[pmmail-list] SirCam Virus Filtering Update

[Ralph Cohen]

On Sat, 04 Aug 2001 17:25:40 -0500 (CDT), Maynard wrote:

>While your ICSL filter catches all the body text and everything else
>which is thought to be "defining" of SirCam at this time, it is
>probably a whole not more CPU and time intensive than those more simple
>filters in use by those of us who don't mind a possible "false
>positive".

Hi Maynard,

I think that to put this discussion back into context, it's important
to note that Kris' filter was, in part, a response to problems Dave and
I had regarding false positives.  Using a simple filter, I found that
my messages to the list about the virus and the replies that quoted
them ended up in my junk folder courtesy of my filter.  Dave's filter
was set up to reply to any SirCam emails he received and inform the
sender that their system was infected, so he obviously didn't want to
falsely alarm people because of a false positive detection.  Kris'
filter makes false positive and false negative detections virtually
impossible.

Everyone's needs are different, however, so if a simple filter that
mostly works is fine for your needs, then go for it.  I really don't
think that there's any significant difference in the CPU overhead with
a simple vs. a complex filter, since both stop filtering as soon as a
condition is not met.  Regardless, I found the discussion on filter
design to be very interesting and educational and maybe it will inspire
other users to explore this great PMMail feature.

Ralph

rpcohen@neurotron.com

- pmmail-list - The PMMail Dicussion List ---------------------------
To UNSUBSCRIBE, send a message to mdaemon@bmtmicro.com with the first 
line of the message body being...
UNSUBSCRIBE pmmail-list@blueprintsoftwareworks.com