Subject: Re: Viruses

From: "Jon William Toigo" <[email-masked]>
Date: Fri, 27 Jul 2001 08:43:26 -0400

I have received multiple infected emails from multiple sources over the past
four days, followed by a flood of system generated warnings after each one.
It's kind of ridiculous.

JWT
----- Original Message -----
From: "Greg Minshall" <[email-masked]>
To: "Jon William Toigo" <[email-masked]>
Sent: Thursday, July 26, 2001 10:12 PM
Subject: Re: Viruses

> i think *1* virus-attached e-mail going through the IETF list will result
in
> 10s or 100s of the warnings (if that is what you are talking about).
>

---

From: Greg Minshall <[email-masked]>
Date: Fri, 27 Jul 2001 07:50:06 -0700

yep, it's a pain.

---

From: John Starta <[email-masked]>
Date: Fri, 27 Jul 2001 08:18:41 -0700

All of which could have been easily filtered locally on your workstation. 
Rather than contribute to the noise, perhaps learning how to use the basic 
capabilities of your mail client would be time better spent.

jas

---

From: "Jon William Toigo" <[email-masked]>
Date: Fri, 27 Jul 2001 11:33:52 -0400

Mr. Starta,

Thank you for your message.  However, my mail client is not equipped to
handle the blocking of messages that emanate from different senders at
different times with different content.  The simplest technique is to simply
block everything coming from the IETF mail list, I suppose.  That would
certainly reduce the "noise" to which you refer.  Heck, you would have the
reflector all to yourself (except for the virus writers) if everyone
followed your recommendation.

JWT

---

From: John Starta <[email-masked]>
Date: Fri, 27 Jul 2001 08:50:16 -0700

Every single message propagating the SirCam virus has a distinct pattern 
upon which you can filter. It doesn't matter that they're coming from 
different senders, at different times, with different attachments. In 
addition, the warning messages about the viruses presence have distinct 
patterns that can also be filtered upon. The "noise" I'm referring to are 
individuals complaining to the entire list about something absolutely 
within their control by filtering locally.

I have nothing against you personally and look forward to your future 
contributions to the list.

Cheers,

jas

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 27 Jul 2001 18:05:12 +0200

JWT writes:

> However, my mail client is not equipped to
> handle the blocking of messages that emanate
> from different senders at different times
> with different content.

Try sorting on message size.  The SirCam messages are all quite large in size,
compared to the average text message.  I direct all messages over a few K bytes
in size to a separate folder, then examine and/or discard the contents thereof
periodically.  This is with Outlook Express, but I'm sure other programs can do
the same.

---

From: Mark Durham <[email-masked]>
Date: Fri, 27 Jul 2001 09:31:14 -0700

Server-side filtering is obviously a more efficient approach. As for "noise,"
doesn't your post fit this category as well (or as badly) as the one you're
responding to?

> The IETF list is a general discussion list, ideally focused on
> technical issues. Note that a number of users and/or domains are
> filtered out as they have repeatedly sent spam messages to the list.

Given that description, I'm not sure I see how filtering is off-topic.

---

From: John Starta <[email-masked]>
Date: Fri, 27 Jul 2001 10:23:45 -0700

I concur server-side filtering is generally more efficient. However I'm 
somewhat leery of agreeing that it's necessarily "better". (Who decides 
who/what/when? This is not a role for the IETF.) Nevertheless, server-side 
filtering isn't available on this list. Thus instead of complaining about 
the large number of messages infected with the Sircam virus, or the warning 
messages alerting us to that fact, why not take personal responsibility for 
resolving it yourself by filtering locally? I don't understand why this is 
such a difficult point to understand.

The issue really extends beyond the current hot point of the virus laden 
messages or the warnings. Don't like the message, thread, or author. Filter 
it LOCALLY. Think back to the days of Usenet and kill files. This enables 
those that find the content worthwhile to continue to read, while those 
that have chosen to filter not to be bothered.

Cheers.

jas