hi all,
jeez, ya go out for lunch ... THEN everybody starts talking at once! :-)
thx for the replies ...
-- On September 27, 2005 3:42:38 PM -0400 Marc Sherman
<msherman@???> wrote:
>> (1) to check/deny on 'serious mime errors'
...
>> (i) how should (1) be done if NOT with 'demime'?
>
>
http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050523/msg00120.html
perfect. thx!
>> (2) to invoke my spam scanner, Exiscan/ClamAV
...
>> "Clamd does not seem to unpack MIME containers, so it is recommended
>> to unpack MIME attachments in the MIME ACL"
> Like the demime option, that statement about clamav is obsolete. Clamav does
> a pretty good job at unpacking mime containers these days.
> Yes, my clamav acl is just:
> deny message = This message contains malware ($malware_name)
> malware = *
>
> and it has been working very well for some time.
good to know. thx.
> <clamav maintainer hat on>
> yes and no, is my advice to you
...
> If libz can't unpack a zip file ... then clamav won't either.
...
> If it's OK ... then I'd say rely on clamav
...
> If you feel you have to be more cautious, then wish that exim was
> keeping the demime facility :(
unfortunately, i have no experiential basis on which to claim any such
'feeling' one way or the other.
short of any substantive quantification of the problem, which may well have
been done, this _seems_ like Exim's replacing a solution that works well with
ClamAV (demime) with one that is, by some measure, sub-optimal (depend on
ClamAV's unpack ...)
and, btw, how long *IS* demime 'sticking around' in exim?
personally, i'm still unclear which options are 'good', let alone 'best' ...
so, at first blush, it sounds (to me) like two things (at least) should be
considered:
(1) either a functional alternative needs to be made available to the obsolete
demime-ing in Exim, demime should be kept, and/or work with the ClamAV folks to
help overcome the shortcomings mentioned above there ...
(2) Exim's documentation (wiki?) should be updated to reflect the current state
of affairs --whatever that ends up being -- with demime, ClamAV, etc.
cheers,
richard
