Hacker News Reader

"before that the inbound email is scanned for viruses (ClamAV)"

We moved away from ClamAV because it detected less than a tenth of virus samples we tested in practice. Simple things like EXEs, ISOs, VBAs and JS attachments.

VirusTotal uploads showed the same single digit detection rate for ClamAV.

I thought ClamAV was a better scanner, have things stagnated?

View on HN

I use the free version of sophos for linux plugged into rspamd. Hopefully it has a better detection rate since Sophos. I did it this way since I read about the poor detection rate of ClamAV. Tbh we've blanket banned exes and their ilk so I'm not even sure if we need it anymore.

Did you use anything else than stock rules?

Nothing other than stock settings and the latest signatures, same as VirusTotal's ClamAV I think?

Reply on news.ycombinator.com