> For instance a simplistic image viewer which opens internet connections and fetches data from the net How does the AntiVirus know that /usr/bin/mfvwr is supp

> For instance a simplistic image viewer which opens internet connections and fetches data from the net How does the AntiVirus know that /usr/bin/mfvwr is supposed to be an "simplistic image viewer"? Is an simplistic image viewer that allows you to upload images to an image hoster not simplistic, anymore? And is there another category of semi-simplistic image viewers who are allowed to do that but not scan your home directory? What about mfvwr's new feature of finding all your image files? Who tells the maintainer of the AV that mfvwr became non-simplistic in version 1.5-rc1 and a fully-fledged image manager in version 1.9-beta2? What about forks that add new, non-simplistic features but keep the name of the binary to be a drop-in-replacement?