Bug#231045: Clamav detects Worm.Sober.C1
On Fri, 20 Feb 2004, Brian May wrote:
> CC: Debian comaintainer of amavisd-new.
> >>>>> "Timo" == Timo Veith <timo.veith@gmx.de> writes:
>
> Timo> I thought that the $viruses_that_fake_sender_re matches
> Timo> against the result string of clamav which one can also find
> Timo> in a warning message, e.g.
Clamav or whichever AV you are using, actually.
> Timo> Bug #232052 rather means to diable all warnings which is not
> Timo> what we want. Please correct me if I am wrong.
Actually, we are considering changing the _default_ option to discarding
viruses. Granted, coupling that with the current default of no AV
administrator, this leads to quiet discards.
They are _NOT_ silent discards, since Amavis will log to syslog what it
did.
> This seems to be controversial.
Yep :-)
IMHO if one wants to spam others with virus warnings, he must take the
proper steps to do so by himself, without any sort of help from the
package. If your local policy requires this, you will know it, and
enable the dang thing.
(We should document all these default behaviour changes in the NEWS
file which apt-listchanges displays...)
> There are people who say virus scanners should never send a warning
> message because of the possibility you will accidently SPAM innocent
Brian is being nice. It is not a remote possibility, as almost every one
already knows. It is rare to find someone who didn't receive a "virus
alert" due to fake-sender viruses..
Maybe we should have a default virus admin set to postmaster@$mydomain.
Brian, I will ready CVS for:
D_DISCARD and no warn sender [aka SPAM others] for viruses
virusadmin set to postmaster
NEWS.Debian with a headsup, including one on the clamav socket thing
Then we can rollback if you disagere, or release the thing.
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: