On Fri, 15 Aug 2008 10:47:15 PDT, david@lang.hm said:

quoted text
> in any case the vunerability is limited as the next time the signatures 
> are updated the files would get scanned again, so I don't think it's a big 
> problem in practice.

This problem is actually identical to "new file scanned, but you don't have
the signature available yet so malware isn't detected".

Those of us who have seen large mail servers pile up queues in the 10s of
millions in the 45 minutes between when the worm went critical-mass and when
we got a signature might disagree on it not being a big problem in practice.

Of course, if that's considered "outside" the threat model, somebody better
start writing down exactly what small corner of threat model this is actually
helping against...