[Avcheck] avcache announcement

[Ralf Hildebrandt]

On Thu, Mar 14, 2002 at 04:58:23PM +0100, Piotr KUCHARSKI wrote:
> On Thu, Mar 14, 2002 at 06:00:58PM +0300, Michael Tokarev wrote:
> > Ralf, this may be a better idea/solution for your exact problem.  How
> > about using Message-ID field instead of checksum as a key?
> 
> Depending on the lifetime of cache, checksum of body might
> be better -- subsequent copies of same mail would be cached already.
> Doing checksum requires more resources than checking MID, though.

On a mailserver, we want to prevent large writes! We have CPU in
abundance.

> And yahoo-groups send separate copies of the same mail, with
> different From_ (probably to get better error handling). 
> I noticed that after getting 48 warnings from infected, which
> all were triggered by one virus sent to some yahoo list.

We would only use the body for the md5 sum, and remove the headers
(except for the content type header)

-- 
Ralf Hildebrandt (Im Auftrag des Referat V A)   Ralf.Hildebrandt@charite.de
Charite Campus Virchow-Klinikum                 Tel.  +49 (0)30-450 570-155
Referat V A - Kommunikationsnetze -             Fax.  +49 (0)30-450 570-916
How can you have an email virus? Mail software doesn't execute code,
it just displays messages.