procmail
[Top] [All Lists]

Re: Virus scanning and defense-in-depth

2004-02-29 15:08:19
On Sun, 29 Feb 2004, Robert Allerstorfer wrote:

To satisfy all these problems, including catching bad .com
attachments, while not false-positive detecting good files with bad
extensions, I have now written my own AntiVirus plugin for procmail.

[...]

The ReadMe is found at
http://www.softlabs.info/antivirus/SoftlabsAV/ReadMe.txt

"... Thus, there will reside up to 12 different virus files in the
Quarantine directory: ..."

I'd like to issue a plea to you (and Nikos if he's reading this) who are
writing procmail recipes for public consumption:

Please DON'T assume that shoving the email into quarantine mailboxes is
the way that everyone wants to handle the problem.  Instead of writing ...

:0:
* conditions
some-quarantine-file

... please use ...

:0
* conditions
{
 SOME_DOCUMENTED_VARIABLE_NAME=some-useful-value
 SWITCHRC
}

This has the same effect (ending the recipe file) as delivering to a
folder, and allows others who are using your recipes to manage the outcome
differently if they like, e.g.

INCLUDERC = your-nifty-recipes.rc

:0
* SOME_DOCUMENTED_VARIABLE_NAME ?? some-useful-value
! some-quarantine-address

If you feel strongly that delivering to quarantine is the right thing and
want to provide examples of doing so, write two cooperating recipe files,
one that sets variables as I've suggested and another that INCLUDERCs the
first file, tests for the values, and files the messages.

Nikos' YAVR is migrating slowly in this direction, but it still has nearly
100 delivering recipes.  For those of you who are programmers, this is 
like writing a library function that calls exit(), forcibly stopping the
calling program.  This is OK in exceptional circumstances but frustrating
as the "normal" behavior.


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail