ietf-mta-filters
[Top] [All Lists]

Re: spamtest/virustest "NIL" behaviour

2003-04-30 11:10:45

Hi Nigel,

--On Wednesday, April 30, 2003 6:58 PM +0100 Nigel Swinson <Nigel(_at_)Swinson(_dot_)com> wrote:

|> virustest value:
|>
|> 0 - definitely clear of viruses
|> 1 - possibly contains a virus/unchecked
|> 2 - definitely contains a virus
|>
|> That would eliminate NIL entirely.
|
| Sounds good to me too :o)
|
| I do wonder though if we should just use 0-10 for virustest too, so that
| it's the same range as spam test.  It might be more "intuative" to users.
| So you'd have varying degrees of suspicion.  If implementations just map
| to the values 0, 5 and 10 then that's fine, but I don't know if there are
| anti virus implementations that give a "score" in the same way as anti
| spam does... or will there be such an implementation in the future?  Just
| an idea... I'm not completely sold on it myself I have to say.

I did just think of one other state that might be interesting to enumerate and that is 'virus was detected but removed - message is now safe'. That could simply be handled as a comment in the 'text' part of the result, or by inserting it into the enumeration at index 1. I know a number of anti-virus tools are able to 'clean' messages and being able to detect that in sieve might be useful. Would this be useful to add?

I do think virustest should be restricted to a very limited set of values as the potential for damage caused by letting some through is much more significant than spamtest.

--
Cyrus Daboo