[clug] Interesting MyDoom bounce

[Martin Pool]

On 30 Jan 2004, Marek Samoc <mjs111 at rsphy1.anu.edu.au> wrote:
> On Fri, 30 Jan 2004, Tim Potter wrote:
> 
> TP> On Fri, Jan 30, 2004 at 02:11:53PM +1100, Brett Worth wrote:
> TP>
> TP> > I just saw this in our logs:
> TP> >
> TP> >  ----- The following addresses had permanent fatal errors -----
> TP> > <user at altair.com>
> TP> > 	(reason: 550 Error: Microsoft Windows(tm) attachments not accepted here. Please remove them and resend.)
> TP> >
> TP> > An excellent approach... :-)
> TP>
> TP> Except for the fact that the sender address is forged and the unlucky
> TP> sender now gets a bounce message for a message they didn't send.
> TP>
> TP> A better approach is to just discard virus emails.
> TP>
> TP>
> TP> Tim.
> TP>
> 
> Yes, but it is not up to the receiving end to decide whether a message is
> to be discarded.

Yes it is.  There are no circumstances when the error will do anything
useful, and it is likely to generate more noise.  It is a net loss.
Viruses should be silently dropped.

> The receiving end of an SMTP transaction just provides a
> 5xx error. It is up to the sending machine to bounce the message back or
> to drop it on the floor.

If the sender is stupid enough to pass a virus, it is probably stupid
enough to generate a bounce.

-- 
Martin 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.samba.org/archive/linux/attachments/20040130/ea813f47/attachment.bin