-------- Original-Nachricht -------- > Datum: Mon, 26 Nov 2007 19:34:40 +0000 > Von: Mark Rogers <[EMAIL PROTECTED]> > An: [email protected] > Betreff: Re: [dspam-users] EICAR equivalent for spam
> Steve wrote: > > Can you explain what the goal or reason is you want DSPAM to act > positive to a GTube string? > > > > Basically, to check everything around dspam. > > - To make sure spam gets quarantined correctly, and that the right user > can see it in their own quarantine box and process it. > - To check that any user can change their own settings and see the > effect on incoming spam (eg quarantine/tag/etc) > - To compliment the logs when trying to understand the path an email is > taking through dpsam (eg "tail -f" a given dspam/postfix/whatever log, > inject a "known spam", see what happens). > - To test that a domain is correctly configured to trap spam prior to > that domain's MX records being pointed to the server (weak example, > since this is pretty easy to check via mail headers too). > And you plan to capture all of the above test with one simple GTUBE test string? > And so on. Pretty much the equivalent of EICAR: if your AV program > catches EICAR it doesn't prove that the AV program is functioning 100% > correctly (eg properly downloading updates etc[*]), but it does at least > make it easy to test that the system is able to handle a simple case. > But DSPAM does NOT download anything. DSPAM learns from the data it receives or from the user making decisions. Something so universal and easy as the EICAR or GTUBE is not possible with DSPAM (actually this is not possible with any pure statistical filter). > [8]Long ago I thought that it would be useful if EICAR did release a new > test "virus" every month or so, so that testing with a current EICAR > binary would test that updates were being properly downloaded and > installed. But that's another story. > I test my AV by ensuring that the download/update process is working correctly. Testing my AV with EICAR (even if it would be new each month) is not the right approach for a functional test. At least I don't see it as a perfect test. > -- > Mark Rogers // More Solutions Ltd (Peterborough Office) // 0845 45 89 555 > Registered in England (0456 0902) at 13 Clarke Rd, Milton Keynes, MK1 1LG > -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer
