NCSG-DISCUSS Archives

NCSG-Discuss

NCSG-DISCUSS@LISTSERV.SYR.EDU

Options: Use Forum View

Use Monospaced Font
Show HTML Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
From:
Timothe Litt <[log in to unmask]>
Reply To:
Timothe Litt <[log in to unmask]>
Date:
Mon, 6 Oct 2014 07:47:34 -0400
Content-Type:
multipart/signed
Parts/Attachments:
text/plain (1769 bytes) , text/html (2376 bytes) , smime.p7s (4 kB)
I've just spent a couple of hours tracking down why dozens of e-mails to
this list have been quarantined by anti-virus software on my servers
(and probably other servers).

As I receive the list in digest format, this means many postings as the
entire digest (typically a day's worth of posts) is treated as malicious.

The problem turned out to be that a member's e-mail signature includes a
URL that Google has detected as a distributor of 19 exploits.

I've notified that member of the details privately.

*For everyone else:* The lesson is that including URLs in your signature
(as well as in the message body) can cause your e-mail to be treated as
malicious and not delivered.  At least when sending to mailing lists,
please keep your signatures as simple (and short) as possible!

FYI, to check a URL's status with Google's service, simply visit
http://www.google.com/safebrowsing/diagnostic?site= ,  appending the url
(starting with http://) after the '='.

*For the listserv administrator:*  Mail sent to the list should go
through an anti-virus filter before being accepted.  ClamAV is what I
use (free, safe & effective); configure it with 'SafeBrowsing yes' in
freshclam.conf.  Because that (apparently) isn't being done, a single
problematic posting causes every digest including (or quoting) that
message to be treated as malicious.  The classification is correct, but
the effect is to suppress delivery of many postings.  In any case, the
list should try not to distribute malicious mail.  (In this case, sent
inadvertently.)

This technical interlude now returns you to the regularly-scheduled
programming...

-- 
Timothe Litt
ACM Distinguished Engineer
--------------------------
This communication may not represent the ACM or my employer's views,
if any, on the matters discussed. 



ATOM RSS1 RSS2