Hacker News new | ask | show | jobs
by m_eiman 4854 days ago
GMail silently drops any emails containing zipped .exe files that I send to my boss. That's despite me being one of his most common correspondents, part of the same GApps domain and whatnot. The problem is the same: spam filtering gone wrong.
3 comments
magicalist 4854 days ago
wait, you're sending from a google apps domain? From the web interface? It always just refused to send if I've tried to do that in the past, with a message explaining why. If you're sending from a different provider, gmail help claims it will bounce it back, not drop it silently, though I've never actually tried that.

In any case, not allowing specific file types as an attachment feels pretty different here, at the very least because the list of filetypes not allowed are enumerated[1], the refusal is explicit, and it's not due to the subject of the exe you're trying to send.

[1] http://support.google.com/mail/bin/answer.py?hl=en&answe...

link
m_eiman 4854 days ago
I'm sending via a non-Google SMTP server, and there's no bounce message or anything - it's just dropped. I'd argue that silently dropping any message from a known source, regardless of the contents, is wrong. I'd be ok with the -attachment- being removed if a scan shows it's a virus/trojan, but then there should be a notice to both sender and recipient.
link
CamperBob2 4854 days ago
Agreed, this is incredibly annoying, achieves little or nothing in the way of improved security, and makes GMail a lot less useful than it could be. They've done it for years.
link
zxtang 4854 days ago
It's also not very sophisticated last I checked. Just change the extension.
link
cynwoody 4854 days ago
Nothing silent about it, in my experience, at least. I was trying to send a self-extracting encrypted archive (full of documents) to my tax guy. Google wouldn't accept the .exe attachment until I added .remove to the end of the name.

The intent is to require the receiver to take some affirmative action (e.g. deleting the .remove) before blindly running the attachment and getting pwned. Seems perfectly reasonable.

Unlike what Apple just got caught doing. I'm ripe for a new phone. I don't think it's going to be an iPhone ...

link