Re: [Evolution] Re: FRQ: Pipe incoming mail through AntiVirus tools

[Jeffrey Stedfast <fejj ximian com>]

On Fri, 2002-07-12 at 06:15, Anton J Aylward, CISSP wrote:
> On Fri, 2002-07-12 at 00:34, Jeffrey Stedfast wrote:
> > Sure, but solving problems that don't exist is just wasting time (there
> > aren't any viruses that can affect Evolution like Melissa, ILoveYou,
> > etc).
>
> Now, Jeff, that not altogether reasonable for two reasons.
> First the "yes it used to be but we changed all that" will apply
> as LINUX gains in popularity.  When MS-Windows came out, the DOS based
> virus couldn't affect it and people were making much the same argument.

Sure, and when the problem arises, we'll implement it. Until then there
are plenty of other things that demand attention NOW. This can wait, and
it can wait quite a while. I don't see this being an issue in the
foreseeable future.

But please, if you feel differently - Evolution is an Open Source
client; you are free to contribute. Scratch your own itches and whatnot.

> Second, consider the corporate environments.  All the ones I've worked
> in are wildly heterogeneous: Novel+MS, PC+Mainframe+Mac, IBM, Compaq,
> Dec, HP.  As the profile of Linux develops, we are going to see
> corporations with a heterogeneous mix of workstations: Linux+windows
> (and possibly mac).  So saying there is no need for virus protection
> because of the presence of Linux is an argument that often won't apply.

I never said that. I said there were no viruses that affected Evolution.
That is different from saying Linux in general.

> Finally there is the case where people end up working with both Linux
> and Windows.  I'm like that.  There are some applications that simply
> don't exist in any form under Linux.  I'm on mailing lists for the user
> groups and while I read the mail under evolution, occasionally I need to
> do stuff with it in the Windows context.  I fire up the Windows box and
> connect to my IMAP server and ... need to make sure that even though the
> mail repository is on a Linux machine it has been protected against
> Windows malware.

Then you should be using server-side filtering. Client-side filtering is
not a solution for this problem.

First, Evolutionb only filters mail on the IMAP INBOX that is marked as
\Recent - this flag only exists for the first session, after that it is
gone.

So...lets pretend that we had this mechanism in place...

You are on Linux and open up Evolution, it downloads all your new IMAP
INBOX mail and strips any viruses off the messages and then re-uploads
them back to the IMAP server in the appropriate folder. (wow, that's a
lot of overhead! this could be better done server-side!!).

Now you're reading your mail and there's a particular message that you
want to read that contains a .doc word attachment...

You reboot into Windows (or walk over to a Windows box?) and launch
Outlook and connect to your IMAP server and in the meanwhile you have
gotten new mail. Well... Outlook doesn't have a means to do this type of
filtering and so some of the new mail you just got contain viruses. You
read that message you wanted to read and then go "Ah, here's some other
unread mail I have... lets just see what I got" So you click on the next
unread message and bam, now you're infected with a virus.

How exactly did that solve your virus problem? It didn't.

> Talk to Rob Rosenberger if you want to really learn about the myth
> surrounding viruses.  My sword arm is sore and tired on this point.
>
> > Along the same lines, solving problems that are already solved is also a
> > waste of time (if you want a virus scanner for your email, this is best
> > done on the SERVER not the CLIENT).
>
> Damn Right!
> And in a corporate setting the likelihood of a mail gateway or central
> server is much greater.

So you disagree with me only to conclude the same thing? *sigh*

Jeff

-- 
Jeffrey Stedfast
Evolution Hacker - Ximian, Inc.
fejj ximian com  - www.ximian.com