Question regarding Filename Rules

[Rob Poe]

I guess the thing about it is this:  

If we're blocking executable files, then how would that rule help?

I'm not being argumentative .. Just curious..



>>> roger at RUDNICK.COM.BR 4/19/2005 9:07:21 AM >>>
I was saved from some infections in the last year thanks to that rule in
MailScanner. For 5 or 6 times last year this function stopped new viruses
way before McAfee, Clamav and BitDefender in my server. In some of these
cases, the first antivirus was 4 hours late in the detection, and all this
time I would be voulnerable if this whas turned off...

I use this argument (that's true) all the time with my users when they
complain about this, and it's working!

Regards

Roger Jochem


----- Original Message -----
From: "Rob Poe" <rpoe at PLATTESHERIFF.ORG>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Tuesday, April 19, 2005 11:01 AM
Subject: Question regarding Filename Rules


> I have a client who is requesting that I remove the double extension rule.
They are getting files (jokes, at that!) with .htm.html extensions (along
with other things) and they want the double extension rule removed.
>
> I think this is a bad idea, can anyone give me a better argument than
"Because I said" to leave it in place?
>
> What are the chances of them being MORE at risk for infection?
>
> Thanks!
>
> Rob
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!