The software giant’s chief executive on Tuesday unveiled a set of midrange and high-end server systems, powered by a faster version of the Sparc microprocessor line invented by Sun. Oracle said the new systems are much speedier in running an array of applications, including Oracle databases and Java software, and are up to ten times faster than the similarly priced Oracle system it replaces.

Read the rest of this post on the original site »

Sergey Nivens / Shutterstock.com

But that’s not to say that Apple hasn’t been preparing — quietly as always — for the kind of eventualities that tend to crop up when hackers and other digital miscreants are taken to probing your systems for vulnerabilities.

One visible sign of that preparation can be detected in the personnel that Apple has been hiring in the area of software and system security in recent years. Apple rarely if ever comments on any but its most senior hires. Nevertheless, several names have come to light. And while Apple generally doesn’t comment to confirm or deny the role that any of these people may or may not be playing in response to the latest incident, here are some people whose job at Apple involves security.

Craig Federighi: Senior vice president for software engineering, Federighi is in charge of all aspects of Apple’s operating system software, both on the Mac and the iOS platforms, and reports directly to CEO Tim Cook. He inherited responsibility for iOS after last year’s departure of Scott Forstal. He worked at Next Computer, the company Apple acquired in 1996 that brought Steve Jobs back to Apple after more than a decade. Later, Federighi spent a decade at Ariba, including a stint as its CTO. Everyone involved in OS security, whether for the iPhone, iPad or the Mac, reports to him.

David Rice: Hired in 2011 as Apple’s global director of security, Rice is a graduate of the U.S. Naval War College and spent time at the National Security Agency. However, he’s best known for his 2007 book “Geekonomics,” in which he argued that software is a new kind of public infrastructure that when built badly amounts to a public hazard, and those who buy it become virtual crash test dummies who have to suffer with a software industry that is unaccountable for the results.

Window Snyder: Hired in 2010, Snyder lists her title as Senior Product Manager, Security and Privacy. She had previously headed up security operations at Mozilla, the open source software organization responsible for the Firefox Web browser. She has also held software security positions at Microsoft and @stake, a security firm that’s now part of Symantec. She’s listed as co-author, with Frank Swiderski, of a Microsoft-produced book called “Threat Modeling,” which focuses on looking at computer security from the point of view of an attacker.

Ivan Krstić: Hired in 2009, the Croatian-born Krstić is in charge of core OS security on the Mac. He previously ran security for the One Laptop Per Child program, where he came up with a method to secure programs in Linux called BitFrost that wrapped individual programs in their own virtual operating environments so that one couldn’t harm the other. The approach was considered so novel that some suggested incorporating it as a core feature of Linux.

Kristin Paget: Currently a Core OS Security Researcher, Paget is a Microsoft veteran who’s generally credited with “saving Windows Vista” by forcing a delay in that operating system’s release after demonstrating that it wasn’t as secure as previously thought, Paget joined Apple late last year as a Core OS security researcher. Her hiring was first reported by Wired.

Image: Sergey Nivens / Shutterstock.com

In the spate of large companies hacked in recent weeks, it seems that many of them have one thing in common. Many have visited one compromised website specifically devoted to sharing information related to mobile development — and it’s not just tech companies visiting the site.

The site is called iPhoneDevSDK, according to sources close to the Facebook hacking investigation. It’s a hub for many companies concentrated on the mobile space.

After Facebook employees visited the mobile development site in recent weeks, malicious code injected into the HTML of the site used an exploit in Oracle’s Java plug-in to infect employee laptops, as the company divulged last Friday.

When asked for comment on the site in question, Facebook referred us back to the company’s blog post from last week, without going into further detail.

Of note: Do not visit this site, as it may continue to be compromised. While it’s potentially risky to publicize the website, AllThingsD is providing the name to inform readers, developers and organizations interested in mobile development in order to keep them from becoming infected.

Update 4:22 pm PT: Ian Sefferman, owner and operator of the site iPhoneDevSDK, has reached out to AllThingsD and provided the following statement:

“We’re investigating Facebook’s reports that iPhoneDevSDK was hosting an exploit targeted at Facebook employees. We’re actively ensuring that is not the case. Facebook originally noted that they immediately reached out to other affected companies, but we were never contacted by Facebook, any other company, or law enforcement. Our users’ security is incredibly important to us and we’ll be sure to follow the investigation through to completion.”

When asked for a response to Sefferman’s statement, Facebook declined to comment on an ongoing investigation.

This is likely also the website responsible for the recent hack of Apple employee laptops, as the company announced on Tuesday. “Apple has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plug-in for browsers,” the company said in a statement to AllThingsD provided earlier this morning.

Apple did not immediately respond to a request for comment on whether or not the iPhoneDevSDK site was involved in its hack.

The site could also be the common thread behind the recent Twitter hack, which potentially compromised the accounts of 250,000 Twitter users. In the language of Twitter’s blog post, head of information security Bob Lord reminded users to disable Java inside of their browsers, a hint that this could be related to the Facebook and Apple hacks.

Apple also released a security update software patch to users on Tuesday which addresses the Java exploit, another indication that the iPhoneDevSDK site is responsible for the company’s hack.

Twitter did not respond to a request for comment.

The hack is different from many familiar modes of attacking individual users and companies. It’s called a “watering hole” attack, in that it’s launched from a centralized, popular location that many people visit across multiple industries.

“Everyone knows about spearphishing now,” said Joe Sullivan, Facebook’s chief security officer, in an interview last week with AllThingsD. “But being able to target a site on the Internet — it’s a really interesting idea that you could target people from there. You don’t have to get someone to open the email or click on the link.”

Or as independent security researcher Ashkan Soltani told us last week: “Rather than attack individual developers, they’ve poisoned the well.”

This type of attack has been used in other recent high-profile hacks. In December of last year, a watering-hole hack was discovered on the website of the Council of Foreign Relations, a Washington, D.C.-based think tank whose influence is widespread in “journalist, business and education circles.”

But the attack on mobile developers is potentially even more worrisome: The iPhoneDevSDK website isn’t just for tech-focused companies working on mobile apps. It’s an iPhone-specific site that any organization interested in mobile could benefit from visiting. And as Facebook said in its recent blog post, “Facebook was not alone in this attack. It is clear that others were attacked and infiltrated recently as well.”

The implications loom large. As the tide has shifted over the past few years and more people have moved to using smartphones and tablets for their computing needs, countless numbers of major companies and organizations have invested heavily in mobile application development. Imagine how many visited the site and could unknowingly be affected.

“It’s the type of forum that anyone who was building apps for mobile devices would visit,” Facebook’s Sullivan told AllThingsD. “It’s pretty popular for sharing tips, tricks, etc.”

So going forward, the question now isn’t which company is next, but rather which one is willing to admit it next.

“I truly believe we’re going to see quite a bit more of these announcements as companies start to get smarter and look more closely at their systems,” Soltani told AllThingsD in a previous interview.

Now, “it’s not a matter of whether or not you’ve been compromised,” Soltani said. “It’s whether you have the expertise to tell.”

The flaw was also used to compromise Macs at other companies, including a recently disclosed attack at Facebook.

“Apple has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plugin for browsers,” the company said in a statement to AllThingsD. “The malware was employed in an attack against Apple and other companies, and was spread through a website for software developers. We identified a small number of systems within Apple that were infected and isolated them from our network. There is no evidence that any data left Apple. We are working closely with law enforcement to find the source of the malware.”

The company noted that it has been shipping Macs without Java since the release of Mac OS X Lion, and that it also has a software mechanism that disables Java if it goes unused for 35 days. Apple is also releasing an updated software tool to detect and remove Java-related malware.

On Friday, Facebook confirmed that it was a victim of a targeted attack last month.

Such attacks have been on the rise, with many government agencies and companies saying that they have been targeted.

The attack on Apple employee computers was reported earlier on Tuesday by Reuters.

That’s the gist of the U.S. Department of Homeland Security’s latest vulnerability advisory on Java, which has been in the headlines for the past week because of yet another critical vulnerability that could be exploited to install and execute malicious code on unguarded systems.

“Unless it is absolutely necessary to run Java in Web browsers, disable it,” Department of Homeland Security’s Computer Emergency Readiness Team (CERT) advised. “This will help mitigate other Java vulnerabilities that may be discovered in the future.”

CERT’s recommendation, while blunt, echoes that of security researchers who have long said the best solution for the perennially vulnerable Java is to dump it entirely. As Twitter engineer and security expert Charlie Miller told Reuters, “It’s not like Java got insecure all of a sudden. It’s been insecure for years.”

On Sunday afternoon, Oracle released a patch for the critical vulnerability, which could be exploited to install and execute malicious code on unguarded systems. And not a moment too soon. By the end of last week, security researchers had already spotted malware designed to exploit it in the wild. Some theorized the flaw potentially put more than 850 million PCs at risk.

In a bulletin, Oracle said that the patch not only repairs the vulnerability, but switches Java’s security setting to “high” by default. “The default security level for Java applets and web start applications has been increased from ‘medium’ to ‘high,’” Oracle said in an advisory today. “… With the ‘high’ setting the user is always warned before any unsigned application is run to prevent silent exploitation.”

A thoughtful additional precaution — though one you’d think it would have occurred to Oracle to add earlier on. But are these measures sufficient to protect consumers who use Java? Java security expert Adam Gowdiak isn’t so sure. “We don’t dare to tell users that it’s safe to enable Java again,” Gowdiak told Reuters. H.D. Moore, chief security officer at the security firm Rapid7, took an even dimmer view of the patch and the software itself. “Users should simply disable it,” he told Forbes. “The amount of utility it offers is so much smaller than the risk it creates for users. It’s much safer to leave it off.”

“In the Court’s view, Google has failed to comply with the August 7 order,” Judge William Alsup wrote in an order just released.

Google and Oracle had been given until Aug. 17 to disclose the names of any journalists or bloggers on their respective payrolls who may have written about the case. Oracle had, in April, disclosed a relationship with Florian Mueller, a prominent blogger on patent law, whom Oracle had retained as a consultant.

Google, however, basically sidestepped the issue. Now, Judge William Alsup is sort of ticked off:

“The August 7 order was not limited to authors ‘paid … to report or comment’ or to ‘quid pro quo’ situations. Rather, the order was designed to bring to light authors whose statements about the issues in the case might have been influenced by the receipt of money from Google or Oracle.”

Google has until this Friday to comply with the order.

A copy of the order is embedded below:

2012.08.20 Order to Supplement Disclosure

So anyway, today was the deadline for the companies to drop their filings, and, well, here they are. Short answer: Oracle reiterated what it said before, that it had retained the patent law blogger Florian Mueller, he of Foss Patents, as a paid consultant in the case, though this wasn’t exactly news since Mueller and Oracle had both already disclosed the relationship. It also mentioned an Oracle corporate blogger who wrote about the case while it was going on.

Google for its part appears to have shrugged. “Neither Google nor its counsel has paid an author, journalist, commentator or blogger to report or comment on any issues in this case. And neither Google nor its counsel has been involved in any quid pro quo in exchange for coverage of or articles about the issues in this case.”

That statement more or less sums up Google’s position, though it goes on to say that it doesn’t quite understand what the judge is asking for.

The end of Oracle’s filing provides a clue. It names Ed Black, president and CEO of the Computer and Communications Industry Association, of which Google has long been a paid member, and Jonathan Band, author of the book “Interfaces on Trial 2.0,” which Google referenced in some of its presentations in court.

Says Oracle: “Google maintains a network of direct and indirect ‘influencers’ to advance Google’s intellectual property agenda. This network is extensive, including attorneys, lobbyists, trade associations, academics, and bloggers, and its focus extends beyond pure intellectual property issues to competition/antitrust issues. … Oracle believes that Google brought this extensive network of influencers to help shape public perceptions concerning the positions it was advocating throughout this trial.”

Update: I’ve just heard from Daniel O’Connor, the Senior Director of Public Policy & Government Affairs at the CCIA, and he reminds me that the organization has long had a staked-out position on the copyrightability of APIs — which was a key issue in the trial — since the days when Oracle and Sun Microsystems were members of the organization and Google was not.

Another update: And now I’ve received a statement from Band:

I am a registered lobbyist for NetCoalition and the Computer & Communications Industry Association, trade associations whose members include Google. Oracle until recently also was a member of CCIA. I do not represent Google.

The book cited in Google’s brief, Interfaces on Trial 2.0, was accepted for publication by MIT Press in the fall of 2009, before Oracle completed its purchase of Sun Microsystems, and approximately a year before Oracle sued Google. As the book clearly indicates, much of it is based on articles I authored or co-authored prior to 2005, while I was a partner at Morrison & Foerster, the firm that now represents Oracle in this litigation. Several of my co-authors were also Morrison & Foerster lawyers.

The book advances the same policy perspective as the first volume, Interfaces on Trial, which was published in 1995, when I was a partner at Morrison & Foerster. In the Acknowledgements section of that volume, we thank Michael Jacobs (the Morrison & Foerster partner who signed the Oracle filing) and several other then-Morrison & Foerster partners for their contribution to our understanding of copyright law. Both books are available for free download at http://www.policybandwidth.com/interfaces-2-0.

It should be noted that the policy perspective we articulated in both books was shared by Sun Microsystems, and, at that time, by Oracle. Sun and Oracle not only were members of the CCIA, but were also members of the American Committee for Interoperable Systems and the European Committee for Interoperable Systems, groups that advocated positions consistent with those taken by Google in this case.

There you have it. We’ll see what presiding Judge William Alsup says about this in the coming days. I’ve embedded the two filings below.

First, Google’s filing.

GOOG-1237-main

And now Oracle’s.

Oracle Response to Aug. 7 Order

Judge William Alsup, who presided over the case in the U.S. District Court for the Northern District of California, wrote in his order that he’s “concerned that the parties and/or counsel herein may have retained or paid print or Internet authors, journalists, commentators or bloggers who have and/or may publish comments on the issues in this case.”

Google and Oracle have 10 days from today to “file a statement herein clear identifying all authors, journalists, commentators or bloggers who have reported or commented on any issues in this case and who have received money (other than normal subscription fees) from the party or its counsel during the pendency of this action.”

The only one known so far is Florian Mueller, who writes a blog called Foss Patents that covered the legal maneuvering in the trial extensively. He disclosed on April 18 (see the relevant section in the last four paragraphs or so) that he had been hired by Oracle as a consultant.

Oracle spokeswoman Deborah Hellinger just sent a comment that seems to put the onus on Google to disclose some relationship that both parties know about:

Oracle has always disclosed all of its financial relationships in this matter, and it is time for Google to do the same. We read this order to also include indirect payments to entities who, in turn, made comments on behalf of Google.

Google has yet to return my email seeking comment. If there’s anything that either party has yet to disclose on the subject I guess we’ll learn that from the filings, which are due no later than next Friday.

Of course this goes without saying, but I’ll say it anyway: While I wrote quite a bit about this case, no one paid me, aside from my AllThingsD salary, to write anything about it or to color the direction of my coverage one way or the other. And if you want any further information on the subject you can refer yourself to the ethics statement that’s linked directly to the right of my grinning mug at the top of this page.

Now that we’ve got that out of the way you can read the full filing, all one page of it, below.

ORDER RE DISCLOSURE OF FINANCIAL RELATIONSHIPS WITH COMMENTATORS ON ISSUES IN THIS CASE

And on Thursday it appealed to the presiding judge to force Oracle to pay them.

“Google prevailed on a substantial part of the litigation,” Google said in a Bill of Costs filed with the court, and obtained by Wired. “[Oracle] recovered none of the relief it sought in this litigation. Accordingly, Google is the prevailing party and is entitled to recover costs.”

Those costs amount to roughly $4 million, including transcript fees of about $143,000, court-appointed expert fees of $987,000 and a jaw-dropping $2.9 million for obtaining, copying and organizing documents used in the case.

That’s pocket change for Oracle. But Google’s demand for it is certainly a twist of the knife to its antagonist, which had once hoped to recoup billions of dollars in damages for Android’s alleged Java-related patent infringement. The judge presiding over the case has yet to rule on Google’s request.

Oracle has said it plans to appeal the court’s ruling. A company spokeswoman declined comment on Google’s reimbursement request.

The lawsuit between Oracle and Google over the use of Java in Android is in the books, and while Oracle scored some points and prevailed on at least one narrow point of the dispute, as time has run out, the scoreboard is lopsided in Google’s favor.

Initially billed as the “World Series of intellectual property cases,” this trial had lots of bold-faced names on the witness stand, including Oracle CEO Larry Ellison, Google CEO Larry Page, plus Scott McNealy and Jonathan Schwartz, both former CEOs of Sun Microsystems.

After the jury had its say, William Alsup came back with a ruling that Oracle cannot apply copyright protection to Java APIs. This was by far the most controversial and wide-ranging portion of Oracle’s case, one that had software developers around the world kind of worried that it might prevail. It didn’t, but Oracle has promised to appeal Alsup’s ruling.

Below is a copy of Judge William Alsup’s final order in the case, spelling it all out. You’ll notice that in the portion of the case concerning nine lines of code on which Oracle did prove that its copyright was infringed, no money is changing hands. Oracle was technically entitled to some low-six-figure sum of damages for the infringement. But my understanding is that by agreeing to zero damages now, it’s simply speeding up the process that will lead to an appeal. So while it’s over, it’s really not.

Final Order

One of the more controversial stances that the software giant Oracle had taken as part of its dispute over Java with the search giant Google was that 37 specific application-programming interfaces — software tools that programmers use to work with Java — could be subject to copyright protections. Today, the judge hearing the case ruled that they cannot.

Judge William Alsup ruled only on the issue of the 37 specific APIs, and didn’t tackle the wider issue over whether or not an API actually can be protected under copyright law. Some software developers had worried that it might be an overbroad interpretation that would tie up some widely used techniques under tricky copyright rules.

Oracle, you’ll recall, had sued Google, alleging both copyright and patent infringement over Google’s use of Java in creating the Android mobile operating system. Google had countered that Java is free to use, and that the APIs are more or less required to use Java in the first place. Oracle won a narrow, but hollow victory in the copyright phase of the trial, but lost outright in the patent phase.

Barring an appeal — and more on that, presently — Oracle won’t collect enough damages over the one case of infringement to cover the cost of the trial. A statement made during the trial limited the potential damages Oracle could collect from the one piece of software code infringed to about $150,000.

The key bit of Alsup’s opinion: “So long as the specific code used to implement a method is different, anyone is free under the Copyright Act to write his or her own code to carry out exactly the same function or specification of any methods used in the Java API.”

In a statement, Oracle promised to appeal. It also stuck to its guns that Google must make its implementation of Java within Android compatible with all other versions of Java, something that Google isn’t likely to do.

Here is the full text of Oracle’s response to Alsup’s ruling:

Oracle is committed to the protection of Java as both a valuable development platform and a valuable intellectual property asset. It will vigorously pursue an appeal of this decision in order to maintain that protection and to continue to support the broader Java community of over 9 million developers and countless law abiding enterprises. Google’s implementation of the accused APIs is not a free pass, since a license has always been required for an implementation of the Java Specification. And the court’s reliance on “interoperability” ignores the undisputed fact that Google deliberately eliminated interoperability between Android and all other Java platforms. Google’s implementation intentionally fragmented Java and broke the “write once, run anywhere” promise. This ruling, if permitted to stand, would undermine the protection for innovation and invention in the United States and make it far more difficult to defend intellectual property rights against companies anywhere in the world that simply takes them as their own.

And here’s Google’s comment:

The court’s decision upholds the principle that open and interoperable computer languages form an essential basis for software development. It’s a good day for collaboration and innovation.

I didn’t get a copy of the ruling, but ZDNet did, so I’m taking the liberty of embedding its copy here:

Oracle v. Google: Order Regarding Copyrightability of APIs

Asa Mathat / AllThingsD.com

In the history of Silicon Valley, there are few characters more colorful than Larry Ellison. The CEO and founder of the enterprise software giant Oracle rarely needs an introduction, and in certain circles he is often referred to by his first name alone — with no doubt as to whom you’re referring. He’s also known for racing sailboats and flying planes. Today, he’s onstage for an interview with Kara Swisher at D: All Things Digital.

Ellison is also known for his enemies, both in the marketplace and in the courtroom. Oracle is a dominant force in the enterprise software business, and competes strenuously against other giants like SAP, but it has also hauled its executives into the courtroom over the theft of software.

Newer enemies are Hewlett-Packard, once a significant partner; and Google, against which Oracle recently lost a lawsuit alleging patent infringement. Expect lots of questions about the lawsuits. There’s also the matter of Oracle’s new enterprise hardware business. Oracle, traditionally a software company, bought Sun Microsystems and thus has a new — or some would say old — hardware business. No doubt he’ll have a lot to say about whether or not that’s been a good purchase. The jury is still out.

Finally, Ellison is also known for his friends, and one in particular: Apple founder and CEO Steve Jobs. After the interview, Ellison will participate on a panel we are doing as a tribute to his close friend.

4:27 pm: Kara: This is the interview I’m most excited about. Let’s start with the America’s Cup.

Larry: It’s the oldest trophy in international sports. Dates to 1851.

Back in the 1850s, when you moved products around, it was by sailing ship. The Queen of England organized it. Schooner America from the U.S. challenged the Brits. They raced around the Isle of Wight. Americans won the first one. Since that time, six American teams have won the cup. It’s the most difficult trophy to win. I tried three times, and won once. I’m defending in San Francisco next year.

There are lots of teams to beat, but we’ll be competitive. It’s extreme sailing — this is not the kind of boat you’d use to take your kids to sail. Even the small boats go 40 miles per hour. They are designed to be unstable so they go fast.

It can be dangerous. Every time I’m on one of these boats, there’s some kind of injury.

Kara: You’ve been CEO of Oracle since 1977. You’re probably the longest-running tech CEO in Silicon Valley. Let’s talk about the sweep. Where do you think Silicon Valley is now? Do you still think innovation is mature?

Larry: I think the Internet was the last big change. The Internet is maturing. They don’t call it the Internet anymore. They call it cloud computing.

Larry: When the Internet first started, the primary device connected to it was the personal computer. Every network has enormously complex components that are hidden from consumers. The PC network was very different. The PC was very complex, and was attached to a complex network.

Now we’ve migrated that complexity off the desktop and moved it to Internet servers. That has been recast as cloud computing.

Kara: Why did you resist the name “cloud computing”?

Larry: I objected to people saying, “Oh my God, we just invented cloud computing.”

Kara: You just don’t like the words “cloud computing.”

Larry: I like the words. It’s a charismatic brand. And people do need to simplify their existing data centers and deliver services in simpler ways.

Kara: How do you look at innovation in Silicon Valley?

Larry: The big thing was the Internet. Right now, our daily lives are on the Internet or the social network. For a very long time, we’ve known how much you earn, what clothes you recently bought, because we had your credit records. That was the single most important database in the world. It tracked every consumer and everything they were doing. Now we can track not only what you’re buying, but what you’re saying about them. We know who your friends are, and what you’re saying to your friends.

We suddenly have consumers instrumented, because they are willing to share their information. Consumers just tell us everything about themselves. Every time you make a comment or tweet, all of this stuff, we have all this detail of people’s lives online, which allows us to market things and sell things and service the consumers in a more insightful way.

Kara: Thoughts on Facebook?

Larry: I am on Facebook, but I don’t use it much. I was obsessed with it for three months. Making friends. Meeting people I would otherwise never meet. Finding out what they had for breakfast.

Kara: What did you say to Mark Zuckerberg when you met him?

Larry: I told him I thought Facebook was a world-changing technology. Google is a very important company. Facebook is arguably an even more important company. How they monetize all of it remains to be seen.

(Ellison mentions the Salesforce deal we reported on yesterday to buy Buddy Media.)

Kara: Did you also look at Buddy Media?

Larry: We did. But we looked at other companies as well. And we bought the one we wanted.

4:45 pm: Larry: If you don’t keep your technology current, you’re going to lose your customers to a competitor. For every Facebook, there’s also a Splunk or other companies doing interesting things.

Kara: Are there areas that are more hyped than others?

Larry: I thought cloud computing was overly hyped and very promising at the same time.

Larry: People said the PC would replace the mainframe. But IBM still does mainframes. PCs are more important than mainframes. I would argue that smartphones are more important than PCs. For the first time, the consumer end of IT is bigger than the enterprise side. Consumer information processing is the biggest part of our business.

Kara: So are you a consumer company?

Larry: We’re not a consumer company, but we sell to the consumer companies. Apple is a big customer. And all the phone companies — we are by far the most popular provider of automation systems all over the world. Our big competitor there is IBM, and we’re growing much faster than they are. IBM used to be No. 1 in database; now we’re No. 1. They used to be No. 1 in middleware, and we’re now No. 1 in middleware. They’re No. 1 in high-end servers; soon we’re going to be No. 1 in high-end servers.

Kara: What do you do all day?

Larry: I still run engineering at Oracle. Mark Hurd runs the sales and consulting, and Safra Catz runs accounting and legal. What I do every day is look at product plans.

4:50 pm: Larry: Long before we bought Sun, we decided to build this database machine. We thought data centers were unnecessarily complex. People were buying storage from EMC, and networks from Cisco, and all these other separate parts together. I said let’s do all of it. We’ll sell one building block you can plug into your data center. We’re trying to do for the data center what Apple did for the consumer.

4:52 pm: Larry: Sun has already paid for itself. Sales are going down in hardware, but the unprofitable part is going away. Our margins are the highest of anyone in the server business. The sales are down 20 percent, but the profits are up.

Larry: If you look at the iPhone, 90 percent of the complexity is the software. And the chips. We design the chips in the Sun servers, the SPARC chip. The complexity is in the software.

Larry: We’re announcing the general availability of the Oracle Cloud. Platform as a Service. Database Service, Java Service and a bunch of applications. All on top of other acquisitions, like Taleo for talent management.

Larry: A complex ERP and HR suite in the cloud. All running on Oracle hardware, and running in their own virtual machine.

When you’re a multi-tenant customer, you get the new upgrade when the vendor tells you. When you run your own VM, you have more control. (Take that, Benioff!)

Kara: Talk about your patent situation, the recent cases with Google, HP and SAP?

Larry: They’re all being litigated. Google is really a copyright case.

Kara: Will you appeal?

Larry: We won on infringement. (Sorta.) When litigation is over, I’ll talk about it.

On the HP case: HP sued us when we hired Mark Hurd. Then they sued us when we said we wouldn’t port new versions of our software to Itanium. That is the next version of our database, which comes out next year. HP says we have a contractual obligation to port to Itanium. We don’t think that is true.

Kara: Do you imagine a better relationship with HP?

Larry: Now that Meg Whitman is CEO. I like Meg.

He doesn’t like the former CEO, Léo Apotheker, formerly of SAP.

Larry: SAP admitted to stealing Oracle software. Who was CEO of SAP when that happened? Leo.

Kara: Léo.

Larry: I’m not going to call him Léo. Leo. You’re going to fire Mark Hurd and hire Leo?

Larry: When HP said “whoops” nine months later, I almost tweeted “Told ya!”

Kara: So you get along better with Meg?

Larry: I wish Meg nothing but the best. I wish her nothing but the best. Those of us who grew up in the Valley think of Hewlett and Packard as role models, and we’d like to be half as good as they were. Then they brought in Leo. Then when we subpeonaed him, he went on the lam!

5:00 pm: Larry: They sent him to Bolivia to talk to customers. And then they sent him to Mongolia to talk to customers, just beyond the reach of the federal subpoena. They should have left him in Mongolia, because when he got to California, it got bad.

5:01 pm: Kara: What do you think HP should do?

Larry: You want me to give HP advice? I think Meg was a big improvement. But I’m focused on running Oracle. I like her, and I hope she does well — for the benefit of HP’s customers and employees.

Kara: What keeps you going?

Larry: Red Bull. Kidding. Life’s a journey. We’re all curious about each other and about ourselves. It’s a journey about discovering limits. I’m fascinated by what can be done with technology. To constantly test limits. Learning as we compete to solve customer problems. The whole thing is just fascinating. I don’t know what I would do if I retired. When I go sailing, I look around to see if anyone wants to race. I just like competing.

Kara: What’s one thing people don’t know about you?

Larry: That I play classical guitar.

Kara: Is the public’s image of you accurate?

Larry: Frequently, I’ll be in a meeting with someone and the person says “Oh my God, you’re nothing like what I thought you’d be.” Of course, it’s a low bar. I didn’t just bite the head off a small animal before the meeting.

5:04 pm: Now time for Q&A. Question about what is the next mountain for Oracle to climb. Is the consumer cloud holding something for you?

Larry: We are not competing with IBM in services. As services becomes more important for IBM, products are the tail and service is the dog. We think we can beat IBM in servers. That is the next thing for us. Exadata, Exalytics, Exalogic. Our other big competitor is SAP. The interesting thing about them is that while we’re rewriting all our big applications, SAP hasn’t even begun to rewrite their applications.

Larry: SAP’s franchise in ERP (enterprise resource planning) is in danger. They announced they will have nothing new until 2020. They are buying Ariba, and they bought SuccessFactors. SAP’s business is ERP and they have nothing new in the cloud for at least eight years and I’d argue nothing for 10 to 12 years.

Question about Workday, a company run by PeopleSoft founder Aneel Bhusri, who is in the audience.

Larry: It’s going to be very interesting to monitor Workday. We monitor Workday, and we beat Workday all the time. Workday doesn’t use a database. They use Flash as a user interface, so they can’t run on iPhones or iPads. Whenever we’re in a head-to-head with Workday, we almost always win, and that’s before we’re fully launched. (He’s really hating on Workday. Interesting.) Salesforce uses a really good database. They use Oracle. And great middleware. They use Oracle.

Question about America’s Cup. What is it about this event for guys like you? And what do I have to do to get to sail with you?

Larry: I had a boat called Sayonara. I drove it to five consecutive championships. So it was the logical next step. I have been a competitive sailor for a very long time. I decided to find out how good this Russell Coutts guy is. Answer is, he’s really good.

5:12 pm: Question from Esther Dyson about Larry’s philanthropic efforts.

Larry: We have a foundation, the Ellison Medical Foundation, that is focused on diseases related to aging. For obvious reasons. (Jokingly referring to himself.) We do primary and applied research. I’ve spent about $1 billion supporting that. Oracle has a very large health-sciences practice.

5:13 pm: Larry: We recently started a company where we are simulating quantum mechanics in small molecules, where we are doing drug design. Basically building chemical simulators so we can test drugs.

It’s something that has fascinated me my entire life. Biological systems are very complex, and every year we understand them better.

5:15 pm Question: Any advice for Obama?

Larry: My advice to Obama is that we have to have a more balanced immigration policy. (Applause.) Immigration is a good thing. We need to embrace people with skills not readily available in the U.S. We need to embrace scientists and mathematicians and doctors trained in the U.S to stay in the U.S., rather than sending them back to China or Indonesia and have them buy houses there and start their companies over there. It is simply madness that after we grant someone a degree from Stanford that next they get a note from the government to get out.

5:18 pm: Kara: We have to end it there, because we’re going to the panel on Steve Jobs. That’s it for now.

Full D10 Conference Coverage

Bloomberg News is reporting that the jury has been dimissed, and that there will be no third phase of the trial, which was to have focused on damages in the event that Oracle prevailed.

The win for Google in the patent phase comes on top of a narrow but hollow victory for Oracle, in which the enterprise software giant won a part of its argument, but failed to make it stick in a way that would make any difference to either company.

Asked to decide whether Google had infringed upon Oracle’s copyrights to certain parts of the Java programming language, the jury — the same jury that came out in Google’s favor today — agreed that it had. Then asked to decide on four specific examples of that infringement, jurors could agree on only one that cracked the threshold of being sufficiently egregious to warrant any damages. And in that case, the damages amount to no more than $200,000, probably less than it cost to litigate in the first place.

Google shares rose slightly by $2.09 to $602.89 or less than 1 percent. Oracle shares fell slightly by 6 cents to $26.30.

Oracle put out this statement:

Oracle presented overwhelming evidence at trial that Google knew it would fragment and damage Java. We plan to continue to defend and uphold Java’s core write once run anywhere principle and ensure it is protected for the nine million Java developers and the community that depend on Java compatibility.

Meanwhile, here’s Google’s statement, which reads like a victory lap:

Today’s jury verdict that Android does not infringe Oracle’s patents was a victory not just for Google but the entire Android ecosystem.

But even a task that never ends has to have a beginning, and more often than not it goes something like this: What do I have that needs to be protected, and how well or not is it protected now? Sometimes the best thing to do is call in someone from the outside to look at it all with fresh eyes. And sometimes the answers can be shocking.

It’s the sort of thing that Rapid7, a fast-growing security firm based in Boston, specializes in. While some security firms are more the cops on the beat, hired to keep things in check based on established rules and policies, Rapid7 is one you call when you want to know how the bad guys will try — and try they will — to get through whatever security measures are already in place.

The firm also owns Metasploit, an open source service that’s essentially an early-warning system about new vulnerabilities. Twice in the last year, new research by Rapid7 — released to the wider world through Metasploit — has caught my attention: Once it was about Java, and the other item was about how the methods employed in Stuxnet could be used to create new ways to attack public infrastructure.

I recently had a chance to ask Rapid7 CEO Mike Tuchen some questions about his company and the interesting role it’s playing in trying to clear up a lot of ambiguity about IT security that so many CIOs find frustrating. My first question was to ask Tuchen to explain from a high level what Rapid7 does.

AllThingsD: Mike, the thing I always think of when I talk to security companies is that the scope of the problem is constantly moving. If I were to use a football metaphor, it would be that the goalposts are always changing. And yet there’s another metaphor that fits as well: That of a medical triage, because once you know you have problems, there’s the matter of determining which one to fix first. What does Rapid7 do to help companies sort all this out?

Tuchen: We think of the security market as breaking out into “front-end” and “back-end” activities. Front-end activities are the assessments we do to proactively answer questions like: What’s my security posture? Where am I strong, and where am I vulnerable? What should I do to become more secure? That’s where we fit. 

Back-end activities are the enforcement and remediation efforts to protect data or networks that typically act in real time in response to threats detected including firewalls, anti-virus applications and so on.

We’re finding that as the threats are constantly growing and changing, there’s a lot of interest in assessment. The reality is that we’re seeing a new breach on average of once per day for the last 18 months or so. So when things are moving that fast, who wouldn’t want to know where their weaknesses are and what are the most important things they need to do to lower the chance of a being one of those companies breached? Our customers are telling us that once they’ve done the assessment, they’re able to set their priorities for the next 12 to 24 months. If you haven’t done an assessment, there’s a good chance you’ll buy a back-end product that doesn’t solve all your problems because you never knew what all the problems were in the first place. That’s how budgets tend to spin out of control.

So one big question around security is around the shift to the cloud. There are still a lot of people who don’t trust systems they can’t touch, but with the cost savings, the shift is looking more real every day. What does that shift mean for you and for your clients?

The first question you have to ask is “what do I have?” It’s kind of self-evident: You can’t secure what you don’t know about. Cloud services can make this trickier by adding another question into the mix: “Where is it?” And it gets even dicier when you take into consideration all the virtual machines that can be turned on and off at will and moved from one physical machine to another. The boundaries get a lot less well-defined. So the first step is discovery: What do you have, where is it, and what controls are in place? 

The next step is determining what types of threats you’re likely to face and figuring out what’s working to head them off and what’s not. After that you put together a strategy for improvement. 

Generally speaking, the best approaches we’ve seen start with basic hardening techniques. You take some concrete actions that are designed to make it more costly and difficult for attackers to establish a beachhead on your systems. Next, you lock down the perimeter as tightly as possible, and train employees to recognize and resist social engineering attacks.

When it comes to assessing the security of cloud offerings and software-as-a-service applications, it’s a matter of getting comfortable with the security that the vendor has in place. Our own experience with this has been pretty bleak. It’s clear that the industry as a whole has work to do there. 

Like what?

Attackers have the advantage right now. Even the largest and most sophisticated companies are getting breached on a regular basis. I think there are three things that need to happen: We need to do a better job of information-sharing about risks, methods, and actors so that companies don’t have to start from scratch. We also need to make security simpler. Right now it’s way too complex, and there are too many products that target specific problems that tend to be important to only the biggest of companies. And even those companies can barely stitch them all together into a coherent solution. For everyone else in the world it’s pretty much impossible to do that.

We’re working on a lot of this. We run an annual conference called UNITED to bring together innovative defenders to share ideas. It stands for “Using New Ideas To Enhance Defense.” We’ve committed $100,000 to sponsor some projects we like to call the “Magnificent7” and there will be no strings attached to the funding.

Washington seems to have finally awakened to the wider IT security threats. We hear a lot of talk coming out of Congress about cybersecurity. What, if anything, do you expect to come out of these efforts?

There are two security bills, SOPA and CISPA, that have gained a fair amount of attention lately. SOPA focuses on the illegal downloading of music, videos, software and other counterfeit goods that affect a wide variety of industries. These are the low-hanging fruit when it comes to online crime.

CISPA focuses on sharing private sector consumer data with the government to protect national security interests. The intent with CISPA is to legally protect private companies when they share consumer information with government and law enforcement entities. This information would not be available to the public at large and is highly scrutinized by privacy advocates. The information would be used to try to protect the country’s critical infrastructure. But if it were to become law, it won’t change the status quo of organizations and consumers fending for themselves when it comes to information security.

Also if they’re passed, they only affect U.S. citizens. These laws will not prevent foreign entities from engaging in piracy or breaching U.S. corporate or civilian assets. Companies will still be under non-stop attacks from persistent adversaries.

You raised a big bunch of funding last fall with a $50 million investment led by TCV. What are you going to do with all that money?

We’ll use it for three major initiatives: First, we’re doubling down on expanding our existing engineering teams. We doubled the team in 2010, nearly doubled it in 2011, and plan to double it again in 2012. Second, we’re accelerating our international expansion. We just hired a regional VP for Europe and are expanding our European and Asia-Pacific operations with new offices in Amsterdam, Hong Kong and Sydney. Finally, we’re looking to acquire terrific companies with passionate teams that want to join forces with Rapid7 to change the security world.

You acquired the Metasploit Project in 2009. How has that deal worked out and what does it say about the companies you may yet acquire? What are your plans for future acquisitions?

Metasploit has been great for Rapid7. We first started thinking about Metasploit when Chad Loder, one of our co-founders, came up with the idea of integrating an existing product with Metasploit. We discussed it with HD Moore, the founder of Metasploit, and he was equally excited about the idea of integrating the products together. In a week or two we had a working prototype. Right then we realized that we’d found something special: A passionate, driven entrepreneur who shared a lot of our vision and values, a product that logically works together with our existing product, a huge and engaged community of expert security insiders and a business that was ready to be commercialized. We asked HD if he’d like to join forces with us, and he agreed. We were able to build a team around HD, and together we’ve built the Metasploit business into a leader in its category. 

In that case we learned that founder and team are critical. It also made it easier to build the rest of the team around HD from the bottom up. Now we’re actively looking for companies that play in markets that make sense for us, and products that have a solid foundation for the future. We haven’t yet found another opportunity that fits all of these areas.

I get that Rapid7 is growing; you’ve got an impressive list of customers that includes Anadarko Petroleum, Teradyne, Liz Claiborne and the U.S. Postal Service. Can you share some basic metric that shows how much you’re growing?

Our revenue for the last seven years is over 90 percent per year, and we’ve grown more than 70 percent in each of the last two years. And we have more than 2,000 customers. We’ve been lucky to be in a market where the demand is increasing because threats are escalating.

Asked to decide whether Google had infringed upon Oracle’s copyrights to certain parts of the Java programming language, the jury agreed that it had. But then, when asked to decide on four specific examples of that infringement, jurors could agree on only one: The rangeCheck method in TimSort.java and ComparableTimSort.java. Don’t ask me to explain exactly what it is, but it is being described widely as “nine lines of code.” And, unfortunately for Oracle, the damages it can collect are limited to somewhere in the neighborhood of $150,000 to $200,000, or less than pocket change for either company, not the $1 billion or more Oracle had said it wanted.

Jurors were also unable to decide if the portions of Java code that it copied could be protected by the long-established doctrine of Fair Use, under which certain infringements can be excused. Google lawyers pounced on this, and said they would move for a mistrial.

The conclusion is that Oracle proved at least part of its argument, but failed to prove the dramatic injury it said it had suffered. It also proved that Google knew that it needed a license to Java in order to use the portions of Java that it did use. The complication there was the fact that one flavor of Java is compatible with other flavors of Java: It still operates under the old “write once, run anywhere” principle that Sun Microsystems envisioned when it created Java. Oracle still wants Google to take out a commercial license that would require Google to maintain Java compatibility with other platforms.

Still undecided — and this is the big issue that has the eyes of the software industry watching this case closely — is whether Oracle can prevail on the issue of protecting software APIs using a copyright in the first place. Jurors were instructed to proceed under the assumption that this was a matter of settled law, when in fact it is not. Judge William Alsup will decide on this issue later, and it is unclear exactly how the jury verdict in the first phase of this case will affect his decision.

Had Oracle won a more ringing endorsement from the jury, that portion of the argument might seem to be stronger. It’s an important point that Google argued against, saying APIs shouldn’t be subject to copyright protection, because they’re more like tools and techniques that programmers use to build software. You can copyright a given program because it’s unique, but you can’t copyright the language it’s written in. The possibly strained analogy I came up with before is this: You can copyright a musical composition like Miles Davis’s “So What,” but you can’t copyright the form of music known as jazz.

Oracle argued at trial that copyright law offers the only proper protection for original expression in software, mainly because software advances are incremental, building upon previous advances and innovations. Laws governing trade secrets and patents don’t get the job done. Oracle lawyers contended that copyright law, while still imperfect, protects innovations and advances at a more granular level, but mainly against copying.

Also still ahead is the patent phase of the trial, where Oracle will assert that Google violated Java patents in building Android. After that, there will be a third phase, where the two parties will wrangle over damages. So far, it seems — unless Oracle prevails in the patent portion — that there won’t be much to wrangle over.

At least for now, it appears that Google has escaped the worst of Oracle’s accusations. That was the conclusion of shareholders of both companies. Google shares rose by more than 2 percent on the news of the verdict yesterday, closing at $607.55 a share. Oracle shares fell by more than 1 percent to close at $27.92 a share. The case isn’t over, and Google hasn’t exactly come out of it looking virtuous. But if the point of defending against a lawsuit is to escape paying huge monetary damages, Google won the day.

Embedded below is the filled-out jury questionnaire:

Verdict

As the AP has it, the jury has decided against Google on Oracle’s copyright claim, but has reached an impasse on some key questions. There’s obviously more to this story as it develops. I’ll be updating as soon as I know more.

Update: The jury sided in part with Oracle, ruling that the Android mobile operating system infringes on some Java copyrights. However, it was deadlocked over the question of whether that use constituted “fair use,” and was therefore protected. This impasse appears to be the basis for a mistrial motion that Google lawyers say they intend to file.

Oracle has not prevailed on every point and, in fact, it’s looking like a messy victory. The jury found code in two files to be infringing, and that some elements of Android application programming interfaces or APIs were similar to Oracle’s Java APIs.

Attorneys for Google told Judge William Alsup that they intend to file a motion for a mistrial because of the impasse over the “fair use” question. Alsup told both sides to be prepared to argue that motion, which will come later.

A few other things are coming up: Judge Alsup still has to rule on whether APIs can be copyrighted as a matter of law. Jurors were instructed to deliberate, assuming that they could be copyrighted.

There is a clear finding that Google has infringed on nine lines of code. This came in Question 3A, concerning something called RangeCheck in Java. They decided that Google hadn’t infringed on two other blocks of code. With the jury out of the room, Judge Alsup said that there is “zero finding of copyright liability” on anything other than the nine lines.

That’s good for Google, because Oracle’s own expert at trial said they’re not worth much. An Oracle attorney suggested that the company should receive a share of Google’s profits on top of regular damages. Judge Alsup rejected that as “bordering on the ridiculous.”

From Google:

“We appreciate the jury’s efforts, and know that fair use and infringement are two sides of the same coin. The core issue is whether the APIs here are copyrightable, and that’s for the court to decide. We expect to prevail on this issue and Oracle’s other claims.”

And here’s Oracle’s statement:

“Oracle, the nine million Java developers, and the entire Java community thank the jury for their verdict in this phase of the case. The overwhelming evidence demonstrated that Google knew it needed a license and that its unauthorized fork of Java in Android shattered Java’s central write once run anywhere principle. Every major commercial enterprise — except Google — has a license for Java and maintains compatibility to run across all computing platforms.”

For reference, I’ve embedded the questionnaire that the jurors were required to fill out:

Jury Questions

Judge William Alsup is starting to talk about opening arguments for phase two of the trial, which will focus on patents. A third phase, assuming Oracle prevails, will focus on determining damages.

There was a false alarm late Friday when CNET and Bloomberg News reported that a partial verdict had been reached, when in fact it hadn’t. This happened after it became relatively clear that jurors were stuck and unable to agree on all four questions they have been tasked with answering.

Jurors have been asked to decide if Google’s use of 37 sections of Java source code — which Oracle owns, having acquired Sun Microsystems in 2010 — constitutes copyright infringement; or if, as Google argues, the copied sections are so insignificant as to amount to “no big deal.”

Oracle sued Google in 2010, after closing the Sun deal. Google stands accused of using some parts of Java to create Android without having first obtained the relevant licenses — first from Sun, then from Oracle — that, among other things, required compatibility with other flavors of Java.

Jurors have reached no conclusion in the case and Judge William Alsup has sent them home for the weekend with instructions to try again on Monday.

The jury had indicated Thursday in a note to Alsup that it was stuck on some point. Alsup warned lawyers for both sides that they might have to prepare for a deadlocked jury. Obviously, the situation here is fluid. I’ll have more in this post as it comes in.

There are four questions the jurors are tasked to answer, and they’re said to be unanimously agreed on three of them, but unable to reach consensus on the fourth, though its unclear which are which.

For what its worth, below is the form with the four questions the jurors have to answer.

Jury Questions

The Associated Press reported that a note to Judge William Alsup asked what would happen if jurors were unable to come to a conclusion, and indicated that some jurors are not budging from their positions.

Alsup called jurors into the courtroom for a talk, then sent them home so they could “start fresh” today. Bloomberg Businessweek reported that Alsup told lawyers that it’s possible the jury is deadlocked. If that’s what happens, Alsup said, the parties would move immediately into the second phase of the trial, which covers patents.

Jurors have been asked to decide if Google’s use of 37 sections of Oracle-owned Java source code constitutes a copyright infringement, or if, as Google has argued, the copied sections are so insignificant as to amount to “no big deal.”

Oracle sued Google in 2010, after acquiring Sun Microsystems and becoming the owner of the Java programming language. Google stands accused of using some parts of Java to create Android without having first obtained the relevant licenses — first from Sun, then from Oracle — that, among other things, required compatibility with other flavors of Java.

The jury has been deliberating since lawyers for Google and Oracle wound up their arguments on Monday.

(Image courtesy of Icanhascheezburger)

The jury has had the case since Monday, and as yet there’s no indication of when its deliberations will be complete.

The basic questions jurors are wrestling with concern whether and how it is or isn’t okay for a company to copy portions of software code that would otherwise require a commercial license. Also looming large over the proceedings is whether or not a programming language can by itself by protected by copyright. Oracle lawyers argued at trial that it can, but this is by no means a legal slam dunk.

Google lawyers, for their part, argued that the copying was insignificant, or “no big deal whatsoever.”

Oracle sued Google in 2010, after acquiring Sun Microsystems and becoming the owner of the Java programming language. Google stands accused of using some parts of Java to create Android without having first obtained the relevant licenses, first from Sun, then from Oracle, a license that among other things required compatibility with other flavors of Java.

Once the jury comes back, which could be as soon as today (but we thought that earlier this week), the trial will shift to a second phase over patents. After that, assuming Oracle prevails in one or both of the first two phases, a third phase will determine the amount of damages, if any. The full trial is expected to last two months.

Lots of people are waiting on the outcome of this first phase, however. To all of them, I dedicate Tom Petty’s “The Waiting.”

In his appearance, McNealy said that, as he remembers it, Google was asked to take out a commercial license on Java. “There is a Java specification license document available,” he said, that didn’t contain any financial requirements, but it did require compatibility.

McNealy had been called as a witness by Oracle, and on the stand he said that it was Sun’s practice to let other companies use Java, but only with a commercial license, and that its primary requirement was that the licensee ensure that Java remain compatible.

While numerous other phones from the likes of Nokia, Research In Motion and Motorola were compatible with Java applications, those on Android weren’t. Compatibility is one of the main points over which Oracle has been arguing with Google. Oracle contends that not only did Google violate its patents and copyrights, but it then went on to build its own incompatible version of Java, fracturing one of the oldest premises of Java’s existence: Write once, run anywhere.

McNealy is also running a poll on Twitpolls, asking people to vote for which side they agree with. (Google is ahead as of this morning.)

Who is right in the Oracle vs. Google lawsuit? reply w/ #oracle #google #neither #both http://t.co/aWdhzPbO

May 1, 2012 1:44 pm via GetTwitPollsReplyRetweetFavorite

@scottmcnealy

Scott McNealy

And he promotes a similar poll on his own new venture’s site, Wayin.com, where, as of this morning, the vote is favoring Oracle.

Meanwhile, the jury is still out, and the world is still waiting for a verdict. It could come today.

Anyhow, here’s the video of McNealy’s six-minute TV interview:

The jury in the Oracle-Google trial will begin its second day of deliberations today, following a round of closing arguments by lawyers for both sides.

From Oracle’s perspective, the basic question jurors will have to answer, as its lawyer Michael Jacobs put it, is whether it’s okay for one company to use another company’s intellectual property without permission. (See Jacobs’ slide deck, embedded below.)

Google attorney Robert Van Nest argued that the amount of Oracle IP that it used was so small as to be “no big deal whatsoever.”

Oracle sued Google in 2010, after Oracle acquired Sun Microsystems and thus became the owner of its Java programming language. Google is accused of using some parts of Java to create Android without having first obtained the relevant licenses, first from Sun, then from Oracle.

Monday’s closing arguments constituted the end of the first phase of the trial, which has also turned into a closely watched battle of the proper use of copyrights over software.

Once the jury comes back, which could be as soon as today, the trial will shift to a second phase concerning patents, after which a third phase will determine the amount of damages, if any. The full trial is expected to last two months.

Judge William Alsup, in his final instructions to the jury, reiterated the parameters of the case, telling panelists that copyright protection covers the “expression of ideas,” but not methods of operation. He said the copyrights Oracle has exerted cover the “structure, sequence and organization” of software code.

Google has argued that APIs shouldn’t be subject to copyright protection because they’re more akin to tools and techniques that programmers use to build software.

Oracle has argued that copyright protections should apply because they’re more granular and targeted than trade-secret law or patents.

day11-closing-1609612

(Image courtesy of icanhascheezburger.com)

Of the two, Jonathan Schwartz, Sun’s last CEO, spent the most time on the witness stand. Called by lawyers for Google, he bolstered Google’s argument that it was free to use parts of Java as it assembled its Android mobile operating system.

Scott McNealy, called by Oracle, said it was Sun’s practice to let other companies use Java, but only with a commercial license, the primary requirement of which was that the licensee ensure that Java remain compatible.

While numerous other phones from the likes of Nokia, Research In Motion and Motorola were compatible with Java applications, those on Android weren’t. Compatibility is one of the main points over which Oracle has been arguing with Google. Oracle contends that not only did Google violate its patents and copyrights, but it then went on to build its own incompatible version of Java, fracturing one of the oldest premises of Java’s existence: Write once, run anywhere.

Schwartz said he had hoped that Google would take out a commercial license, but in the end, he said, according to a report on CNet News, Sun opted “to grit our teeth” and support it as part of the Java community. He said that he opted not to sue Google over the issue.

Oracle also presented as evidence an email from Schwartz, describing Google as having taken Java “without attribution or contribution,” and then went on: “This is why I love scroogle,” referring to a now-defunct Web-search service that served up Google-like search results anonymously. See it below.

HP sued Oracle over what it says is an agreement to continue to create software that will run on HP systems running Intel’s Itanium chip, an agreement that HP argues was struck as part of the settlement that ended a suit stemming from former HP CEO Mark Hurd’s joining Oracle in 2010. Oracle, for its part, has argued that Intel plans to phase out the Itanium chip, a specialized server chip that never saw any real success in the marketplace, in order to focus more on its mainstream Xeon line of server chips and has only been producing them because HP has been paying it to do so.

The pair lobbed dueling filings at each other yesterday. In Oracle’s filing, which is the first of the pair embedded below, its lawyers accuse HP of trying to have the court write the contract it says it never agreed to in the first place: “HP has now been forced to admit that the fuzzy, feel-good language in the Reaffirmation Provision would fail as a porting contract on its own — unless the Court supplies numerous detailed terms inferred from the parties’ course of dealing.”

In the second of the two filings embedded below, HP makes the point that Hurd, once HP’s CEO and now Oracle’s co-president, had previously worked with Intel on Itanium-related matters. The key quote from the introduction:

“When asked point blank at his deposition whether it was misleading for HP not to publicly disclose the ICA [Itanium Collaboration Agreement], Oracle’s Co-President stated definitively: “No.” Thus, to prevail on its false advertising claims, Oracle must establish that its own Co-President was responsible for a fraudulent scheme while he was the CEO at HP, and that Mr. Hurd perjured himself at deposition. Although, and somewhat incredibly, Oracle recently stated on the record in response to this Court’s question that Mr. Hurd was part and parcel of this alleged scheme and pattern of lying, Oracle has no evidence to support this claim against Mr. Hurd. In any case, the fact that Oracle is even going down this path against its current Co-President reveals the absurdity of its entire claim.

Here, you can read them in the original, Oracle’s first:

Oracle Reply Msa 1599529

And now HP’s filing:

HP Reply in Support of Cross Claim MSJ