Messages in this thread | | | Date | Fri, 15 Aug 2008 16:17:42 -0400 | From | Theodore Tso <> | Subject | Re: [malware-list] TALPA - a threat model? well sorta. |
| |
On Fri, Aug 15, 2008 at 02:06:47PM -0400, Valdis.Kletnieks@vt.edu wrote: > This problem is actually identical to "new file scanned, but you don't have > the signature available yet so malware isn't detected". > > Those of us who have seen large mail servers pile up queues in the 10s of > millions in the 45 minutes between when the worm went critical-mass and when > we got a signature might disagree on it not being a big problem in practice.
For a mail server, I really think something specialized like ClamAV is a much better solution than something in userspace, which will probably decide it has to rescan every single file that gets written, including your mail server logs. :-)
A specialized solution for a mail server is *always* going to be able to a more efficient, more practical, and be able to do application-specialized things (such as refusing the e-mail while the connection is still open, so you don't have to worry about being RFC compliant about sending bounce mails when the SMTP return-path is most likely bogus).
- Ted
| |