[Mimedefang] Notifying virus recipients

[Adrian Chadd]

On Thu, May 15, 2003, David F. Skoll wrote:
> On Thu, 15 May 2003, Adrian Chadd wrote:
> 
> > Ie, if foo at domain.com is sent a virus I've currently got it configured
> > to send back to the virus sender a bounce message. I'd also like
> > to email foo at domain.com that sender bar at domain2.com sent them a potential
> > virus.
> 
> Why?  What good do such notifications do?

Requirement from boss? :)

The boss would like the sender to be notified that they've sent something
which we've intercepted and modified. The boss would also like the recipient
to be notified that the sender sent them something which looked like a
virus.

I guess the train of thought here is this - people assume that email
Just Works(tm) and isn't modified. Any modification of this requires
notification. I can see senders wanting to know that an attachment
didn't actually make it to a recipient ("I have a virus?") and
a recipient wanting to know that something sent to them was modified
("That company spreadsheet you sent was munged by virus scanning?")

> > Now, in the example mimedefang-filter script the $FoundVirus variable
> > is set in filter_begin() and tested in filter(). Thats keeping state, right?
> > I'm doing some state-keeping magic in my filter for per-recipient
> > filters and it _seems_ to Do the right thing. What gives?
> 
> filter_begin, filter, filter_multipart and filter_end form an atomic
> unit in one Perl process.  The others (filter_relay, filter_sender and
> filter_recipient) do not.

Hm. Any possibility of at least bringing filter_recipient into this
atomic unit? It _seems_ to work right now but we all know how "seems to"
applies when you're dealing with threaded stuff.. :)




Adrian

-- 
Adrian Chadd			"It shouldn't take an hour and a half for
<adrian at creative.net.au>	  "any woman to take a bath."
				    - Captain Jerk, Women and ..