Nigel Metheringham wrote:
>
> Additionally, Chris Edwards suggested that it be possible to scan the
> first n KB of a message. This raises the following issues:-
> * Is SA on a part message sensible? A partial message could, in
> theory, banjax a load of SA rules, so getting lots of extra hits
> for (say) maleformed MIME
> * Should we add this feature to exiscan (or rather exim since its
> in the main line now).
>
> If we do want to do this AFAICS it has to be done within exim since SA
> cannot do that for us right now (since we bypass the bit that could do
> it for us).
No, I think Jeremy and I are clear that we're arguing the same point.
I'm arguing that Chris's proposal is a good feature request for Exim (in
the exiscan code path). Jeremy's counter-argument is that exim should
continue sending the full message to spamd, and spamd itself should not
scan the full content of messages above a certain size.
IMO, it would be preferable to do this within exim, because in the case
of extremely large messages, even sending the data across the wire to
spamd and reconstructing it in spamd's address space could be
problematic. I'm willing to be convinced I'm wrong on that one, though.
- Marc
