On 14 June 2002, Jason Haar said:
> On Thu, Jun 13, 2002 at 01:19:38PM -0400, Greg Ward wrote:
> > This is English, not German -- only proper nouns should be capitalized.
>
> Wow - some QA - great!
Wow -- a response -- great! ;-) Now that I know someone is listening,
kindly permit me to comment at, ummm, greater length on the default
warning message sent by qmail-scanner. First, the headers as shown in
my MUA:
Date: 14 Jun 2002 02:12:21 -0000
From: "System Anti-Virus Administrator" <[EMAIL PROTECTED]>
Cc: [EMAIL PROTECTED]
Subject: Virus found in sent message "Qmail-Scanner viral test: checking
perlscanner..."
If this warning message is sent to [EMAIL PROTECTED] and nobody
else, then there should be a "To: [EMAIL PROTECTED]" header. You're
right that it's not mandated by any RFC (AFAIK), but having a "Cc"
header without a "To" header is just weird.
(Hmmm: it could be that qmail-scanner isn't putting any recipient
headers in. I believe qmail adds a "Cc" to the envelope recipient(s) in
that case. Easy solution: add a "To" header.)
OK, on to the body.
[This message was _not_ sent to the originator, as they appear to
be a mailing-list or other automated Email message]
Grammar: "the originator" is singular; "they" implies plural.
The object of this sentence is first an email mailbox ("originator"),
then a collection of many email mailboxes ("mailing-list"), then an
email message. It's a very confused sentence.
Compound adjectives are hyphenated in English, but compound
nouns are not: "Mailman is my favourite mailing-list software. I use it
to run many mailing lists."
"Email" is not a proper noun. Nor is "virus" for that matter.
Try this on for size:
[This warning message is *not* being sent to the apparent originator
of the original message. This address appears to be that of a
mailing list or other automated email system.]
If the envelope sender is non-empty, I would make that:
[This warning message is *not* being sent to the apparent originator
of the original message, [EMAIL PROTECTED] This address appears to be
that of a mailing list or other automated email system.]
(I'm assuming that the empty envelope sender is what caused this message
to be inserted.)
(BTW, what exactly are your criteria for determining that something is a
"mailing-list or other automated Email message"? Apart from empty
vs. non-empty envelope senders, I don't see how you can make this
determination.)
Next:
Please update your virus scanner or contact your I.T support
personnel as soon as possible as you have a virus on your system.
"IT support personnel" would be better. Or maybe just "system
administrator".
However, that begs the question: I thought this message was sent to
[EMAIL PROTECTED] because a virus was intercepted by the python.net
mail server. That doesn't mean that there's a virus on that system! It
just means some luser out there on the net has an infected PC. I don't
care; there's nothing I can do about it, and all I want is to stop the
junk from getting into user's mailboxes.
Next:
Your message was sent with the following envelope:
MAIL FROM:
RCPT TO: [EMAIL PROTECTED]
Not quite true; the envelope was more likely
MAIL FROM: <>
RCPT TO: <[EMAIL PROTECTED]>
Err, waitasec, that's not right either: I deliberately modified
test_installation.sh so it sends the test messages to [EMAIL PROTECTED]
rather than [EMAIL PROTECTED] Where the heck does it get the idea that
the recipient was [EMAIL PROTECTED]? Isn't that just the recipient
for the *warning* message? What's going on here?
Anyways, I'm very dubious about the whole notion of virus scanners
sending out warning messages. Six months ago, it made a little bit of
sense to try to send a brief warning *to the envelope sender* of a
virus. Nowadays, most viral email that I see has forged envelope
senders and/or a forged From header. I personally went through a couple
of weeks where every day I had 3 or 4 messages from virus scanners
around the 'net telling me that I was infected with a virus, because
some !@#^$@!#$ virus was forging my address all over creation.
(Probably found it in lusers' web caches, I dunno.)
To summarize my not-at-all humble opinion: virus scanners should not
notify the intended recipient that a virus was stopped. (That's just
stupid -- the whole point of virus scanners is to keep junk out of my
mailbox, and 37 "I stopped a virus for you" messages are just as
annoying as 37 viral messages. Also, stupid virus scanners tend to send
"I stopped a virus for you" messages to mailing lists, which is even
worse.) Virus scanners should not bother to notify the apparent sender
of the virus that they sent a virus either, because nowadays that
address is more than likely forged. I suppose there's some small value
in having a virus scanner notify the local admin(s) that it has stopped
a virus, either incoming or outgoing -- but I'd rather see, say, daily
summaries of the caught viruses. Getting a notification for every virus
caught on a busy system would be a massive hassle.
Greg
--
Greg Ward - Linux nerd [EMAIL PROTECTED]
http://starship.python.net/~gward/
The NSA. We care: we listen to our customers.
_______________________________________________________________
Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -
http://devcon.sprintpcs.com/adp/index.cfm?source=osdntextlink
_______________________________________________
Qmail-scanner-general mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
