[news.software.b] filters to detect uuencode binaries

zdkm01@hou.amoco.com (Dave Moore) (05/24/91)

We are currently in the process of establishing a corporate UseNet 
network.  It will consist of Cnews servers, interconnected using
nntp.  Due to management concerns over copyright infringements and
viral attacks I would like to know if anyone is familiar with filters
that may be applied against a file to determine if it contains an
uuencode binary.  

Also, would it be possible to include such a filter in the nntp 
stream so that files containing the information could be intercepted
and removed or redirected.

Please email any info that you have and summarize in a later posting.

Thanks in advance.
-- 
Dave Moore	dmoore@hou.amoco.com
Amoco Corp. ISD SSS/Mini-Micro Systems
Houston, Texas (713) 556-2242
Socon 8-321-2242 CSSVM(ZDKM01)

jiro@shaman.com (Jiro Nakamura) (05/24/91)

In article <1991May23.190827.24459@hou.amoco.com> zdkm01@hou.amoco.com (Dave  
Moore) writes:
> We are currently in the process of establishing a corporate UseNet 
> network.  It will consist of Cnews servers, interconnected using
> nntp.  Due to management concerns over copyright infringements and
> viral attacks I would like to know if anyone is familiar with filters
> that may be applied against a file to determine if it contains an
> uuencode binary.  

  Although I understand your concerns, I assure you that you are using the  
wrong means to protect against them. Copyright infringments can come over  
non-uuencoded forms (excerpts from books springs to mind, because of the recent  
flurry over them). Viral attacks can come over from e-mail (the Internet virus)  
or people who don't watch their Bourne shell auto unpackers while running as  
root.....
   I'd say that it'd be a productivity loss more than a legal gain. What  
happens if I want to send someone at your company a source package? I usually  
tar, compress, uuencode them. What? A uuencode filter??!?!? Well, I'll just  
have to crypt or btoa it then. Are you going to have a btoa filter too? 
    Education is the best means to solve your problems. Also, cut out the feeds  
that are most likely to have virii or copyright infringments on them. Cut the  
alt.* and rec.* feeds, cut the comp.binaries.* feeds, comp.source.* feeds, if  
you are really paranoid.
    You are not attacking the real source of your problem, ignorance on the  
part of your users, and ignorance on the part of people who post stupid things.  
I think you should work on the human element before blaming or "fixing" the  
electronic one.

   My 2c.

   - jiro nakamura
     jiro@shaman.com
-- 
Jiro Nakamura				jiro@shaman.com
The Shaman Group			(607) 256-5125 VOICE
"Bring your dead, dying shamans here!"	(607) 277-1440 FAX/Data

sob@tmc.edu (Stan Barber) (06/10/91)

In article <1991May23.190827.24459@hou.amoco.com> zdkm01@hou.amoco.com (Dave Moore) writes:
>Also, would it be possible to include such a filter in the nntp 
>stream so that files containing the information could be intercepted
>and removed or redirected.

Such functionality should be part of the news system, not NNTP. I would guess
that the news relay and news posting functions of CNEWS could be modified to
do this. However, you'll probably have to do this yourself.

NNTP will not support such features and no plans are on the drawing board
to include such features. It is not what NNTP does.
-- 
Stan           internet: sob@bcm.tmc.edu         Director, Networking 
Olan           uucp: rutgers!bcm!sob             and Systems Support
Barber         Opinions expressed are only mine. Baylor College of Medicine