[Mimedefang] Block mail by subject

[WBrown at e1b.org]

mimedefang-bounces at lists.roaringpenguin.com wrote on 03/24/2004 02:48:52 
PM:

> 'Fault' isn't really the issue here - if you want to blame
> something, blame the mailers that execute received content
> as a hidden side effect of opening or previewing a message.
> The more relevant issue is:  whose problem is it when your
> boss gets a few hundred rejection notices saying he sent a virus?
> That is the result when everyone sends notifications instead
> of just discarding virus-generated messages.

AHHH, but we don't know for sure that the messages being dropped (in the 
context of this thread) were infected.  All we know is they had the same 
subject as some viruses being sent.  That is not proof of infection.  In 
that case, reject.  If you *KNOW* that it has a virus, then drop. 
Rejecting with notification is a good temporary measure until updated 
virus definitions are available.  I can explain a false notice a lot 
easier than mail that did not go through.

The virus writers are not stupid. They pick subjects that are reasonable 
messages to receive.  They want - no, NEED people to think it could be a 
legitimate message.  Who in their right mind would open a message with a 
subject of "WARNING! Virus enclose - please to be opened"?