3 ms·

The analogy doesn't hold because anyone can send an email to anyone else on any service at any time. You can't exactly just climb up a telephone pole and tap o

The analogy doesn't hold because anyone can send an email to anyone else on any service at any time. You can't exactly just climb up a telephone pole and tap off a few phone numbers for yourself. You have to explicitly enter into a contract with a service provider to use their infrastructure. Spammers and scammers are wasting infrastructure resources that the telcos could be allocating to users. The telco can just cut your access off if you abuse it. If I spin up an email server, no one entity can stop me sending email to anyone else. Gmail or Outlook or other services can block me individually, but there is no centralized network and no central authority that can refuse my connection. [0] I suspect that telcos don't want to do anything about abuse because it's a very large fraction of their total traffic. The artificially higher utilization of the network gives them more justification for their prices or gives them some sort of good boy points for having x number of users. I don't really know how any of that works, just a wild guess. [0] There are centralized blacklists and other ways to communicate that a sender should be widely blocked, but that's not the same as a telco refusing to physically connect you

TedDoesntTalk 3y ago
> You have to explicitly enter into a contract with a service provider to use their infrastructure Sounds like you’ve never used Twilio before - or any other API-based SMS system
- selcuka 3y ago
  Isn't Twilio your service provider in that case?
- callalex 3y ago
  Have you tried recently? There’s a ton of regulation mandated paperwork and registration required these days.
- axelthegerman 3y ago
  Ehm you need to create an account, accept their TOS, enter billing information and then some. They can easily disable your account should you break the TOS (or for any reason really) Not quite the same as hosting an email server somewhere
kmoser 3y ago
> there is no centralized network and no central authority that can refuse my connection Your ISP/host can refuse service (assuming somebody convinces them to take that step). That doesn't mean you can't find another, but they are your connection to the Internet.
axelthegerman 3y ago
> You have to explicitly enter into a contract with a service provider to use their infrastructure. Exactly. And proper providers make legitimate users jump through so many hoops. E.g. with Twilio I can't even send text messages to US long codes (regular numbers) anymore without assigning "campaigns" and giving sample text messages... All I wanted is that my users can pick a phone number and use SMS as an interface to send commands and queries. They (US government and Twilio) don't even let me do that in order to "fight spam". > I suspect that telcos don't want to do anything about abuse because it's a very large fraction of their total traffic. Same here. They keep adding process and restrictions on legitimate users to prove that they're working on it, but I don't think they really want to. Sure, there are probably fishy international service providers that house legitimate AND spam traffic and are hard to block. But phone networks are much more centralized than email and should have better abilities to fight spam if they really wanted to (but instead keep profiting from it)
drdaeman 3y ago
> The analogy doesn't hold because anyone can send an email to anyone else on any service at any time. Sorry, but I disagree. You can't just open a utility cabinet and establish TCP connections with random mail servers either. You have to explicitly enter a contract with a service provider to connect to Internet too. And every mail system out there uses a bunch of precautions, like SPF, DMARC and of course it refers to some DNSBLs. I just cannot imagine any operational Internet-facing general-purpose SMTP system that doesn't. Most ISPs out there outright filter out any tcp/25 traffic for their customers, residental or hosted. Typically (in case of server hosting) or less typically (in case of residental network access) this block can be lifted by going through some sort of pinky-swear "won't spam" KYC, but if you abuse it, you'll get booted off the platform real fast. And if it's too weak, the provider will very soon find themselves and their customers unable to send anything. Because if a LIR doesn't respond to spam reports from their system, RDNSBL bans will very rapidly grow from just a single IP to progressively larger and larger subnet and then the whole AS. And getting out of a DNSBL isn't exactly fun. So network operators really hate email spam - it brings them nothing but headaches. And that's why virtually all spam today comes from infected or hacked machines, and not some malicious people running a spam server. I don't know where telephony spam comes from - as I've said I don't have much experience with this side of telecom, but I wouldn't be surprised if a vast majority of it would be from hacked/unsecured VoIP systems. I believe unscrupulous phone companies may be able to pull something, selling access to spammers, but that's probably once-or-twice-in-lifetime thing, because they won't be able to BS that they were hacked or something after a few incidents. (I highly doubt phone companies don't have a culture of blocking abusive peers. Internet operators surely do.)
- calamari4065 3y ago
  I have a VPS I pay $15 a year for, and it hosts my own email server. I've got all the security bells and whistles. Sure, my provider could ban me if they cared enough, but it's pretty much trivial to set up a new one. And as you said, some of the email spammers use botnets. Which is yet another order of magnitude removed from the hassle of getting a telco to hook you up on the sort of scale we're talking about. And sure, we have all sorts of institutional protections and blacklists to prevent spam, and yet we all still get flooded with spam. The only effective way out so far has been server-side spam filtering, which cannot be implemented in the phone network as long as caller ID spoofing is still allowed. Call and text spam come through the same channels as any legitimate business. These people have the same kinds of commercial contracts as any business, and as far as the telco is concerned, their traffic is completely normal and legitimate. That's the problem we're discussing: the telcos are not enforcing the anti-spam laws. They seem perfectly content to let these bad actors operate on their network. There is no subterfuge, no hacking, no foul play of any kind to get their traffic onto the network. The telcos simply let it happen. The telcos also explicitly allow anyone to spoof caller ID so that the receiving customer can never know the true number they're being called from. The customer can never block the spammer because they just generate a new number each time. Email spam and phone spam are not the same problem at all. Not even close. Email spam is simply people abusing the technology in spite of everyone's best-effort attempts to stop it. Phone spam is institutionalized. The telcos have made a deliberate decision to allow this, and not offer any way for customers to protect themselves. Again, despite laws existing which should force them to stop the abusive traffic.

TedDoesntTalk 3y ago

> You have to explicitly enter into a contract with a service provider to use their infrastructure Sounds like you’ve never used Twilio before - or any other API-based SMS system

selcuka 3y ago
Isn't Twilio your service provider in that case?
callalex 3y ago
Have you tried recently? There’s a ton of regulation mandated paperwork and registration required these days.
axelthegerman 3y ago
Ehm you need to create an account, accept their TOS, enter billing information and then some. They can easily disable your account should you break the TOS (or for any reason really) Not quite the same as hosting an email server somewhere

kmoser 3y ago

> there is no centralized network and no central authority that can refuse my connection Your ISP/host can refuse service (assuming somebody convinces them to take that step). That doesn't mean you can't find another, but they are your connection to the Internet.

axelthegerman 3y ago

> You have to explicitly enter into a contract with a service provider to use their infrastructure. Exactly. And proper providers make legitimate users jump through so many hoops. E.g. with Twilio I can't even send text messages to US long codes (regular numbers) anymore without assigning "campaigns" and giving sample text messages... All I wanted is that my users can pick a phone number and use SMS as an interface to send commands and queries. They (US government and Twilio) don't even let me do that in order to "fight spam". > I suspect that telcos don't want to do anything about abuse because it's a very large fraction of their total traffic. Same here. They keep adding process and restrictions on legitimate users to prove that they're working on it, but I don't think they really want to. Sure, there are probably fishy international service providers that house legitimate AND spam traffic and are hard to block. But phone networks are much more centralized than email and should have better abilities to fight spam if they really wanted to (but instead keep profiting from it)

drdaeman 3y ago

> The analogy doesn't hold because anyone can send an email to anyone else on any service at any time. Sorry, but I disagree. You can't just open a utility cabinet and establish TCP connections with random mail servers either. You have to explicitly enter a contract with a service provider to connect to Internet too. And every mail system out there uses a bunch of precautions, like SPF, DMARC and of course it refers to some DNSBLs. I just cannot imagine any operational Internet-facing general-purpose SMTP system that doesn't. Most ISPs out there outright filter out any tcp/25 traffic for their customers, residental or hosted. Typically (in case of server hosting) or less typically (in case of residental network access) this block can be lifted by going through some sort of pinky-swear "won't spam" KYC, but if you abuse it, you'll get booted off the platform real fast. And if it's too weak, the provider will very soon find themselves and their customers unable to send anything. Because if a LIR doesn't respond to spam reports from their system, RDNSBL bans will very rapidly grow from just a single IP to progressively larger and larger subnet and then the whole AS. And getting out of a DNSBL isn't exactly fun. So network operators really hate email spam - it brings them nothing but headaches. And that's why virtually all spam today comes from infected or hacked machines, and not some malicious people running a spam server. I don't know where telephony spam comes from - as I've said I don't have much experience with this side of telecom, but I wouldn't be surprised if a vast majority of it would be from hacked/unsecured VoIP systems. I believe unscrupulous phone companies may be able to pull something, selling access to spammers, but that's probably once-or-twice-in-lifetime thing, because they won't be able to BS that they were hacked or something after a few incidents. (I highly doubt phone companies don't have a culture of blocking abusive peers. Internet operators surely do.)

calamari4065 3y ago
I have a VPS I pay $15 a year for, and it hosts my own email server. I've got all the security bells and whistles. Sure, my provider could ban me if they cared enough, but it's pretty much trivial to set up a new one. And as you said, some of the email spammers use botnets. Which is yet another order of magnitude removed from the hassle of getting a telco to hook you up on the sort of scale we're talking about. And sure, we have all sorts of institutional protections and blacklists to prevent spam, and yet we all still get flooded with spam. The only effective way out so far has been server-side spam filtering, which cannot be implemented in the phone network as long as caller ID spoofing is still allowed. Call and text spam come through the same channels as any legitimate business. These people have the same kinds of commercial contracts as any business, and as far as the telco is concerned, their traffic is completely normal and legitimate. That's the problem we're discussing: the telcos are not enforcing the anti-spam laws. They seem perfectly content to let these bad actors operate on their network. There is no subterfuge, no hacking, no foul play of any kind to get their traffic onto the network. The telcos simply let it happen. The telcos also explicitly allow anyone to spoof caller ID so that the receiving customer can never know the true number they're being called from. The customer can never block the spammer because they just generate a new number each time. Email spam and phone spam are not the same problem at all. Not even close. Email spam is simply people abusing the technology in spite of everyone's best-effort attempts to stop it. Phone spam is institutionalized. The telcos have made a deliberate decision to allow this, and not offer any way for customers to protect themselves. Again, despite laws existing which should force them to stop the abusive traffic.