[Avcheck] Re: text message shouldn't be scanned?

[Michael Tokarev]

adi wrote:
> 
> Sorry me for bothering you (again!) for asking about avcheck stuff
> directly to you. My message to avcheck list get bounced.

I was shure I forgot something, and here it is.  Yesterday I changed
configuration on our mailserver, and forgot about list.corpit.ru and
mailman.  Should be fixed now.  Thank you for the information -- you
was the "beta-tester" of our mailserver... ;)

I'll Cc this to the list (and this will be another test for new settings)

[]
> Received: by isol.portal.mweb.co.id (Postfix, from userid 501)
>         id CBDEC73532; Mon, 31 Dec 2001 23:53:30 +0700 (JAVT)
> Date: Mon, 31 Dec 2001 23:53:30 +0700 (JAVT)
> From: adi <adi@satunet.com>
> To: avcheck@list.corpit.ru
> Subject: text message shouldn't be scanned?
> Message-ID: <20011231235330.A26453@satunet.com>
> Mime-Version: 1.0
> Content-Type: text/plain; charset=us-ascii
> Content-Disposition: inline
> 
> Happy New Year!

Happy! ;)

> I thought that text message, i.e text/plain or text/html(?) shouldn't
> be scanned by antivirus daemon. This especially give benefit for one
> that use content inspector stuff.
> 
> Is it worth of effort? Comments?

Well, not quite this.  There are uuencoded attachments (still) exists.
While most MUAs (?) will not open/execute them while opening a message
(like outgluck does with javascript or .exes with audio/x-waw mimetype),
them still should be scanned IMHO.  Uuencode is of a *very* little usage
today, and any checks for this "encoding" *may* be omitted entirely.

Next, for the (small) plaintext messages, a virusscanner performs very
fast too.  I agree that it will be faster to bypass a virus check for
such a messages, but not significantly faster.  Well, it will be
interesting to see the numbers (comparing e.g. simple "cat >/dev/null"-like
"inspector" with avcheck on a number of plaintext messages).  Our mailserver,
while does not handles a huge mail volume, runs on i486 DX4/100 machine,
and I'm happy with it's speed even when processing many mails with large
attachments at once (where a virusscanner uses CPU expensively).  Again,
I don't know how the change will be better on a high-volume mail machine.

Best regards,
 Michael.