From owner-freebsd-security Tue Dec 4 16:34: 8 2001 Delivered-To: freebsd-security@freebsd.org Received: from lariat.org (lariat.org [12.23.109.2]) by hub.freebsd.org (Postfix) with ESMTP id 7CDCA37B41A for ; Tue, 4 Dec 2001 16:34:04 -0800 (PST) Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2]) by lariat.org (8.9.3/8.9.3) with ESMTP id RAA26148; Tue, 4 Dec 2001 17:33:50 -0700 (MST) Message-Id: <4.3.2.7.2.20011204172959.04d112e0@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Tue, 04 Dec 2001 17:33:45 -0700 To: , From: Brett Glass Subject: Re: Mail list is posting gone virus!!!! In-Reply-To: <01d701c17d10$a8b334b0$0001300a@lhtech.lhtek.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org At 03:11 PM 12/4/2001, "J e f f r e y D . G o r d o n" (a "space cadet?") wrote: > To my knowledge the FreeBSD mailing lists have too much traffic to run a >virus checker (and I don't blame them for not checking if they don't), I do not believe that this is a valid excuse. Checking for a virus or worm costs MUCH less than sending it to large numbers of users. >plus his virus pattern was RELEASED THIS AFTERNOON. Also no excuse. Our heuristic checker caught the very first copy (See http://www.brettglass.com/spam/paper.html) and would run just fine on the FreeBSD mail servers. Also, one should NEVER rely on antivirus vendors to provide patterns in a timely fashion. It is in their interest to delay deployment of patterns so as to allow users to suffer a bit; it increases their sales. McAfee is the worst offender here. --Brett Glass To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message