2004-01-30»
bbc censorship»
It's always a joy to watch prissy corporate mail filters twitch their lace
curtains and bounce back NTK when they spot a phrase they don't like. This
week they refused to deliver NTK because we used the word "dyke". As in Greg Dyke.
(Admittedly, the completely justified use of "butt" and "wanker" elsewhere
might not have helped our case.)
Not as bad as one UK firm's IT department, which is currently binning any
incoming email with "hello" or "Hi" in the subject line. "These are common
header descriptions of the e-mails containing the [MyDoom] virus", they say.
I'll go out on a limb here and suggest they're also common header descriptions
of the e-mails not containing it, too.
2004-01-29»
mydoom vs procmail - battle of the CPU cycles»
A bit too late for most, I guess, here's the procmail recipe I've been
using to fend off the majority of MyDoom
:0 HB
* <50000
* ^Subject: (test|hi|hello|Mail Delivery System|
Mail Transaction Failed|Server Report|Status|Error|)$
* ^Content-type: application/octet-stream;
* (file)?name="(document|readme|doc|text|file|
data|test|message|body).(pif|scr|exe|cmd|bat|zip)
mydoom
It's nabbed about 900 of them so far. There's a variant that uses random
ascii for the document name which that it doesn't catch, but I haven't seen
many of those.
Now, to devise some way of coping with the million anti-virus checkers that
bounce the mail with a "Virus Refused" message - even though their designers
know that the return address is fake, and they are bouncing to innocent
parties. Sigh.
