Just when you thought Google Docs were safe...

Just when you thought you were were safe from Google Desktop exploit, An interesting cross-site scripting (XSS) vulnerability found in the Google Spreadsheets service would have allowed attackers to gain unauthorised access to other Google services, including Gmail and Google Docs.

The vulnerability was discovered by security engineer Billy Rios , and takes advantage of nuances in the way Internet Explorer handles Content-Types for webpages.

When a spreadsheet is saved and downloaded in CSV format, the Content-Type is set to "text/plain", thereby instructing the client's browser that the document should be treated as plain text. However, if HTML tags are entered into the first cell of the spreadsheet, Internet Explorer detects these tags near the start of the CSV document and instead deduces that it should be treated as HTML. This essentially allowed arbitrary HTML webpages to be served from spreadsheets.google.com, which in turn allowed JavaScript to be executed in the context of the spreadsheets.google.com site. A remote attacker could exploit this weakness by stealing the user's session cookies and hijacking their session.

Rios points out that Google cookies are valid for all google.com sub domains. This means that when a user logs in to Gmail, the Gmail cookie is also valid for other Google services, such as Google Code, Google Docs, Google Spreadsheets, and more. Cross-site scripting vulnerabilities in any of these sub domains can allow an attacker to hijack a user's session and access other Google services as if they were that user.

Google has fixed the vulnerability discovered by Rios and there have been no reports of the vulnerability being exploited by attackers.

US Government responds to the idea of patenting movies

It is enough of the creative minds out there to create ideas of patenting movies. (Read the post). (adapted from Greg Aharonian) The US Patent Office just sent out a Response to the first of four movie plot patents submitted by patent lawyer Andrew Knight. The Response is a request for more prior art from Mr. Knight, which is mostly a 103-obviousness concern (with the presumption that his specific plot is 102-novel). Since the Detailed Description has to be 112-ish enough to enable an obviousness determination in light of the prior art, with no 112-clarification questions in the Request, the initial concern of the patent examiner seems to be mostly obviousness-related. This may not mean that the PTO accepts the 101 statutory nature of movie plot patents, with a 101 rejection to appear later in the first Office Action. Still, if the PTO was looking for an easy rejection, a simple 101 First Office Actioni rejection, while not justified, would also not have been unreasonable. It may be that in light of other arguments, the PTO is thinking that maybe fighting movie and music patents, in the long run, is a losing battle (and it is) especially if the 101 arguments are based on nonsense, caselaw pathetic, arguments such as those found in last summer's MPAA submission to the PTO on "functionality" (may that submission find a first use when printed on multiple sheets of toilet paper). Another interesting note: the patent is being examiner in Art Unit 3714, which is for Education and Amusement. Somewhat appropriate, but given the general electro-technical nature of modern movies, maybe not the best match. But if the PTO is going to open to more patenting of the arts, it needs new Art Units (with examiners with degrees in the arts) and new Classification Classes (using classifiers with knowledge of the arts). What follows is the bulk of the text to the PTO's first Response. **** Application/Control Number: 10/722,473 Art Unit: 3714 DETAILED ACTION Request for Information Under 37 CFR 1.105 1. This is one of four related applications (applications numbered 10/722,473, 10/846,544, 10/861,849 and 10/869,082). In each of these applications, Applicant seeks to obtain a patent for a fictional plot or storyline. Applicant has acknowledged that in doing so, he seeks to open up an entirely new area for patent applications. It therefore behooves the Office to have all of the facts concerning the case before rendering an opinion regarding patentability. 2. Furthermore, storytelling is of immemorial antiquity. Throughout recorded history, man has told stories. No doubt storytelling antedates recorded history. One can easiy imagine our Neolithic ancestors lounging about the case spinning yarns. 3. The point is that for tens of thousands of years [greg note: except for creationinsts], people have been telling stories. Each of these stories has a plot. None of these plots will appear in the patent literature. Nor is it possible for the Examiner to search more than a miniscule portion of the prior art - certainly no meaningful search can be accomplished without further information. (not necessarily true, since there are some good plot databases on the Internet, such as IMDB - Internet Movie Database. But this statement is more an examiner's plea for the PTO to not make the mistake they did with biotech and software and bizmet patents, which is to seriously worry about prior art problems decades after the first such patents are filed.) 4. Therefore, in order for Examiner to do an adequate examination of Applicant's invention [note: does this imply that movie plots can be invented under 101?], Examiner requests the following information: a. Whether a search of the prior art was made, and if so, what was searched. b. A copy of any non-patent literature, published application, or patent (U.S. or foreign), by any of the inventors, that relates to, or has a plot/storyline similar to, the claim invention. c. A copy of any non-patent literature, published application, or patent (U.S. or foreign) that was used to draft the application. d. A copy of any non-patent literature, published application, or patent (U.S. or foreign) that was used in the invention process. e. Identification of any use of the claimed invention known to any of the inventors at the time the application was filed notwithstanding the date of the use. f. A copy of any publication of which the Applicant is aware concerning these applications. [note: if Mr. Knight signed an NDA to view one or more publications relevant to his application, is he forced to violate the NDA and submit such information to the PTO?] g. Identification of any court case that Applicant contends provides legal precedent for a grant of patent rights to the application. [note: easy to partially answer this question: EX PARTE LUNDGREN!!!!!!!!!! Mr. Knight has my permission to send a copy of my patenting movie/music article to the PTO. Also, STATE STREET - movie plots are big business!] 5. Examiner realizes that it may prove difficult to provide some of the non-patent literature that might have been used to develop the plots in question. For instance, it might not be practical to submit an entire novel or a motion picture in response hereto. In those cases, Applicant should identify the non-patent literature and provide a synopsis of the plot or other pertinent information. If possible, Applicant should provide copies of any particularly relevant passages. 6. This Requirement for Information under 37 CFR 1.105 is made without an action on the merits and has a shortened statutory period of two months for reply. Applicant may extend the time period for a reply up to six months in accordance with 37 CFR 1.136(a).

Microsoft's iPhoney patent is phoney

Microsoft's new iPhone patent is probably a piece of pure excrement, once you subtract out all of the nonsense in claim 1 and focus on the last two clauses that might be an invention, except for the fact that the patent ignores tons of prior art. The Microsoft patent is: United States Patent 7,225,409 Graphical user interface for a screen telephone (filed August 1999, based on August 1998 provisional) and the only possible "innovation" (someone can explain that to a company that thinks innovation is putting a touch tablet in a coffee table) are the last two clauses of claim 1: and wherein execution of the one or more methods of the application programming interface is responsive to the input from the application for customizing the customizable visual user interface, wherein the telephony module includes an operator agent for determining a media mode of an incoming call. So Microsoft is proud to have invented a customizable telephony app that switches handlers depending on the type of incoming call. This patent so outraged a discriminating member of the patenting community, that he reviewed the filewrapper, and found out the "innovation" is even less - just the last clause, since the examiner rightfully argued the rest of the claim was anticipated by an earlier patent, U.S. patent 5850433. Pathetically, and as an abuse of the PTO's resources, it took Microsoft 8 (non-final) rejections to get this allowance. Worse, this last clause is invalid in light of yet another patent, 5,493,609, the abstract of which talks about media mode switching for incoming calls: A telecommunication system provides voice and data communications over a conventional telephone line that can be dynamically switched from voice mode to any of a plurality of data modes (e.g., fax, modem, or VoiceView protocols) during a single conversation. Each station includes a telephone for voice communications and switching means for selectively connecting the telephone to the telephone line in voice mode and disconnecting the telephone while operating in one of the data modes. A modem provides data communications over the telephone line in any of a plurality of data modes. Voice is the default mode of operation. Prior to switching into a data mode, the originating station first transmits a start signal over the telephone line that includes a mode signal indicating one of the data modes. If a station detects a start signal transmitted by a remote station, a controller directs the switching means and modem to automatically switch from voice mode to the selected data mode in preparation for receiving data from the originating station. The stations also can also query one another to exchange information on their respective capabilities. Now, the switching goes on outside of the conventional telephone, but it is trivial and KSR-like obvious-to-try move the switching into a computer telephony application (for which there is also prior art). So after 8 (non-final) rejections, Microsoft gets a patent claim that with a little more searching can be invalidated. And Microsoft knows this. So why is Microsoft utilizing limited PTO resources pursuing such crap? It is yet another example of Microsoft's lack of interest in patent quality, and makes a mockery of Microsoft's participation in IBM's scam of a prior art project, scam in that both companies could better support patent quality by doing better searches for their own patent applications, instead of abusing the PTO. Both companies lie about their support for patent quality, one reason they are silent on people who lie about their professional experience to become PTO (Deputy) Directors (as if you thought I could resist the sarcasm!)