Re: [Pan-users] Re: Re: How do I keep read messages between runs?

[Duncan]

On Fri 18 Jul 2003 05:06, Jeff Vian posted as excerpted below:
> >Mick.
> >
> >ps. [Likely a silly Q] I have got a virus scanner deleting some of the
> >downloaded files (when download bodies too is checked) running in the
> >background, I presume PAN can handle this cross-usuage?
> >
> >  
>
> Why would you expect pan to handle that????
>
> Pan keeps track of the cached data and headers using a .dat file.  If
> PAN makes a change in the status the .dat gets updated, if something
> else makes the change PAN would not be aware of the change until you
> force it to attempt to use the data that has been deleted/changed.
>
> If you have something else actively deleting the actual files then PAN
> would have to actively monitor file status constantly and that would
> really load it down and send performance into the toilet.

I no longer do Windows, which I call MSWormOS for obvious reasons. (Y'all got 
your critical updates to block the latest vulns, the RPC vulns?  RPC is 
dangerous in Linux too, but there it can be entirely turned off, as is 
recommended and the default in most modern installations, unlike MSWormOS 
(again), where it cannot be turned off.  W9x not affected, but the so-called 
"trusted computing" W2003Server certainly affected -- and it's a buffer 
overflow too, which 2K3 Server was supposed to have closely examined and 
corrected  all those..)

However, back when I DID still "do windows", I used and followed AV fairly 
closely, as I do most computer security related stuff.  With internet based 
incoming, there are two points at which it can be scanned.  1) at the 
networking subsystem layer, or 2) at the file system layer.  

Because of the time it takes to interpose itself and scan files as they are 
accessed (written or read) and the associated performance hit, this is 
generally done on executable files only (plus scanning within compressed 
files such as zips for executables).  PAN's cache consists of text files, not 
executables.  Also, since it's not OE or part of the OS itself, the AV has no 
reason to treat the files as special -- OTHER than text.  Thus, it's not so 
likely that AV scans at this level by default, altho it will of course do so 
if you have it set to scan all files or if the .msg extension is set as an 
executable format for the purposes of scanning.

Rather, the AV will scan the network traffic as it comes in, adding itself to 
the component stack as part of the networking subsystem, so it has access to 
everything coming and going.  Thus, it will interpose b4 PAN gets the file, 
rather than deleting the file out from under PAN in the cache.  Presumably it 
returns a "does not exist" error to PAN, as if the file simply weren't on the 
server, the overview then being treated as outdated.  Alternatively, it could 
return a "stub" file, as a substitute, which PAN would then store as the 
message, and which would then upon display let the user know the original 
file was intercepted due to showing positive on a virus scan.  In either 
case, it shouldn't interfere with PAN's normal functioning at all.

Even if it IS deleting files off the disk, PAN must be prepared to cope with 
that, as it would for instance cope with a file system corruption issue.  
There was a time when PAN did so rather less than gracefully, but quite some 
work was put into that area, so PAN should now treat it as simply a file that 
hasn't been retrieved yet and attempt to fetch it again if necessary.  Of 
course, with the AV scanning, that should fail, but again, it shouldn't crash 
PAN.  PAN should just return message unavailable, basically marking that 
message with an X in the display.

Of course, this is all as I understand it..

-- 
Duncan - List replies preferred.
"They that can give up essential liberty to obtain a little
temporary safety, deserve neither liberty nor safety."
Benjamin Franklin