[Mimedefang] Anyone using File::Scan?

Royce Williams royce.williams at acsalaska.net
Wed Feb 16 11:41:36 EST 2005


On 2/15/2005 8:46 PM, David F. Skoll wrote:

> Does anyone use File::Scan with MIMEDefang?  It seems to cause a lot
> of problems with false positives.

I've never noticed or heard of any false positives until now.  I've
never had to ask the maintainer for anything, either, so I can't speak
to his/her responsiveness.  We've been happily using it for a couple
of years without incident.

Is there any pattern to the false positives has File::Scan been
generating?  Is it related just to the "suspicious file" detection,
or to actual signature data?


> For the next release, I'm considering removing the auto-detection
> of File::Scan.  In other words, if you want File::Scan, you'll have to
> specifically ask for it in your filter.

Not knowing any better, it seems to me that most folks would have
File::Scan installed entirely and only for use with MIMEDefang, but
I could be mistaken.  Since its value seems to come mostly from its
"quick first pass" quality, I would think that it wouldn't be as useful
as Clam AV or some other free package for other uses.

In other words, I'm arguing that if someone has File::Scan installed,
perhapsy they almost always intend to use it with MIMEDefang, so the
extra step of having to enable it might be superfluous.


> Any objections to this change?

It's pretty simple to use $Features{"File::Scan"} as you suggest later
in the thread, so I won't lose any sleep over it.

If I had my druthers, though, one or more of us could try to talk to
the maintainer (Henrique Dias, hdias at aesbuc.pt) to get at the root cause.
I'll drop him a friendly note that directs him to this thread.  If I
were him, I'd certainly want to know. :)

-royce

-- 
------------------------------------------------------------------------
Royce D. Williams                                  - IP Engineering, ACS
work: [first.last]@acsalaska.net                - PGP: 3FC087DB/1776A531
personal: [first]@alaska.net               - http://www.tycho.org/royce/



More information about the MIMEDefang mailing list