On Wed, 18 Jul 2018 14:32:26 +0100 Richard Clayton <richard@highwayman.com> wrote: <snip>
and so this still begs the question - what is the arbitrary number?
in my experience the canonical arbitrary number is 42
so if you receive 41 emails for you to verify your email address from the same ESP and the same resource, in ten minutes, you would not consider this abuse or abusive behavior. good to know, thank you.
It seems as if both Richard and Michele agree and do not think that the arbitrary number of 5 verification emails in ten minutes to a victim email address, is abuse or abusive behavior.
Michele did not express such an opinion and neither did I.
Of course you did. simply read the paragraph above. You would not consider 5 emails in ten minutes abuse or are you simply joking about the "canonical arbitrary number" ? in that case: It is not very funny as you already seem confused about the TWO abusers. The criminal going to Google and adding the verification email = Abuse Google going and sending 5 verification emails in ten minutes = Also Abuse.
Still it would be interesting to know if this is actually the case. If nothing under 20 000 "verify your email address" emails per day from the same IP number / resource is not abuse - Then it would be good to know that the members of this abuse WG think that I am silly with my daily limit of three.
You appear to have misunderstood the mail bombing attack which is widely distributed. The 20000 emails I suggested (as an indicative figure, your attack may vary) come from up to 20000 different sources -- so very small numbers from each source, thereby avoiding any rate limitation systems.
There is usually just one originating server that automates the filling in of forms on the various websites that send the verification emails -- though there appear to be multiple criminals offering the mail bombing service.
This is a core issue that affects the entire abuse community and the very definition of what is abuse. please also do spend the time to look at my thread about the definition of abuse. You will note that there are hundreds of posts and even a kind of, sort of, general consensus of what abuse actually is. Yes, of course the action of the mail bomber is abuse. But, the further action of the ESP is also abuse! So, it does not matter what criminal, syndicate, person or group initiates any action... It is up to the provider of the service, the ESP, to ensure that what that ESP is doing is not abuse. Otherwise a criminal can do one action / post - and this results in a ten fold amplification Which brings me back to my Google example: If Google, and ESP, sends five verify your email address emails in 10 minutes to a victim that is not known to Google, it will be my contention that this is abusive behavior. You do not agree with that? As you have said that this behavior is not abuse, you have not yet told me why though? Andre