Re: [Exim] System message & transport filtering

On Sat, 13 Oct 2001, Odhiambo Washington wrote:

> * Christopher Curtis <ccurtis@???> [20011012 21:23]: writing on the subject 'Re: [Exim] System message & transport filtering'
> |
> | What I want is something more like this - I want to scan all messages, but
> | at that point, the only thing I can modify are the headers. So I insert a
> | header that I want to key off later, to send them a new email during
> | delivery. I don't want to put it in a seperate folder, but if the
> | automatic email thing works without having to scan the entire message
> | body, that's exactly what I am looking for.
>
> Still sounds ambiguous to me. Messages are delievered in some order
> and I still believe the message that triggers your filter (or
> whatever) will be delivered before the one you generate as a
> consequence of it having an executable. Chances are high that your
> user will read the warning _after_ having met his match in the
> executable.
>
> Think of it another way: The main purpose of all this is to avoid the
> risk of infection. Just _reject_ the e-mails with the executables.
> That is what I do here and I explained it to my users. I told them in
> plain language that if they want the executables in their e-mails,

This is a fine solution for you, but not for me. I cannot deal with mass
filtering at a level like that, and I cannot inconvenience the people who
get mail with that -- most of them are not "my" users, and the ones that
could be considered mine, aren't. The situation is highly political and
I'm not yet at a position where I can be making decisions like that. And
the people who could make a decision like that will not go for it.

> I suggest that if you want to meandor around the executable, you
> should simply use your time on something else.
>
> DISCLAIMER: Remember this list is also about people's opinions ;-)

Ok, well ... is the summary then that even though I found the nasty
attachment and inserted a header using a message_filter (which has no
valid recipients), I have to rescan the entire message again at delivery?

Chris