Ah. This is a bit of a soft question, but I though there might be some here that can share some insight.
I'm a developer. Sometimes I need to send a (bugfixed) DLL or EXE file to a customer. If this customer is in a big company, here's what I do:
- Rename the executable file (module.dll -> module.d__)
- zip the file with password so that it cannot be unzipped by the mail server
- rename the zip file (module.7z -> module.7.txt)
- send this via email and add a lengthy explanation for the guy at the other end on how to get at the file
- cross fingers that it'll get through the filters
Now, I can understand that email filters won't allow bare exe attachments.
What I fail to grasp is, how making email server filters unzip all attachments and then additionally check the unzipped files for executables regardless of their extension is adding any security. A zip-file won't suddenly explode in the users face. He'll have to unzip the file to get at any potentially malicious content. If you can get him to unzip a file, you get get him to jump through the hoops I described above.