Re: What is the list policy on posting binaries ? and a suggestion for a wiki.

Russell Fulton wrote:
> Happy New Year and successful snorting to all! 

Same to you.

> 
> The subject says it all.  Do we actually have a policy? 
> 

No. Not an official policy. I allow rather large emails through the
list. Everything is AV scanned and spam filtered of course, and only
list members may post. So what might come through should be relatively
safe, with proper caution exercised of course.

As to whether TO post binaries: I would prefer if there is a binary
someone wants to get to the interested folks that they put it somewhere
for download, or shoot to me offlist and I can put it on the bleeding
web server. Rather than spam those that aren't interested. The tarball
from yesterday was tiny, it's not a big deal. But malware samples and
larger binaries can cause folks issues.


 > If you really need to distribute executable files I believe that the
> appropriate means of doing so is to post a link to a web site where it
> can be downloaded.  Don't have access to a web site where you can put
> stuff?  Well may be Matt and in merry band ;) could add a wiki to the
> bleeding threats web site (or is there one there already?).

Yup. I agree.

> https://webdropoff.auckland.ac.nz/  Files dropped here are virus checked
> unless they are encrypted.  ( The filter also blocks password protected
> zip files and a few other encrypted formats -- but not PGP).
> 

Neat tool! That an in house app?

As for a wiki: That's in the works and a high priority for me. The true
goal of that being a semi-self-documenting signature set, where the
references can all go there. Anyone can post and update things via the
wiki, and not have to do email crud. Then posts are reviewed by other
members to ensure non-spamminess and reasonable accuracy.

That's coming, soon. My free time is going into the spyware listening
post at the moment, and great data is starting to surface. The wiki will
be right after that!

Matt


--------------------------------------------
Matthew Jonkman
Bleeding Edge Threats
765-429-0398
765-807-3060 fax
http://www.bleedingthreats.net
--------------------------------------------

PGP: http://www.bleedingthreats.com/mattjonkman.asc