Jorey Bump wrote: > Michael Collette wrote: >> He's a great test case for this, as he apparently hangs out with the >> virus prevelent crowds, but I don't see him as available for further >> testing. > > This raises an interesting question: As an admin, I collect virii that > come my way, and analyse them to improve security on my boxen. I would > LOVE a mailing list that sent me nothing but messages infected with the > latest virus, so I could check the effectiveness of my mail scanner and > global procmailrc. Since the From: header would always be the same, I > could catch whatever gets through, after the recipe I use to quarantine > potential virii. That would be a great help in fine-tuning my rules. > > I know, I know, the potential for abuse is huge. You could sign up > someone you despise without their knowledge. But many lists send an > initial activation message, so this could be done safely. Does anything > similar already exist?
That is a very cool idea. I know it was invaluable for me to actually have a copy of the ILoveYou virus at the time of the outbreak in order to figure out how to combat it. I didn't have filtering set up at that time, and it did get loose on my network. Pretty much the only source of that kind of stuff would be the AV vendors themselves, and I doubt they'd be willing to share that which they make a living on. Maybe one of the security related sites out there? Later on, -- "Outside of a dog, a book is man's best friend. Inside of a dog, it's too dark to read." - Groucho Marx
