train on viruses? multipart/mixed

[Chris Fortune]

Hello Jef,

I can see that removing multipart/mixed messages would reduce your viruses, but it would also remove an awful lot of innocent mail.
I did a quick search through my own email corpus and found 583 good emails with multipart/mixed in the head section.

Don't throw out the baby with the bathwater.

Chris

----- Original Message -----
From: "Jef Poskanzer" <jef at acme.com>
To: <bogofilter at aotto.com>
Sent: Tuesday, February 24, 2004 11:30 AM
Subject: Re: train on viruses?


> I don't train bogofilter on viruses because viruses never reach my
> bogofilter.  I have two lines of defense before bogofilter, and they
> basically don't let any viruses through.
>
> 1) In my sendmail config, I reject all mail with Content-Type: multipart/mixed.
>
> 2) In my procmail config, I send any mail containing a Windoze executable to
> a junk folder.
>
> Note that getting rid of multipart/mixed also cuts my spam down to a trickle.
> I highly recommend it.  Here's the sendmail.mc code:
>
>
> LOCAL_RULESETS
>
> KMultipartMarker regex -f -aMULTIPART multipart/mixed.*
>
> HContent-Type: $>CheckContentType
>
> SCheckContentType
> R$+ $: $(MultipartMarker $1 $)
> RMULTIPART $#error $: "553 Due to widespread abuse, email with attached files is no longer permitted here. If you want your mail
to get through, send it as plain text."
>
> ---------------------------------------------------------------------
> FAQ: http://bogofilter.sourceforge.net/bogofilter-faq.html
> To unsubscribe, e-mail: bogofilter-unsubscribe at aotto.com
> For summary digest subscription: bogofilter-digest-subscribe at aotto.com
> For more commands, e-mail: bogofilter-help at aotto.com
>
>