Mailing List SIMS@mail.stalker.com Message #8212
From: Daniel Solomons <daniel@oo.net>
Subject: Re: Virus Blocking
Date: Fri, 27 Apr 2001 17:21:05 -0700
To: SIMS Discussions <SIMS@mail.stalker.com>
Hello -

On 4/27/01 10:57 AM, "(SIMS Discussions)" <SIMS@mail.stalker.com> wrote:

> Nobody has made that argument in this discussion (the stupidity of users was
> mentioned, but as an argument _for_ virus scanning as a way of saving those
> users from their own stupidity).

Then we agree that minimal virus scanning might save users from attack.

> Negative impact on the simplicity of SIMS _is_ relevant, as that very
> simplicity is a major reason that many of us have chosen to use SIMS in the
> first place.

Agreed. Therefore, the protection should be simple.

> IMHO, no it's not. SIMS is a simple MTA that does only what's required of it
> by the RFCs, without a lot of add-on features to bloat it and bog it down.
> Many of us find SIMS attractive primarily because of its simplicity. We don't
> need it to filter messages based on content and we don't want it to. If you
> have a need for such filtering, SIMS is not the tool for the job. There are
> other packages (including Stalker's own Communigate) that can do it for you.

You argue against making improvements. If you phrased your objections as
questions, maybe the improvements could be made to satisfy your stringent
requirements.

>> A subject line filter, if implemented, would really help. It would block
>> known viruses that might be transmitted by a well meaning friend, and it
>> would block *some* occurrences of "unstoppable" (eg "dfvc@juno.com" - chosen
>> at random from my logs) spam. The load on sims would be minimal. It seems
>> like a sensible suggestion :-)
>
> If "dfvc@juno.com" is the return-path of a message (it doesn't look like a
> subject line, so a subject line filter wouldn't catch it)

That is true. The message came from a not previously identified server
(there are millions), with this "unstoppable" return-path. However, the
subject line contained "Got debt?" It should be easy to stop.

> you can route it to
> 'error' and turn on 'Verify Return-Path' and SIMS will reject it.

Route *what* to error? Remember, the address looks good. What general rule
could have stopped it without blocking legitimate mail as well? (The address
was disabled soon after the spam, so it does us no good to create filters
after the fact.)

Also, Verify Return-Path was on

> However,
> filtering on return-paths is pretty hit-and-miss, since they are easily forged
> and spammers routinely vary them semi-randomly.

Another good argument for simple Subject filtering, or other minor
enhancement.

> Since Stalker's commercial product Communigate can already filter messages
> based on subject line, along with other content-based criteria (it's what the
> 'Rules' menu item in Communigator is for), I wouldn't expect them to be adding
> it to SIMS. It's the sort of 'extra' feature that you would expect to get with
> a commercial product, but is not necessarily appropriate for a simple,
> no-frills, free MTA like SIMS.

Rules are considerably more than Subject line filtering, and fit well with
the commercial product. The suggestion was simply to make the free product
more effective at blocking spam/viruses. The less spam gets through, the
worse it is for spammers, and the better it becomes for everyone else.

Daniel

--

Daniel Solomons
Internet Central
daniel@oo.net

206/923-1130 Main
206/355-1130 Priority

http://oo.net

Subscribe (FEED) Subscribe (DIGEST) Subscribe (INDEX) Unsubscribe Mail to Listmaster