Re: list moderation request

Todays viruses are ugly. They somtimes can slip thru listserver filters e=
ven=20
if well configured. However, I cannot say I have even noticed that there =
was=20
any viruses sent via wrec/webi... but due to the extremely high amount of=
=20
viruses I receive these days I cannot track exacly how each reach me so i=
t=20
might simply be that I deleted all before looking..

Todays email viruses fake both the To and From addresses but it do not se=
em=20
like many if any of them (if any) fake the SMTP sender address, so any=20
mailinglist who only allows posts with a SMTP sender address subscribed t=
o=20
the list and do not look into to/from headers for this check should be pr=
etty=20
immune I think unless one of the subscribers actually happens to be infec=
ted.

I know there has been a a few cases where we have received these kind of=20
viruses on the squid-users list. Unfotunately the squid-cache.org listser=
ver=20
forgets the original SMTP sender and Received headers after processing th=
e=20
message so diagnosing exacly how these got onto the Squid lists is a bit=20
hard, but the frequency is sufficienly low (two in total that I know of)=20
compared to the amount of directly addressed viruses I receive with=20
squid-users related email addresses to make me beleive the SMTP sender=20
subscribed only filter applied on the list does its job well..=20

What I can advice to protect from any future viruses who fake the SMTP se=
nder=20
as well is to set up the listserver to reject any messages with a content=
type=20
of multipart/alternative, or mime/multipart where the first part is other=
=20
than text/plain. The squid-cache.org lists will be configured to do this =
as=20
soon as someone finds the time to implement it..

Regards
Henrik Nordstr=F6m



Ian Cooper wrote:
> I hear your grief; as webi-owner I'm getting about 40 reports for each =
of
> the viruses that's been posted here in the last few days.  (I doubt the
> problem is wrec, since Keith has pretty good controls on that system.)
>
> I can't offer any quick fixes[*] since I'm no longer in a position to s=
it
> in the cube of the person that runs the list software, and unfortunatel=
y
> I'm personally going to be unreachable for the next few days.
>
> [*] One option might be to temporarily suspend the list
>
> --On Thursday, May 16, 2002 10:29 -0500 "Jens-S. Voeckler"
>
> <[email protected]> wrote:
> > Hi,
> >
> > one of these lists, either wrec or webi, or both, is responsible for =
well
> > half of the SPAM that I receive. I request that, unless already done
> > thus, these lists be moderated! I am not talking about error-prone
> > programs. I am well inclined to abandon wrec and webi, if SPAM contin=
ues
> > to come in from these lists.
> >
> > Sincerely,
> > Dipl.-Ing. Jens-S. V=F6ckler ([email protected])
> > University of Chicago; Computer Science Department; Ryerson 155;
> > 1100 East 58th Street; Chicago, IL 60637-1581; USA; +1 773 834 9170