A ratelimit idea

[fanf]

senji suggested ratelimiting email based on the MD5 checksum of any attachments, with the goal of slowing down an email virus attack. I think this might be feasible so I'm noting it here as a sort of public to-do list entry...

Comments

[nameandnature]

Sort of DCC in reverse (assuming you're talking outbound mail). The DCC does reasonably well on inbound viruses not by looking at the attachments, but at the body that the virus encloses to try to get you to open them (that is, the hash-based checksums are not catching inbound viruses for me, but the "fuzzy" ones are).