Development info?

[Hugo van der Kooij]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex Broens wrote:
> On 8/24/2008 9:47 PM, Hugo van der Kooij wrote:
>>> SpamAssassin Rule Actions =
>>> TRAP_LINK_EXEC=>store-/var/spool/MailScanner/evidence
>>
>> That will store the URL but by the time I can look at that URL to fetch
>> the file the infected system might be cleaned out allready. So I need to
>> automate this a bit further.
> 
> Seems to me you want to do too much within MailScanner...
> 
> I'd forward the msg with the malware URI to a separate account, process
> that account with procmail/ripmime/snersoft's "URI" tool/GET and bingo
> you have the malware to do whatever you want with it and you're very
> flexible.

Sounds nice. But most message never make it as far as procmail. Most are
shot down by significant amount of SA points.

Hugo.

- --
hvdkooij at vanderkooij.org               http://hugo.vanderkooij.org/
PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc

	A: Yes.
	>Q: Are you sure?
	>>A: Because it reverses the logical flow of conversation.
	>>>Q: Why is top posting frowned upon?

Bored? Click on http://spamornot.org/ and rate those images.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFIseGzBvzDRVjxmYERAnQWAJ9fLvVjkRJO7Ly6lyD8aeaRfOekHwCfdhb6
5wZrH6PrEJNEwj3PkGXhrhs=
=Yfkq
-----END PGP SIGNATURE-----