I don't think any of the major mailing list manager programs even make it easy any more to disable the standard three-way handshake subscription confirmation, even if you wanted to. In a rather vast world, many things are possible, but I suspect these went out with the dodo.

Anyhow, the occasional MS-Windows virus autoposted to a mailing list is merely amusing, and surely harmless to anyone with half a brain. What's truly pernicious is what then happens, on lists that have made the horrific error of munging Reply-To. Typically, a half-dozen other Microsoft users' antiviral programs then send out autoresponse "warning" e-mails. Because of the Reply-To munging, those warnings go to the mailing list, rather than to the malware sender.

Worse along those lines happens, on lists with munged Reply-To, with users who have misconfigured "vacation" autoresponders: instant mail loop, and fun for the whole network.

Virus "warning" autoresponders I've seen are brain-dead, anyway. I can't count the number of times I've been "warned" about supposedly sending Microsoft viruses from my copy of mutt on Linux, by antiviral packages so incompetent at SMTP header analysis that they were mislead by Klez or Bugbear fakemail. Over at the Linux Gazette Answer Gang, we've stopped even attempting to enlighten the guilty admins: Their mail domains just go straight onto the deny list.

Rick Moen
rick@linuxmafia.com