full-disclosure - AW: Re: Filtering sobig with postfix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <DF79BE12AF8DD344B107D0D03621E5750ED9C8@kermit.corp.hansenet.com>
From: vogt at hansenet.com (vogt@...senet.com)
Subject: AW: Re: Filtering sobig with postfix

> > /see attached file for details/	REJECT
> 
> this incurs a factor 2-4 performance drop, and it could also elicit
> false positives. you should definitely do more than just REJECT
> (i.e. write out a message: s/REJECT/554 Suspected virus/).

Agree, a message would be good.

> also, this is more the job of a content filter than of an MTA.

True. But this solution offers two advantages:

a) it's a quick hack, it works (apparently), and it was easy to
   do it on a tuesday morning without installing all kinds of
   additional filters.

b) I never have to store the crap on my own system. Let the windos
   users choke on it, even at ?1/GB my harddisk space is too
   expensive to store their virus spam.

Tom