[Mimedefang] Re: Unsafe file types

[David F. Skoll]

On Mon, 1 Dec 2003, Lee Dilkie wrote:

> I'd like to voice another view altogether here.

Courageous! :-)

> On my mail server, I don't block any attachment's based on file extension.

If I didn't block .exes, I wouldn't run a security risk -- we don't
run Windows here at Roaring Penguin, after all.  On the other hand, I
would have about 7 MB/day of virus droppings polluting my Inbox.  This
could fairly be considered a DoS attack, since on average, I get about
only about 1.4MB/day of valid e-mail.  (And most of the byte-volume is
internal -- external people rarely send me messages with large
attachments.)

> I figure that the whole purpose of email is to communicate and I do
> my best to help that.

Again, in my case (I can't speak for you), permitting .exe files would
hamper communication.

> My problem is trying to weed out the non-legitimate email in the first
> place. That is, spam and email's containing known virus's. Blindly blocking
> attachments based on file extensions is going too far IMHO.

I agree.

And once no-one runs Windows, then we won't need to block based on
filename extensions.  However, the fact that Windows is ubiquitous
basically forces admins to do stupid and unfriendly things like block
extensions, pay money for virus-scanners, etc.

At the LISA conference this last October, someone (anonymously) left a
stack of anti-Microsoft pamphlets.  If you think I'm anti-Microsoft,
you should have read that little tirade. :-) There are a lot of
frustrated sysadmins out there.

Regards,

David.