Stop that. Right now. I know – you meant well. You were trying to warn your friends and family about whichever virus is making the rounds. But…

What’s the source of your information? Is it email sent to you by someone else, probably forwarded several times already? What kind of authority do any of the senders have? Are they people you trust to know about viruses and security issues? Or is it your Uncle Fred who just got a computer last year and has been gleefully forwarding every piece of mail sent him to a dozen other people ever since he got on the net?

Did you verify the information with a reliable source? Personally? I don’t care if the person sending the message to you said they checked – did you? 90% of the virus warnings I see are hoaxes, and if every person personally checked the information they’d received before sending it to anyone else, hoaxes would die. I worked in the development department of a very well-known internet company where we regularly received "alerts" from the MIS department that were almost always virus hoaxes – and therefore any information from the MIS department was automatically considered nonsense by just about everyone. My favorite reliable sources are Computer Virus Myths, Symantec and The Urban Legends Reference Pages.

If it is about a real virus – do the people to whom you’re about to send this warning need to hear about it from you? Probably not. If they’re on the net and haven’t already installed antivirus software and set it to update itself regularly, they have problems anyway. If you’re a system administrator or otherwise responsible for the security of those people’s machines, you already have policies and software in place to protect them, right? So you probably don’t really need to send out email about this virus, whatever it is.

Please don’t send virus warnings to unrelated mailing lists and newsgroups, please, unless you absolutely know that a virus has been distributed via that list or newsgroup. Don’t send them to anyone, in fact, unless you have reason to believe that the individual to whom you are sending the message has been exposed to the virus in question. Don’t ever send virus warnings to everyone you know, unless your system has been infected and you have reason to believe that you have personally exposed all of those people to the virus.

There are plenty of legitimate email newsletters to which people can subscribe if they do want to hear about the latest viruses. All of the major antivirus software publishers have them – Symantec, AVP, Trend Micro – check with your chosen product’s publisher. People who want to get trustworthy alerts about general security issues should subscribe to the CERT advisory list.

Nobody subscribes to mailing lists for homeschoolers (or for saxophonists, philosophers, fashion enthusiasts, needleworkers, or haggis lovers) to get virus alerts. They’re off-topic, even if the list-owner doesn’t say a word. They just don’t belong on those lists unless a specific virus was distributed to the list or listmembers. It is rude to send virus alerts to those lists for any other reason. Please don’t be rude.

Originally published January 28, 2001