W32/Sobig.F virus header

[Antony Stone]

On Thursday 21 August 2003 11:37 pm, Malcolm Ray wrote:

> I still don't see the point of adding any such header to outgoing mail,
> other than publicity (and the past few days have shown that "there's no
> such thing as bad publicity" isn't true).  Why should I trust any message
> from a remote site which claims to have been scanned?  Even if it's not
> lying, I have no way of knowing that the sending site keeps its AV
> signatures up to date.

We are not advocating that you trust a remote site.

We are saying you should change your own headers to be different from
everyone else's so that you (and your users) can trust your own headers, and
be sure which headers were added by *your* scanner (not someone else's, or
indeed a virus).

> If and when I deploy MailScanner for my users, I intend to drop that
> header.

In which case, how will your users be able to tell whether your copy of
MailScanner decided the email was safe or not?

Antony.

--

The truth is rarely pure, and never simple.

 - Oscar Wilde