On Mon, 8 Mar 2004, Josh Kelley wrote: >Stephen Smoogen wrote: > >>On Fri, 2004-03-05 at 12:37, Josh Kelley wrote: >> >> >>>1. Most mass-mailing viruses are sent directly by the virus, in which >>>case no one will see any bounces generated. >>> >>> >> >>Right and Wrong. Most mass mailing viruses are sent by the virus, but >>with a spoofed email address that can be either something in the mailbox >>or some other item. I get about 20 you sent this virus that I couldnt >>have sent every week. >> >> >I'm not suggesting sending out "you sent this message" notifications; I >know that's a bad idea. I'm suggesting using action_bounce, which >rejects the message at the SMTP level, instead of action_discard, which >accepts the message and silently discards it. > >In this case, the only time someone would see the bounce is if the virus >sends a copy of itself through unprotected mail server A, unprotected >mail server A tries to relay the message to protected mail server B, >which rejects the message, so then unprotected mail server A tries to >generate an error message to the forged sender address. The proper fix >for this problem, I think, is for mail server A to add virus protection, >not for mail server B to start silently discarding email that it can't >guarantee has no valid content.
I have no control over the 300+ mail relay A's that hit my site every day. From the various other labs, ISPs etc.. this is the usual case. >>people are going to bounce it to the recipient.] >> >> >> >My argument is that if a mail server silently drop all viral messages, >it risks losing valid content. I don't know of a good way to prevent this. > Sorry.. I am from the 'there is no such thing as valid content if its infected' school. However I have to be for they really are out to get me :). -- Stephen John Smoogen [EMAIL PROTECTED] Los Alamos National Lab CCN-5 Sched 5/40 PH: 4-0645 Ta-03 SM-1498 MailStop B255 DP 10S Los Alamos, NM 87545 -- So shines a good deed in a weary world. = Willy Wonka -- _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
