Re: Moving forward ...

[snip]

>
> There are two possible outcomes from this, since one
> presumably wants virus scanning to occur before the MUA gets
> its mitts on it:
>
> 1. You can't train spam filters on viruses/worms/etc. The
> probable corollary is that it's going to be a given that
> virus/worm content should be removed from the mail stream
> when detected. It shouldn't even get to the spam filter.
>
> 2. Spam and malware filtering must happen at the same time,
> before the user has the opportunity to be stupid. Once again,
> viruses, etc., must be removed from the mail system before
> delivery, regardless of spam tagging/processing.

I see the message filtering happening in 3 phases (not all networks will
have all 3 levels).

Forgive the alliteration, I sometimes have to deal directly with our
marketing groups :)

1) Protection - MTA/MDA - implemented by administrator
  - malware
  - UCE/spam filtering

2) Policy - enforce communications policies (MTA or MDA)
  - content policy
  - archiving
  - ...

3) Preference (MDA or MUA)
  - personal rules
  - personal bayes filtering

Each level may remove items from the mail stream, or add data to the
messages for consumption later down the line.


>
> Karl B.
> Drexel University Postmaster
>