Nettify’s Thunderbird Autoconfig Incident
Addresstigator was unveiled on January 4th, 2022, with one idea in mind: to easily allow C# programs to determine the server configuration from just one e-mail address using Thunderbird’s Autoconfig as the backend. Back then, it was fully online, and we wanted to make it possible to do the same thing offline for performance reasons and for those with sloppy internet connection.
Nettify tried to solve this problem by employing a script that provides a way to obtain information for all the mail providers. However, our method and our automation didn’t really account for two things:
- Our automated workflow was run once per day, and it was scraping the whole directory found in the online Autoconfig server.
- The autoconfig server may not be able to handle the excessive load caused by too many requests to different files that provide info about different service providers.
Today, our mail watch has recently pushed a commit to Nettify that emptied the mail list text file, and that led to us acting quickly before starting to make another release if necessary. We’ve reviewed our method by removing some options from the curl command, and saw that we were blocked by the CloudFlare protection mechanism, which led us to reviewing the Thunderbird Autoconfig repository and using it as a submodule to reproduce the exact same files without having to connect to the Autoconfig servers repeatedly.
As a result, we’ve released v1.5.5.2 as one of the procedures to ensure that incidents like this and the Textify one won’t happen again.
We deeply apologize to the Thunderbird team and everyone else affected by our old procedure for causing unnecessary load to the Thunderbird servers. We didn’t realize that it was a mistake prior to pushing the workflow that pulled mail info for all providers. We are working on providing compensation to those affected in many ways.
We promise that such mistakes will never repeat again, and that we’ll evaluate our future choices before we start working on it.
𝙀𝙪𝙧𝙤𝙥𝙚𝙖𝙣 𝙖𝙡𝙩𝙚𝙧𝙣𝙖𝙩𝙞𝙫𝙚𝙨 𝙩𝙤 𝙂𝙢𝙖𝙞𝙡
End-to-end encrypted email. No ads, full privacy.
client in Vivaldi.
just 
