2 ms·

> The analogy doesn't hold because anyone can send an email to anyone else on any service at any time. Sorry, but I disagree. You can't just open a utility cab

> The analogy doesn't hold because anyone can send an email to anyone else on any service at any time. Sorry, but I disagree. You can't just open a utility cabinet and establish TCP connections with random mail servers either. You have to explicitly enter a contract with a service provider to connect to Internet too. And every mail system out there uses a bunch of precautions, like SPF, DMARC and of course it refers to some DNSBLs. I just cannot imagine any operational Internet-facing general-purpose SMTP system that doesn't. Most ISPs out there outright filter out any tcp/25 traffic for their customers, residental or hosted. Typically (in case of server hosting) or less typically (in case of residental network access) this block can be lifted by going through some sort of pinky-swear "won't spam" KYC, but if you abuse it, you'll get booted off the platform real fast. And if it's too weak, the provider will very soon find themselves and their customers unable to send anything. Because if a LIR doesn't respond to spam reports from their system, RDNSBL bans will very rapidly grow from just a single IP to progressively larger and larger subnet and then the whole AS. And getting out of a DNSBL isn't exactly fun. So network operators really hate email spam - it brings them nothing but headaches. And that's why virtually all spam today comes from infected or hacked machines, and not some malicious people running a spam server. I don't know where telephony spam comes from - as I've said I don't have much experience with this side of telecom, but I wouldn't be surprised if a vast majority of it would be from hacked/unsecured VoIP systems. I believe unscrupulous phone companies may be able to pull something, selling access to spammers, but that's probably once-or-twice-in-lifetime thing, because they won't be able to BS that they were hacked or something after a few incidents. (I highly doubt phone companies don't have a culture of blocking abusive peers. Internet operators surely do.)

calamari4065 3y ago
I have a VPS I pay $15 a year for, and it hosts my own email server. I've got all the security bells and whistles. Sure, my provider could ban me if they cared enough, but it's pretty much trivial to set up a new one. And as you said, some of the email spammers use botnets. Which is yet another order of magnitude removed from the hassle of getting a telco to hook you up on the sort of scale we're talking about. And sure, we have all sorts of institutional protections and blacklists to prevent spam, and yet we all still get flooded with spam. The only effective way out so far has been server-side spam filtering, which cannot be implemented in the phone network as long as caller ID spoofing is still allowed. Call and text spam come through the same channels as any legitimate business. These people have the same kinds of commercial contracts as any business, and as far as the telco is concerned, their traffic is completely normal and legitimate. That's the problem we're discussing: the telcos are not enforcing the anti-spam laws. They seem perfectly content to let these bad actors operate on their network. There is no subterfuge, no hacking, no foul play of any kind to get their traffic onto the network. The telcos simply let it happen. The telcos also explicitly allow anyone to spoof caller ID so that the receiving customer can never know the true number they're being called from. The customer can never block the spammer because they just generate a new number each time. Email spam and phone spam are not the same problem at all. Not even close. Email spam is simply people abusing the technology in spite of everyone's best-effort attempts to stop it. Phone spam is institutionalized. The telcos have made a deliberate decision to allow this, and not offer any way for customers to protect themselves. Again, despite laws existing which should force them to stop the abusive traffic.

calamari4065 3y ago

I have a VPS I pay $15 a year for, and it hosts my own email server. I've got all the security bells and whistles. Sure, my provider could ban me if they cared enough, but it's pretty much trivial to set up a new one. And as you said, some of the email spammers use botnets. Which is yet another order of magnitude removed from the hassle of getting a telco to hook you up on the sort of scale we're talking about. And sure, we have all sorts of institutional protections and blacklists to prevent spam, and yet we all still get flooded with spam. The only effective way out so far has been server-side spam filtering, which cannot be implemented in the phone network as long as caller ID spoofing is still allowed. Call and text spam come through the same channels as any legitimate business. These people have the same kinds of commercial contracts as any business, and as far as the telco is concerned, their traffic is completely normal and legitimate. That's the problem we're discussing: the telcos are not enforcing the anti-spam laws. They seem perfectly content to let these bad actors operate on their network. There is no subterfuge, no hacking, no foul play of any kind to get their traffic onto the network. The telcos simply let it happen. The telcos also explicitly allow anyone to spoof caller ID so that the receiving customer can never know the true number they're being called from. The customer can never block the spammer because they just generate a new number each time. Email spam and phone spam are not the same problem at all. Not even close. Email spam is simply people abusing the technology in spite of everyone's best-effort attempts to stop it. Phone spam is institutionalized. The telcos have made a deliberate decision to allow this, and not offer any way for customers to protect themselves. Again, despite laws existing which should force them to stop the abusive traffic.