Re: Virus and spam blocking technique

From: Alan J. Flavell (flavell_at_mail.cern.ch)
Date: 08/23/03 

Date: Sat, 23 Aug 2003 21:27:11 +0200

On Sat, Aug 23, Gianni Mariani inscribed on the eternal scroll:

> Bounce notifications became more annoying than the SoBig virus itself.

Amen to that!!!!!!!

And they come in such a vast variety of shapes and sizes that they've
cost many hours of effort to block. Meantime, the innocent users have
got these bogus alerts accusing them of having sent out viruses, and
have wasted much support time and effort with their - unfounded -
distress.

Back at the campus, we've given up trying to be nice to those who send
us bogus virus alerts: we're rating them as spam (courtesy of
spamassassin) and rejecting them at SMTP time in just the same way as
we do with spam.

Fortunately it's a long standing campus policy not to let
potentially-dangerous attachment formats through the mailer in either
direction; and port 25 outgoing is blocked for non-MTA nodes since an
earlier round of viruses; so we can be confident that none of our
users transmitted viruses out by either of those paths, therefore they
won't need any incoming alerts of that sort.

The only remaining mess was the thousands of incoming bogus virus
alerts, and I _do_ mean *MESS*. A pox on their houses, and on the
vendors who sell them the software to do it.

NB I do not speak for CERN: I'm just another user here.

Loading