On Fri, May 24, 2002 at 10:01:15AM +0100, Nigel Metheringham wrote:
> > You'd have thought the least a header regexp would do is bind to the 
> > start of the line!
> 
> The problem with the exim filter stuff is it was never designed to be
> able to do this and it *can't* bind to start of line (the string its
> matching against is a concaternated set of lines from the message -
> without newlines).
 
By the way,  I'd like to publicly  thank Nigel for this, and  his other work
that we benefit from daily.
 
> Its lame, I no longer use it much myself (theres a couple of places its
> not been removed from) even though I wrote the thing, but its cheap
> (money and MTA resources) and suprisingly effective against things like

Yeah, I am  aware it's not perfect,  it's just a fairly  good (IMO) stopgap.
We've discussed  this on  the exim  list, better  solutions are  exiscan and
friends.
I  just  don't  believe in  full  virus  checkers:  they  eat way  too  many
resources, they're reactive  for the most part (not proactive),  and I don't
want any of those files to go through in the first place, so no need to scan
them.

I haven't looked too hard yet (busy with modifying SA to fix RBL DUL checks,
and parallelize/put  a bound on  DNS RBL checks), but  something lightweight
that does proper mime analysis and  rejects types and attachements just like
what your system filter tries to do, is really all I need. Maybe exiscan can
do that, I have to check.
(I  don't  much  care  for  stripping attachments  or  modifying  the  body.
Bouncing, preferably at SMTP time, is plenty)

Marc
-- 
Microsoft is to operating systems & security ....
                                      .... what McDonalds is to gourmet cooking
  
Home page: http://marc.merlins.org/   |   Finger [EMAIL PROTECTED] for PGP key

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to