITS GOAL. IT IS THEREFORE OBVIOUS.

    Um, no. The legal definition of "obvious to a person skilled in the art" is "the invention has been described in a publication more than one year before the filing date." It's that simple.

    A patent is a business tool, not a refereed paper. Get over it. Or, if you want to change that, write your congresscritter.

  • Who uses antivirus software anyways?

    They hog system resources, they slow down pretty much EVERYTHING, they require CONSTANT updating, they interfere with installers, and on top of that, they don't fix anything!


    Antivirus software can be very *very* helpful, if they're configured correctly. I worked for the local school district a couple sumemrs ago doing basic software upgrades/configuration on all of the district's PC. Every computer had McAfee installed, but it was almost always poorly configured. The software was often disabled, or not configured to retrieve updates automatically, which made it basically worthless.

    And, suprise surprise, we'd find "nests" of viruses in the labs with poorly configured (or no) virus protection. The PCs, as a result, were baerly functioning. We'd bring McAfee back up to speed, give the computer a thorough scan, and eliminate every trace of trouble, almost with no problem (the most infected machine had over 300 infected files, and it got up and worked fine after a thorough scan). On machines so crippled McAfee couldn't be installed, it was a simnple matter to share it's hardrives across the network, and have McAfee scan the drive remotely, which worked like a charm.

    While AV software might not be as useful on the home PC, I would say it is essential in corporations and large business. And I would recomend getting AV software at home, too, if for nothing else than to scan downloaded files.
  • This article tells us very little about anything. The idea of not having to download the complete program for every update is nothing new.

    Perhaps the idea is that there will be a different file for every virus definition. For example, you have version 5.0 that shipped with 10,000 definitions. The first part of the virus definition file contains a hash value that tells you what definitions you have.

    So, you go to update you virus file from your favorite site. You send the hash value. They then know what 10,000 definitions you have. So the only need to send you the patch that contains the files you need.

    This probably means no pre-defined patches. You will have to make patches on the fly. So person x gets the 100 definitions they need, and person y gets the 200 definitions they need, and these might be separate things.

    This can be cool for several reasons:
    * Everyone gets what they need
    * Conversely, no one gets what they don't need
    * No bad patches
    * No one has archived patches that aren't good anymore
    * Custom programs tailored to the user's needs
    * Saved update time

    I guess we will have to see if this is really anything new or not later.
    ----------------------
    Kurt A. Mueller
    kurtm3@bigfoot.com
    PGP key id:0x4FB5FB1D
  • Has anyone heard of any patents pending or granted for a computer virus?
  • according to the article, Symantec feels these patents cover *any* incremental patches to software. quote from the article: "Symantec is not only attempting to apply the patents to the antivirus industry but also to the software industry as a whole. In its statement Wednesday, the company noted that "the technology may be used to update general computer readable files, which may include data files, program files, database files, graphics files, or audio files." " it will be interesting to see how this absurd patent contention plays out.
  • by ||Deech|| ( 16749 ) on Thursday February 08, 2001 @09:18AM (#446168)
    Here is the link to the patent, if anyone is interested...
    http://www.delphion.com/details?pn=US06167407__

    I couldn't quite wrap my head around it.. but I think they are basically using several different incremental versions of the update, compare it to the current data and then applying the update that is most appropriate.

    i.e. say you start with data version 1.
    you update to version 2
    you wait a while and now they are up to version 5
    when you tell the software to update itself it goes and looks to the server and on the server are 5 different incremental updates:
    1 to 5, 2 to 5, 3 to 5, and 4 to 5
    it realizes that it needs the incremental update from 2 to 5 and loads that one...
    of course, I could be completely off, please correct me if I am wrong..(of course you will, this is /.)
    HAND.
  • Well just because you can think of how to do it after reading the article doesn't make it non-obvious. Just because something seems obvious in hindsight doesnt make it non-obvious to begin with.
  • I don't really diagree with what you say, but NAI [nai.com] have a pretty good online database, open to the public. NAI used to be McAffee, and so are the other big AV company. Unless they got bought by Symantec as well (which is possible - I find it impossible to keep up!).

    And regarding virii not found in the wild...(a) where do they get them from?? and (b) there are plenty of rumors that some (if not most) of these virii which never get seen by the public either don't exist, or are created by the labs (directly or indirectly) to keep the business ticking over. I have no evidence whatsoever that this is the case, but it's an interesting idea...

  • by fatphil ( 181876 ) on Thursday February 08, 2001 @02:05PM (#446171) Homepage
    You haven't thought about what AND-ing and OR-ing really mean. _This is a linguistic issue_.

    If X1 and X2 are claims in one patent and Y1 and Y2 are claims in another patent, then a patent application consisting of X1 and Y2 and Z is a perfectly valid. Novelty to the whole patent can be by the introduction of one novel claim (i.e. a logical OR). However, a violation would need to be a violation of all three things.

    Violation(Patent)
    = Violation(Claim1) AND Violation(Claim2)

    Novelty(Patent)
    = Novelty(Claim1) OR Novelty(Claim2)

    This is why to get over Ericsson's vibrating phone patent, Nokia patented the vibrating battery, only one thing was changed, and it was suddenly a new thing.

    So I'd avoid trying to use these simple AND and OR terms to blithely summarise everything about how patents work, the brush is too broad.

    FatPhil
    -- Real Men Don't Use Porn. -- Morality In Media Billboards
  • Any recommendations

    Switch to Linux.
  • No, I won't hold my horses, because I've just read Claim 1 of patent 6,052,531. That claim is very general, and there is tons of prior art.

    If what you say is true, and there's "tons of prior art" covered by the claim, what's the problem? Patent isn't valid -- go home. (Unless one of the dependent or narrower independent claims survives because there isn't the prior art to defeat it, in which case, what's the problem?) If what you say isn't true, and either the claim isn't valid or the art isn't there, what's the problem?

    You can't read the claim in the abstract -- the terms are defined in and have meaning derived from the prosecution history and the specification. I don't know what does or does not infringe, and would never presume to know without more research and study. This much I do know -- its always best to wait and see before leaping to conclusions.

    The claim does appear to be quite broad, I agree. "Update source" in the specification is defined as a server, but I don't think the term is unclear. The patches must have the required state properties, and be applied in the manner set forth in the claim, as those terms are defined in the spec. How they are construed for trial remains an open question, and it seems that those limitations will be key to any infringement litigation. However, any construction of these claims must be understood in the light that the patentee seems to distinguish CVS and related updating technologies in its discussion of the prior art:


    Some computer software publishers update their software "applications" (computer programs and data files associated with the programs) frequently. For some types of software applications, such as virus protection software, these updates are particularly frequent. Virus protection software applications are designed to detect computer viruses on a computer system, and may also remove viruses which are found. An example of such a software application is Norton Anti-Virus, published by Symantec Corporation of Cupertino, Calif. Because these virus protection software applications rely on data about specific viruses, and new viruses are constantly being written to avoid current virus detection capabilities, it is necessary to update virus protection software applications on a regular basis to account for the newest viruses. Frequent updating of data files is also necessary for some database publishers, who must put up-to-date information in their databases, and remove obsolete information therefrom. Periodic updating of general software applications to expand capabilities and eliminate "bugs" is also common.

    Currently, several methods are used to update software applications. The simplest of these is to distribute one entire software application to replace an older one. This method, the "full update" method, is simple, but expensive and inconvenient. Typically the software is distributed on some type of removable media, such as floppy disks or CD-ROMs, which are costly to produce and distribute. The time an end user must wait for the removable medium to arrive and the time it takes for the software application to install itself on a computer system are inconvenient. This inconvenience is compounded where updates occur frequently. Because of the large size of software applications it is generally not feasible to distribute such updates over computer networks, such as the Internet. When full updates are distributed over the Internet, they often cause such high loads on servers that other users suffer slow-downs on the network, and the servers have trouble meeting the demands.

    In order to bypass many of the problems associated with this type of software updating, some software publishers distribute "incremental updates." These updates do not contain entire software applications, but rather only that information necessary to transform a given version of a software application to a newer version. Among the methods available to perform such incremental software updating is binary patching, performed by programs such as RTPatch, published by Pocket Soft, Inc. A binary patcher replaces only those binary bits of a software application which are different in a newer version. Because most software updates involve changes to only a small portion of a software application, a binary patcher needs, in addition to the old software application, only a small data file including the differences between the two versions. The smaller data files distributed for a binary patch update are often less than 1% of the size of a full update, taking advantage of the large amount of redundancy in the two versions.

    The use of incremental update methods allows for smaller updates which can be distributed by means that are not conducive to the distribution of full updates, such as distribution over the Internet. The smaller incremental updates also make distribution by floppy disk more feasible where a full update would have required many disks, and an incremental update may require only one. However, incremental update methods introduce another problem: the incremental update is specifically useful for updating only one particular version of a software application to another particular version. When updates occur frequently, as with virus protection software applications, end users may often update from an arbitrarily old version to the newest version, skipping over several previously released versions. An incremental update for the newest version of a software application will update only from the most recent version, however.

    One solution to this problem has been for software publishers to group a number of binary patch data files together into one distribution. The user of an arbitrarily old version can then apply each incremental update, one at a time, to update to the newest version. However, the number of incremental updates may be large, due to the fact that the grouping covers a large number of versions. The benefits of smaller distributed update files begin to disappear, as the size of the grouped-together incremental updates grows. This method of updating applications can also be cumbersome, as a series of update patches need to be selected from the group and applied to the software application one after another.

    Another solution to the problem of incremental update version-specificity has been to create a unique patch file for transforming every previous version of the application to the most current version. Some users may not wish to update their software applications to the most current version, however, for a number of reasons. Some may be within a corporate setting, where an information services department allows updates only to versions it has had a chance to test and approve. Others may have older computer systems which do not support the increased resource requirements of the newest version of an application. For these reasons, publishers of software updates using this method must generally keep updates available from every previous version of an application to a large number of more recent versions. This results in a geometrically growing number of update patch files to produce, store and maintain for users. In the case of publishers who update their applications frequently, such as publishers of virus-protection software applications, this may quickly become untenable.

    One alternative to the methods described above is the use of "push" technology, in which servers maintain databases of what versions of a software application each user has. The servers then send the necessary updates to each user, as they become available. This system requires "smart" servers, however, to monitor user configurations, determine what each user needs, and send the appropriate update information. This results in a server-intensive system which can cause a drain on server resources comparable to that experienced in the full update scheme, when many users are simultaneously requesting full updates.

    What is needed is a system for updating software applications from an arbitrary first version to an arbitrary second version which does not require a large amount of information to be stored and maintained by a software publisher, does not require the user to acquire a large amount of data to perform such an update, and does not require the use of "smart" servers.
  • Oh yeah, I forgot. It would only be ok to post 'Can I patent something ridiculously common [that Microsoft does]' to be ok with you. I'll try harder to please you next time.
  • On second thought: This patent isn't quite what RCS/CVS systems do. It's rather like a cross between RCS/CVS and the BSD Dump/Restore incremental backup/restore system. You have multiple 'layers' of updates. Using the 'dump' analogy they would be equivalent to 'daily', 'weekly' and 'monthly' patch sets. To do an update from the March 17 versions, you'd grab the dailies from March 17 to the end of the week, the weeklys to the end of March and the monthlys to the most recent month. You'd then get the last couple of weeklies and dailies to get to today's version.

    In my mind, the most 'interesting' aspect of this patent is the layering mechanism. On the other hand, I don't know if there's enough unique ideas between the RCS type stuff, incremental backups and this patent to make this into a patentable improvement. Definitely, I don't see this as being anything like the basic patent that they seem to be making it out to be.
    --

  • if(Patents == bad){
    printf("bad Symantec");
    }

    if(Symantec == good){
    printf("good Patents");
    }

    Where you looking for an value for that comparison?

  • What if a worm happens to get root and then modifies scripts to rm -rf * during the next reboot? You may call it a worm but I might call it a virus.
  • Why would a virus have copy protection? Isn't that counter to its intended purpose, which is to replicate itself?
  • The description of the patent in the previous post sounds an awful lot like "Windows Update"...


    ---
    "They have strategic air commands, nuclear submarines, and John Wayne. We have this"
  • Yes, but have you read the Patent? Does the Patent describe exactly the software technologies you worked on? A Patent that uses broad general terms in my mind is not about protecting intellectual property. Broad general terms are more suited to preventing competing technologies, and more recently, the profitable litigation path.
  • This description makes it sound a lot like the technique IBM used to maintain VM/370 in the early 1970s, those glorious days when it was maintained in source.

    Each change was distributed as a separate file. When you built the system, the changes were applied, and the result used for the build. If you skipped several patches, all the intervening patches would be applied.

    Another place to look for prior are is in the Marimba http://www.delphion.com/details?pn=US05919247__ [delphion.com] update patent. (I believe that patent fell to prior art, but since it was a similar system, prior art to it may be prior art to the Symantec patent as well.)

  • I don't see why. You can program an extremely trivial program and protect it by copy protection. All that means is someone else can't copy it or (thanks to the DMCA) reverse engineer it. Copy protection just means someone else can't muck with it, but the program can do whatever the original creator designed it to do. Including replicate itself.

    Khyron
  • I would be real interested in see them enforce their patent on the makers of Antiviral Toolkit Pro [www.avp.ru]. However I'm sure they will approach the Russian Mafia and ask advice.....
  • by dave-fu ( 86011 ) on Thursday February 08, 2001 @09:01AM (#446189) Homepage Journal
    ...we all get that much closer to realizing The Onion's dream of seeing Microsoft patent ones and zeroes.
  • Actually, I think, from a cursory look through the pages, that this is different from the way that the common "patch" program works. Oh well, I run SuSe, so I don't use Symantecs stuff anyway.
  • This would be more like
    cnews3.5-4.1.patch
    This would be a patch file to update version 3.5 to 4.1 . This sort of update-series patches was one of the methods used to distribute changes to things like news readers, compilers, etc. (pre-CVS).

    From what I can see, the biggest differences are:

    1. It's automated
    2. It seems to specify updates of only binary files.
    3. It may include files describing precisely how the update occurs (This may have been just part of their example)

    --
  • my god, has a company actually filed for a patent for a specific purpose?

    It's kinda hard to tell, unless I missed something in the article, but it really looks like a perfectly good reason to file for a patent: a process that does something specific. Wow, who'd-a-thunk-it? This one may really have been done "right"... based on prior art, but improving upon it, with a specific purpose - what more can you ask for in a patent... (rhetorical question).

    I am eager to see what else spawns from this - whether it be lawsuits (bad), cross-lisencing (acceptable), or nothing (fine by me). Until then, I await further news.

  • by FattMattP ( 86246 ) on Thursday February 08, 2001 @09:21AM (#446194) Homepage
    Oh, like diff and patch. Thanks for the insight. Way to "innovate" there.
  • by redhog ( 15207 ) on Thursday February 08, 2001 @09:23AM (#446195) Homepage
    More like rsync [freshmeat.net] probably...
  • This doesn't really bother me, even the article states:

    Yet incremental updates have been around for a long time, most likely for longer than the Internet has been around.

    While the patent is pretty stupid, I've got a feeling that no competitor of Symantec's will need to license whatever updating technology they use. One [delphion.com] of the patents seems incredibly vague to me, stating:

    A software application (110) is updated to a newer version by means of incremental update patches (122). The incremental update patches (122) each contain that information necessary to transform one version of an application to another version. Any version of an application (110) may be upgraded to any other version of the application, through the use of a series of incremental update patches (122). The appropriate incremental update patches (122) are distributed in a multi-tiered manner, such that some update patches (122) update the application (110) by only one version, and others update the application (110) by several versions.

    Perhaps others can shed some light on this one (the multi-tiered patent), but it sounds to me like similar technology to update patches used everywhere - small chunks downloaded to update a program from one version to another. Oh well, we'll see what happens.
  • You participated in the development of intellectual property? Admitting that around here is like drawing a target on your forehead.
  • by mcoletti ( 367 ) <mcoletti@@@gmail...com> on Thursday February 08, 2001 @03:30PM (#446199) Homepage
    Have you actually read the reference you use?

    Here's a relevent quote:

    For example, there might be a claim specifying that the speaker cone angle is between 40 and 45 degrees, and that the speaker magnet is made of an alloy of iron and nickel, in which nickel makes up at least 5% of the alloy by weight (clearly I am just making this up, and I don't know anything about speaker cones, magnets or metallurgy). In order for the claim to be allowed by the Patent Office, a patent examiner must be unable to find an example of a speaker with a cone of the claimed shape
    and with a magnet of the claimed type. To infringe that claim, a speaker must have both these claim elements. Any speaker with both elements is an infringing device, and any speaker without both elements is (probably) not an infringing device.

    (Emphasis added is mine.)

    So it is NOT OR; it's AND .

    Furthermore, you should probably best refer to the USPTO as a canonical reference and not a /. article.

  • Yes, rm -rf * is a bad security penetration. And someone who dies of starvation due to a bad worm is every bit as dead as someone who succumbs to Lassa fever.

    The worm is still not so pervasive as a virus that resides in virtually every cell of the body.

  • Do you really think we're gonna sue anybody? Probably not. Heck, apparently our legal department doesn't care about www.liveupdate.com, a Crescendo site named after our updater (the name of which we have trademarked).

    I know you're looking for an example of some huge evil corporation intent on squashing everybody like bugs using a mighty system of patents, but Symantec is a company run by and composed of people. Darth Vader does not roam the halls.
  • Let me speak on behalf of Semantec, by thanking all those hard working individuals who create virii and dilligently strive to keep one step ahead. Without your tireless efforts to display your 31337 5ki11z, revealing the truth of ugly, shabby, bloated and loophole-ridden software, we wouldn't have such wonderful entertainment in the news every few months and Semantec wouldn't be making the biggy-whopper-bucks, thus feeling the urge to protect their invention. No problems with prior art, either, I expect.

    All said with a straight face. I've had my meds today...

    --

  • by JoeBuck ( 7947 ) on Thursday February 08, 2001 @09:31AM (#446217) Homepage

    No, I won't hold my horses, because I've just read Claim 1 of patent 6,052,531 [delphion.com]. That claim is very general, and there is tons of prior art. Claim 1 tries to conver any system in which there is more than one patch to be applied, at least one "update source", with no qualifications on what that update source is, containing the patches, and finally, a client "disposed to receive transmitted patches from each update source". Guess what: CVS infringes, except that it is prior art. Even the Linux script for seeking out and applying patches infringes.

    You may have patentable technology here, but only if the claims are rewritten so as not to cover anything that already exists.

  • I don't know enough about the patent system and how people do patent searches and how the PTO grants patents.

    That said, it seems to me that the number of patent applications would be increasing. It also seems to me that the number of prior patents that must be searched by patent attorneys and PTO clerks is also constantly increasing. As patents expire, of course, that number decreases as well, but nonetheless, it just seems to me that the system is going to be more and more difficult to work with and more and more inefficient.

    Of course, it the patents are categorized hierarchichically and cross-categorized, then the amount of searches required can by much more efficient and smaller...but again, I don't know how it works. Does anybody have any idea of how this works?

  • Basicaly, it's like this: A patent examiner has a limited amount of time to process a patent. The patent office gets money for each patent they grant (whether or not it's overturned later). The examiner only looks for published prior art (such as trade journals). They typically can't refuse a patent based on the "obvious to one skilled in the art" clause (unless it is something blatently obvious), because that would constitute the individual examiner making a judgement call based on her personal opinion... there's just too much room for inconsistencies among the various examiners. Therefore, they let the courts decide whether the patent has merrit.

    Also, just because someone has used a technique before, it only constitutes prior art if the technique was published. If the technique is kept secret (i.e., closed source), then it is considered a "trade secret", in which another party is free to discover the technique on her own (and subsequently patent the discovery). If I recall correctly, it used to be the case that if someone got a patent on something you held as a trade secret, they could come after you and charge royalties for using their patent, even though you've been using the "invention" for a number of years. This clause has been recently cleared up, so that any previous inventors of a patented invention can continue to use said invention in their own products, they just can't license it out to other parties.

  • by Sodium Attack ( 194559 ) on Thursday February 08, 2001 @06:06PM (#446223)
    Have you actually read the reference you use?

    Have you actually read the very reference you quoted????!!!!

    Elements within a claim are ANDed. That's what your reference means by "claim elements." (Gee, "claim elements" is not the same as "claims." Who'd'a thunk it?)

    The claims themselves are ORed. (Note that the reference you quote talks about "a claim," not "claims."

    So if a patent reads:

    I claim:

    1. A device consisting of A, B, and C.

    2. A device consisting of D, E, and F.

    You are infringing that patent if and only if you are doing ((A and B and C) or (D and E and F)).

    Clear now?

  • You're correct that the determination of novelty is different than the determination of infringement. However, you're confusing claims with claim elements.

    If X1 and X2 are claims in one patent and Y1 and Y2 are claims in another patent, then a patent application consisting of X1 and Y2 and Z is a perfectly valid.

    If a single claim in the new patent is a combination of X1 and Y2 and Z, then yes, it is valid.

    If the new patent has X1 in one claim, Y2 in another, and Z in a third, it is not. Each claim is like a little mini-patent in its own right. In patent validity cases, it's common for the judge to uphold some of the claims in a patent while striking down others.

    Violation(Patent) = Violation(Claim1) AND Violation(Claim2)

    Simply untrue. Violation(Patent)=Violation(Claim1) OR Violation(Claim2). I believe you are confused because within a claim, there can be multiple elements: Violation(Claim1)=Violation(Element1A) AND Violation(Element1B) AND Violation(Element1C).

    Novelty(Patent) = Novelty(Claim1) OR Novelty(Claim2)

    Technically, speaking of the "novelty" of a patent is meaningless, because each claim is evaluated for novelty on its own. If Claim1 is not novel, Claim1 would be struck down in a court case (in a perfect world). If Claim2 is not novel, Claim2 would be struck down in a court case. If none of the claims in a patent are novel, the entire patent could be struck down, but as far as the legal effect goes that's just the same as every claim in the patent being struck down.

    Novelty(Claim3)=Novelty(Element3A) OR Novelty(Element3B) OR Novelty(Element3A + Element3B)

    By which I mean by the last part, even if 3A and 3B are both known, Claim3 can still be valid if it combines 3A and 3B in a non-obvious way.

  • To infringe that claim, a speaker must have both these claim elements. Any speaker with both elements is an infringing device, and any speaker without both elements is (probably) not an infringing device.

    Said quote refers to one claim. To infringe a claim, a device must have all the elements of the claim. But infringing even one claim of the patent is sufficient to infringe the patent.

    refer to the USPTO

    I found some general patent information [uspto.gov] on the USPTO's site. But I also found this on uspatentagent.com [uspatentagent.com] (not affiliated with USPTO) and this ruling [iptoday.com] in which damages of $324.4 million were awarded for infringement of one claim of a patent with six claims.


    Like Tetris? Like drugs? Ever try combining them? [pineight.com]
  • Great, now they'll try and sue Mr. Torvalds. ;-p Seriously, I share the sentiments of your letter. Is there a foundation dedicated to overturning ludicrous patents, yet? Sounds like a worthy cause to me.

  • Sorry dude. You're truly barking up the wrong tree. Ask anyone around here who knows me. Relax... Pleasing everyone is just a waste of time.
  • by cliffy ( 17953 ) on Thursday February 08, 2001 @11:33AM (#446230) Homepage
    Here's the text of a letter that I will be mailing to Symantec CEO John W. Thompson today. Please feel free to use the body of the letter yourself. Note that I am mailing this the old-fashioned way. A storm of email is too easy to launch; it takes dead trees to garner the attention of most CEOs and politicians.

    Dear Mr. Thompson:

    I am writing to express my extreme disappointment with your decision to pursue and attempt to enforce a patent on "microdefinition technology" as discussed in your Feb. 7, 2001, press release.

    The patenting of obvious technology in the face of a preponderance of prior art is a grave threat to true innovation, does a great disservice to the consumer, and has made our patent office the laughing-stock of the technical community. To be clear, the ability to download files that allow incremental patching of existing running software has been available for many years on Unix and Linux systems. Your attempts to enforce a patent on this reflect a complete disregard for your customers and potential customers that is not in accord with what I have come to expect from Symantec.

    I deeply regret that Symantec has chosen to join in the software patent land-grab. Unless Symantec takes action to allow this technology to remain freely available I will have no choice but to remove Symantec from the list of suppliers that my clients and I can trust with our business.

    Very Sincerely,

    Curtis Clifton

  • Rev!

    Where have I been? Switching jobs, working my ass off trying to launch a company, dating an incredibly beautiful and bright woman... You'd post to Slashdot often if you were me? :)

    Any such thing as a secret sid nowadays? Would you care to drop me a note by email and let me know where the action's at? I miss the Old Boys Club...

  • Perl appears to have been around since about 1987, but patch looks like it dates back to about 1984. I'm not certain, but I don't think Norton Antivirus is older, or even that old.
    treke
  • The legal definition of "obvious to a person skilled in the art" is "the invention has been described in a publication more than one year before the filing date."

    Let me make this short. No.

    Those are two seperate test clauses you've managed to run together. The important bits are:

    (from 35 U.S.C. 103) "if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains."

    (from 35 U.S.C. 102) "the invention was patented or described in a printed publication in this or a foreign country or in public use or on sale in this country, more than one year prior to the date of the application for patent in the United States"

    In this case, it probably passes the test in 102 (Only Symantec knows) but it fails 103 miserably. Far more than miserably in fact, as I am a programmer of much less than ordinary skill. For me, a compiler is more useful as a spelling / grammar checker than as an actual compiler.
  • Right, but unlike you and most of the FP'ers, I actually KNOW what this is about because I was involved. Plus, I _did_ take the time to read the article before I posted.
  • by RareHeintz ( 244414 ) on Thursday February 08, 2001 @09:38AM (#446243) Homepage Journal
    They were the first ones to provide what the industry needed for so many years: a centralized repository of information and knowledge about malicious code -- one that hasn't been replicated...

    Um... Not sure if you meant that to be a troll or not. But how about CERT [cert.org]?

    And by the way, Symantec isn't doing these things out of the goodness of their hearts. They're a business, and they do it because (directly or indirectly) it brings in money. Crow about their accomplishments if you like, but don't make them out like they're Mother Teresa's Sisters of Digital Mercy - they're a large business, and therefore (practically by definition) almost certainly amoral.

    Troll point number 2: I don't know why you think it takes more or less skill to detect a virus not in the wild than one in the wild. That's inane. I'd actually think that figuring out the ones in the wild would be harder, since they're the ones original enough to get through emplaced defenses in the first place.

    In the future, remember: Think, then post.

    OK,
    - B
    --


  • Couldn't you sue them under DMCA?
  • well, lets see...most virus checkers call their virus definition files a database...hence a table of viruses and how to identify them. Now last I recall inserting and updating databases have been happening for many many years. And yes this even happens remotely over the internet, or TCP/IP which could be concidered the same thing.

    So it seems to me they are pattening sycronizing a database. Won't hold.
  • by tewwetruggur ( 253319 ) on Thursday February 08, 2001 @09:43AM (#446246) Homepage
    A point to add about Symantec: Nowhere has it said that they are going after anyone for violating their patents, which is what is oft seen anymore. Their patent does not seem to be on the "quick cash" bandwagon. The article stated that Symantec did notify their competitors of the patent... this is not unheard of - call it professional courtesy.

    As bad as the patent scene has been lately, its actually nice to see a patent that doesn't seem to be frivolous (aka - instant cash by way of multiple lawsuits). It seems that Symantec felt their process was unique, was a vast improvement upon existing methods, and was important enough to protect. This is what patents are for. Too bad other companies see them as an income source.

    Reform the patent process.

    Yes. Write your Congressmen, write your Senators, let them know that the people who elected them expect more. The US Patent Office won't improve unless the people damand it.

  • by miracle69 ( 34841 ) on Thursday February 08, 2001 @09:44AM (#446247)
    I currently own the patents on several viruses that use proprietary technology to spread themselves across the internet. Reverse engineering these viruses is explicitly prohibited under the DMCA and I shall now proceed to sue the socks over anyone who reverse engineers my virii and figures out how to bypass or disable them.
  • Full Vision Anti-Aliasing (FVAA) Patent:

    This patent covers a method to smooth edges seen by the human eye. With this method, sharp edges (or "jaggies") normally seen by the human eye are softened by the process of bending the lens of the eye a small amount so that the focal point of the light passing through the lens is just in front of the retina rather than right on it. Since this is simply a readjustment of a sensory input, no additional processing power is required by the brain to smooth out the "jaggies". This a truly amazing breakthrough for human vision.

    (In case you didn't catch it, this is a patent on near-sighted vision.)
  • I like this one better...

    jargonfile definition:

    virus

    virus n. [from the obvious analogy with biological viruses, via SF] A cracker program that searches out other programs and `infects' them by embedding a copy of itself in them, so that they become Trojan horses. When these programs are executed, the embedded virus is executed too, thus propagating the `infection'. This normally happens invisibly to the user. Unlike a worm, a virus cannot infect other computers without assistance. It is propagated by vectors such as humans trading programs with their friends (see SEX). The virus may do nothing but propagate itself and then allow the program to run normally. Usually, however, after propagating silently for a while, it starts doing things like writing cute messages on the terminal or playing strange tricks with the display (some viruses include nice display hacks). Many nasty viruses, written by particularly perversely minded crackers, do irreversible damage, like nuking all the user's files.

    In the 1990s, viruses have become a serious problem, especially among Wintel and Macintosh users; the lack of security on these machines enables viruses to spread easily, even infecting the operating system (Unix machines, by contrast, are immune to such attacks). The production of special anti-virus software has become an industry, and a number of exaggerated media reports have caused outbreaks of near hysteria among users; many lusers tend to blame _everything_ that doesn't work as they had expected on virus attacks. Accordingly, this sense of `virus' has passed not only into techspeak but into also popular usage (where it is often incorrectly used to denote a worm or even a Trojan horse). See phage; compare back door; see also Unix conspiracy.
  • Has anyone heard of any patents pending or granted for a computer virus?

    Well, yes, if M$FT has any patents on any Windows technology.
  • Touche`. But then again, I hear that has a lot to do with their vendor notification policy on security issues. They are at least in the business of doing the Right Thing, even if they take their sweet time about it.

    And I just thought of another good, centralized repository of virus and security info: Bugtraq. I don't know that they're largest or most authoritative in the world, but I think they're certainly worthy of notice.

    Anyone else have a favorite repository of security info that the original poster in this thread missed?

    OK,
    - B
    --

  • I think I should patent the computer virus so those guys who write anti-virus software will have to pay me for doing anything with any virus. I wonder if it will actually get by the USPO?
  • by yerricde ( 125198 ) on Thursday February 08, 2001 @11:57AM (#446265) Homepage Journal

    Yes, but the claims of a patent are ANDed together. To infringe, you have to have a product that not only falls under Claim 1, but also Claim 2 AND 3 AND 4 AND...

    B*llsh*t. Patent claims are ORed [slashdot.org]. If you infringe one claim of any of the 2-million-odd unexpired U.S. patents, you can be sued, and if you are an individual, the corporation suing you (lawyers don't sue people; plaintiffs sue people) will run the trial so long that you run out of money to pay your attorney(s).


    Like Tetris? Like drugs? Ever try combining them? [pineight.com]
  • by JoeBuck ( 7947 ) on Thursday February 08, 2001 @12:03PM (#446271) Homepage

    The "informative" tag should be immediately removed from gregbaker; he is asserting an outright falsehood. Patent claims are not ANDed. If they were, why would anyone issue a patent with dozens of claims? Because patent claims are ORed, not ANDed, patent lawyers try to claim as many distinct things as possible.

    Drop him down to a -1, with extra negative karma points for assertively claiming something when he has no clue.

  • If the other manufacturers want to make life easy on themselves, they could always just use rsync to update virus signatures. They couldn't* be sued for the method because of the huge amount of prior art (using rsync to update things ... ).

    * Sure, they could be sued ... but ...
  • I have seen these assertions so many times before. If you are right, no problem, the patent is invalid and we are done. If "precisely this technique" has not been used before, however, further analysis (and therefore thought) is required.

    And yes, virtually every patent adds elements to existing prior art. In all of these matters, the devil is in the details.
  • I have been watching nearly the entire population of the planet for a year, and I think it is time to inform you that I have a patent for numerical precedence based on ascension. I have felt it was necessary to gather enough evidence that the entire population was infringing on my patent before bringing it to the legal system. It appears that major sites like eBay [ebay.com], PerlMonks [perlmonks.org], this [slashdot.org], among other sites are in non-compliance.

    The primary infringement is that each new item posted to the sites that are non-compliant are numerically assigned a value that has incremented from the last previous item posted to the site. The infringement is not limited to the Internet, however, and it appears that the methods involved with my numerical ascension have been stolen by numerous companies, organizations, and groups. Furthermore, the methods have been provided without my permission for use to be taught to children in our school systems.

    This post (which ironically enough is in non-compliance), will serve as my notice to cease using the methods for determining numerical precedence based on ascension.

    Thank you.

  • by Sebby ( 238625 ) on Thursday February 08, 2001 @09:49AM (#446281)
    ...to the article:

    "Symantec is not only attempting to apply the patents to the antivirus industry but also to the software industry as a whole. In its statement Wednesday, the company noted that 'the technology may be used to update general computer readable files, which may include data files, program files, database files, graphics files, or audio files.' "

    So you're telling us this is somehow different, yet does the same thing as updating "general computer readable files, which may include data files, program files, database files, graphics files, or audio files."

    Excuse me, but this has been done before.

  • Did you read the article? (No). What does the article say? To sum it up, "They patented a method of updating virus definition files that is more efficient, using less space than updating the entire file". They said nothing about how. Did I read the patent? If I had, I wouldn't have asked 'Where's the patent'. Now, I just gave you how it is done. Therefore it is obvious.

    In case you misread me again, I'll sum it up in a nice concise all-caps sentance, in bold I may add.

    THE HOW IS OBVIOUS.

    If someone were to ask me how to update any sequence of incrementally changed repeating records with the lowest possible data overhead, I would suggest the same thing; Use a change vector, or as one other poster put it, use a delta. Having now skimmed the patent, it appears to be a multi-part change vector with revision stamping.

    In case you misread me yet again, I'll sum it up in another nice concise all-caps sentance, in bold I may add.

    I TOLD YOU WHAT THE PATENT DID BASED ONLY ON ITS GOAL. IT IS THEREFORE OBVIOUS.
  • I don't know, It seems to me that Symantec is not very good company either. While they aren't as big about FUD as say trendmicro, they sell their biggest products (Norton AV) primaily though FUD. Lets face it, virus scanners are not a very good fix to the virus problem, and virus are easy to avoid.

    Additionly most of Symantec's products exist only to fix defficiencies in Windows and MacOS, namely that they don't have any kind of real file protection and they don't have adaquate filesystem management utilities.
    ie
    Norton AV (ugly patch for lack of file protection)
    Norton Utilities (ugly patch for the fact that windows has ugly file and data sturcuites, ie FAT32 and the registry)
    Norton Internet Security (ugly patch for the fact that windows has no access control)
    Norton Ghost (expensive dd clone)
    Basicly their is nothing that Symantec sells that doesn't come with, or isn't needed by Linux or *BSD)
  • by Bob McCown ( 8411 ) on Thursday February 08, 2001 @09:53AM (#446291)
    Its fairly obvious that many of the patents being granted these days have prior art, or violate the "obvious" rule. The patent examiner is noted on the patent. Someone should run through all the silly patents and see if there is a pattern of certain examiners not doing their due dilligence. OR, see if the examiners are being paid off.
  • In related news, K00L ACiD, a 13 year old l33t hacker, has announced a patent for his Virus Deployment Apparatus (TM). The system uses an uncanny technique of replicating itself, most often done by the transposing of zeroes and ones from one media to another. When asked how he'll defend the patent, Mr. ACiD explained, "I'll DoS yer sorry ass."
  • On some Symantec products, they state that the arms-crossed pose of the Holy Pink-shirted One is a trademark of Peter Norton (not Symantec though, Peter Norton is a third party).

    Ah, here it is, from:
    http://www.symantec.com/legal/legal_note.html [symantec.com]

    Third Party Trademarks

    Peter Norton, Peter Norton's stylized signature, and Peter Norton's crossed-arm pose are U.S. registered trademarks of Peter Norton.

  • No, and neither can you patent the idea of posting a stupid 'Can I patent something ridiculously common' joke. It's been done to death before by better karma whores than you, and it qualifies as prior art in my book.
  • why every year they organize the production of a flu vaccine expected to match the viruses live in the general population for that year .... with this long term example of how to handle infectious inofrmation diseases (be they bits or RNA) it would appear to me to be obvious to anyone working in the field ...
  • by sirket ( 60694 )
    cvsup, used by FreeBSD to update the system's source code based on CVS trees, is exactly what is described in the first patent. It has the same abilities, including the delta based changes and time based changes.

    In fact, what they talk about is basically a remote revision control system; so how they can claim this as a valid patent is, well, patently absurd.

    This patent needs to be thrown out either because of prior art, or because it is very very vague.

    -sirket
  • Hey, neat!

    I haven't played with my Mindstorms in a little while... I guess they're getting lonely. Last thing I did was a short-term memory buffer using neural networks, to map the room in 2D... Didn't quite work. Nor did the fully mechanical Enigma machine... I think my ideas are better and grander than my building skillz!

  • by Chairboy ( 88841 ) on Thursday February 08, 2001 @09:03AM (#446305) Homepage
    I used to be involved in the development of LiveUpdate, and the technology that has the patent here is not simply the updating of programs over the internet, it's a patent on the specific method of how the virus definitions are updated. It's not a simple file replacement methodology, it's closer to a structured delta-based updating technology.

    But I don't expect most of the FP'ers to read the article before they scramble to get a post up in the lucrative first 5 minutes of KarmaHeaven....
  • Along with this and other offenses [slashdot.org], I've decided to avoid doing any further business with Symantec. For starters, I've begun to look at other antivirus utilities [winmag.com] (primarily for Win2k &#151 stop snickering!). And, so far, Command Antivirus [commandcom.com] looks to be quite promising, especially since it's available for so many OSs [commandcom.com]. Any recommendations?

    Alex Bischoff
    ---
  • If a company pulls crap like this, and it pisses you off... just don't use their software. There's a good, functional, FREE virus scanner at antivirus.cai.com [cai.com]. It seems to detect everything Norton does, and even has a "live update" feature. Grab it while it's still there.
  • Posted by CmdrTaco on 12:57 PM
    ...
    by Chairboy (ben@vipmail.com) on 01:03 PM
    ...
    But I don't expect most of the FP'ers to read the article before they scramble to get a post up in the lucrative first 5 minutes of KarmaHeaven....

    Looks like yours came in just over. Sorry, no karma for you.

  • I wonder if it will actually get by the USPO?

    Why would the United States Post Office care?


  • hey where you been?
  • by Mr Z ( 6791 )
    Actually, I think, from a cursory look through the pages, that this is different from the way that the common "patch" program works.

    It is, but it's not that much different than how RCS and CVS work. The main difference is that the differences are generated between the version of software being updated and the desired version. Since there could (theoretically) be hundreds of "versions" out there, there needs to be some way of finding out the starting version, and then applying the appropriate patches.

    If I do a cvs update -ttag in my CVS work area, the CVS software looks at my Entries files and determines what versions I presently have checked out of the various files CVS controls. It then queries the server, which sends tailored diffs that will bring my work area in sync with the version specified by the provided tag. (Or, I can leave off the tag and be up-to-date with the most current version.) These diffs are generated specifically between the desired version and the currently checked out version. Additionally, CVS will try to merge differences if any of the patches don't apply cleanly (such as on files that I've edited locally, but have not checked in).

    That sounds an awful like what the virus vendors are claiming to do, and I think RCS (upon which CVS is originally based) has definite prior art here. The oldest reference I've found to RCS is: Walter F. Tichy, RCS--A System for Version Control, Software--Practice & Experience 15, 7 (July 1985), 637-654. (Type man rcs if you have RCS installed.)

    --Joe
    --
  • Run Norton and Symantec at the same time? Norton Antivirus is MADE by Symantec.

    Difficult to seperate the two....
  • Who wants to bet that the viruses themselves implemented and widely dirstributed prior art, of incrementally updating virus software over the net!

    Symantic just copied the idea then patented it.

    -Don

  • Any other programmers out there every had to write anything to update customer data file definitions to a newer version regardless of what the current definition was? I sure have with a few different file formats.

    I sure we can come up with a couple thousand examples of prior art on this one.

    Of course, we must wait until there is a bounty [bountyquest.com] is set.

    Just what the world needs,
  • It seems to me that companies that can't compete or can't find a competitive advantage over the other companies in their field have resorted to patenting things in order to gain this advantage. Virus scanners have been around for a long time, and have been upgrading their databases for a long time, so this patent just seems like an attempt to gain an advantage. The only anti-virus program I found to be any good was AVP, and they're not a major player. I like them because updates were free forever and it could detect more viruses than Norton OR MacCafee. In that business, whoever has the largest virus database the fastest has an advantage. Since most big anti-virus companies are about the same in this regard, is seems Symantec is trying to find another way to get an advantage. Lord forbid they work harder. Course, being a non-windows user means I don't have to worry about things like this, so this really doesn't phase me. :)

    Khyron
  • There is only one way I can think of that would be better than a regular UNIXy patch. Using a change vector from another virus. EG, there are fifteen thousand variations on LoveBug and CIM, not to mention the classic Stone-B, each differing only slightly. So, instead of resending the entire definition with each variant, they send a vector that reads 'Variant: STB001. New variant:STB002. New partial search tag at offset 0x003, 0x060F1E667. New partial search signature at offset 0x004, 0x00000000".

    If this is the case, how is it not obvious?
  • by FortKnox ( 169099 ) on Thursday February 08, 2001 @09:10AM (#446356) Homepage Journal
    This is coming from the company that is trying to patent the human being "Peter Norton" (keep in mind he hasn't touched the code for the Norton utilities for several years)... What do you expect?

    --
  • Say what you want about the patent process these days; it's nothing like when I first got started in the industry with IBM back in the day. You can get the slightest piece of crap patented if you write it up well enough and pay a fee, and we all know it.

    But don't demonize Symantec just because you're angry at the US Patent Office. Symantec is a godsend to consumers and industry giants alike, with their rapid proliferation of virus fixes and breaking news about security compromises. They were the first ones to provide what the industry needed for so many years: a centralized repository of information and knowledge about malicious code -- one that hasn't been replicated (much less supplanted) by even the best efforts of free-software advocates. Symantec's virus institute is so sophisticated that they've managed to release updates for viruses that haven't even been spotted in the wild, yet! Now, that takes a lot of skill, so you know they're doing something right.

    Reform the patent process. Don't blame companies who take advantage of whatever they can (before their competitors beat them to it). We'd all be a lot sorrier if someone like Microsoft had gotten this patent than if Symantec had. And we all know it.
  • It's not a simple file replacement methodology, it's closer to a structured delta-based updating technology.

    Next thing you know, folks will be goose-stepping into my computer room demanding my "patent-infringing" differential backups.

    The courts will decide that I can make the backups, which don't actually infringe on the patent. However, I'll have to mail the tapes to the patent-holder, as restoring them would make use of a "structured delta-based updating technology."

I've noticed several design suggestions in your code.

Working...