Subject: Re: Eliminating Virus Spam

From: Vernon Schryver <[email-masked]>
Date: Wed, 3 Jan 2001 16:19:33 -0700 (MST)

> From: Scott Lawrence <[email-masked]>

> > Still, there are other good reasons why the IESG should add something like
> > the following to sendmail.cf on odin.ietf.org to reject multi-part junk:
> > 
> >      HContent-Type: $>+Check_CT
> >      SCheck_CT
> >      R$*multipart$*              $#error $: 553 reject multi-part junk
> > 
>
> That seems rather heavy-handed; I've often found the vcard 
> attachments to be quite handy, for instance.

What vcard attachments should be sent to the main IETF list?  Unless
a substantial majority of main IETF mailing list subscribers find them
useful, they should not be sent to the main IETF list.  I suspect
that not only are they not useful to a majority, but that a majority
could not use them even if they knew about them and wanted to.

Anything other than pure 7-bit ASCII is very hard to justify in an
international mailing list that is not a captive of a single vendor.

>                                               The IETF produced the 
> MIME standard that defines these things, after all.  The multipart 
> mechanism is not itself responsible for the bad ways in which it is 
> used.

Each time I hear that statement about MIME, it feels as if my blood
pressure ncreases 10%.  I've heard it so often that by now I should be
excreting diamonds.

Outside the offices of the pointy haired and of marketoons, the existence
of a tool is not a requirement for its use in absolutely positively every
context.  MIME is an excellent screwdriver, but it is silly to insist, as
many do, that MIME must be used everywhere a hammer is needed.  The most
common rationalization for MIME everywhere (including the exceptionally
dumb Eudora headers that announce 7-bit ASCII and no multi-parts) is
politically correct cant involving "diversity" (of people, not computers).

Vernon Schryver    [email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Thu, 04 Jan 2001 12:33:15 +0100

Vernon, I fully agree with you: there is no reason to get multipart
messages in technical discussion mailing lists. Even if your solution
seems drastic this is the way we should go.

Thanks!

[email-masked]

---

From: Jon Crowcroft <[email-masked]>
Date: Thu, 04 Jan 2001 12:45:51 +0000

In message <[email-masked]>, Francis D

 >>seems drastic this is the way we should go.
 
i'd prefer to see us develop a more 21st century solution 

first, we should register mime types that we DO allow on a list

second, if someone must send an executable attachment , then we have a
signing server that signs the attachment as trustworthy - most of the
stupid atachments come from places who wouldnt be part of my trust
chain.....

 cheers

   jon

---

From: Harald Alvestrand <[email-masked]>
Date: Thu, 04 Jan 2001 13:54:40 +0100

fwiw, ietf+censored currently has the following set of filters in taboo_body:

>/^Antigen for Exchange found/
>/^Virus Notification: A virus has been detected/
>/^Antivirus Utility for Exchange found .* infected/
>/^Content-Type: application\/x-msdownload/i

the last one is ONLY included because I got so very tired of scanning the 
virus notifications trapped by the first 3 lines (23 caught at last count).

It is my arbitrariness, not a virus-scanning service.

--
Harald Tveit Alvestrand, [email-masked]
+47 41 44 29 94
Personal email: [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Thu, 04 Jan 2001 10:06:56 -0500

> signing server that signs the attachment as trustworthy

and how, and using what criteria, would the signing server evaluate 
the trustworthiness of the attachment?

e.g. I might consider an attachment that installed NetBSD on top
of an existing Windows system to be absolutely trustworthy 
(so long as it did it's job well) and performing a valuable community 
service, but others might not agree...  
(they might insist that Linux be installed instead.)

Keith

---

From: Jon Crowcroft <[email-masked]>
Date: Thu, 04 Jan 2001 15:19:33 +0000

each recipient chooses mailserver to subscribe whose sig
you trust ....i.e. a distributed, heteroegenous system.

for exampl,e i dont really care about windows viruses in my mail since
i read mail on a unix system, so i would subscribe to a listserver
that signed windows executables and visual basic attacments as
ok....:-)

 cheers

   jon