I disagree with the posted page that the telecoms are interested in stopping spam. If they really cared, they would have addressed it by now. I suspect they are somehow making money from the spam callers.
I'm not so sure about this. No one (except for, obviously, spammers) benefits from email spam, every mailhost and network admin is most certainly interested in stopping it (to some extent), and yet my mailbox can prove that spam is still very much alive.
Solving spam problems in a highly distributed large federation of networks is not simple.
However, I think there are less telecoms than LIRs and mail systems out there, and they typically have better control over who their clients are (less hacking, though I could be wrong), and there's not enough pressure on them (spammy mailhost's gonna get banned by every RDNSBL real quick, telcos - I don't know, but I guess not so much?), so I can certainly agree that telecoms have issues with their incentives. I could be wrong about this, though - I don't really know much about the telephone industry.
They should threaten to drop outgoing calls too. That’d eliminate all the useless offshore call centers.
You can't exactly just climb up a telephone pole and tap off a few phone numbers for yourself. You have to explicitly enter into a contract with a service provider to use their infrastructure.
Spammers and scammers are wasting infrastructure resources that the telcos could be allocating to users. The telco can just cut your access off if you abuse it.
If I spin up an email server, no one entity can stop me sending email to anyone else. Gmail or Outlook or other services can block me individually, but there is no centralized network and no central authority that can refuse my connection. [0]
I suspect that telcos don't want to do anything about abuse because it's a very large fraction of their total traffic. The artificially higher utilization of the network gives them more justification for their prices or gives them some sort of good boy points for having x number of users. I don't really know how any of that works, just a wild guess.
[0] There are centralized blacklists and other ways to communicate that a sender should be widely blocked, but that's not the same as a telco refusing to physically connect you
Sounds like you’ve never used Twilio before - or any other API-based SMS system
They can easily disable your account should you break the TOS (or for any reason really)
Not quite the same as hosting an email server somewhere
Your ISP/host can refuse service (assuming somebody convinces them to take that step). That doesn't mean you can't find another, but they are your connection to the Internet.
Exactly. And proper providers make legitimate users jump through so many hoops. E.g. with Twilio I can't even send text messages to US long codes (regular numbers) anymore without assigning "campaigns" and giving sample text messages... All I wanted is that my users can pick a phone number and use SMS as an interface to send commands and queries. They (US government and Twilio) don't even let me do that in order to "fight spam".
> I suspect that telcos don't want to do anything about abuse because it's a very large fraction of their total traffic.
Same here. They keep adding process and restrictions on legitimate users to prove that they're working on it, but I don't think they really want to.
Sure, there are probably fishy international service providers that house legitimate AND spam traffic and are hard to block. But phone networks are much more centralized than email and should have better abilities to fight spam if they really wanted to (but instead keep profiting from it)
Sorry, but I disagree. You can't just open a utility cabinet and establish TCP connections with random mail servers either. You have to explicitly enter a contract with a service provider to connect to Internet too.
And every mail system out there uses a bunch of precautions, like SPF, DMARC and of course it refers to some DNSBLs. I just cannot imagine any operational Internet-facing general-purpose SMTP system that doesn't.
Most ISPs out there outright filter out any tcp/25 traffic for their customers, residental or hosted. Typically (in case of server hosting) or less typically (in case of residental network access) this block can be lifted by going through some sort of pinky-swear "won't spam" KYC, but if you abuse it, you'll get booted off the platform real fast. And if it's too weak, the provider will very soon find themselves and their customers unable to send anything.
Because if a LIR doesn't respond to spam reports from their system, RDNSBL bans will very rapidly grow from just a single IP to progressively larger and larger subnet and then the whole AS. And getting out of a DNSBL isn't exactly fun. So network operators really hate email spam - it brings them nothing but headaches.
And that's why virtually all spam today comes from infected or hacked machines, and not some malicious people running a spam server.
I don't know where telephony spam comes from - as I've said I don't have much experience with this side of telecom, but I wouldn't be surprised if a vast majority of it would be from hacked/unsecured VoIP systems. I believe unscrupulous phone companies may be able to pull something, selling access to spammers, but that's probably once-or-twice-in-lifetime thing, because they won't be able to BS that they were hacked or something after a few incidents. (I highly doubt phone companies don't have a culture of blocking abusive peers. Internet operators surely do.)
Sure, my provider could ban me if they cared enough, but it's pretty much trivial to set up a new one.
And as you said, some of the email spammers use botnets. Which is yet another order of magnitude removed from the hassle of getting a telco to hook you up on the sort of scale we're talking about.
And sure, we have all sorts of institutional protections and blacklists to prevent spam, and yet we all still get flooded with spam. The only effective way out so far has been server-side spam filtering, which cannot be implemented in the phone network as long as caller ID spoofing is still allowed.
Call and text spam come through the same channels as any legitimate business. These people have the same kinds of commercial contracts as any business, and as far as the telco is concerned, their traffic is completely normal and legitimate.
That's the problem we're discussing: the telcos are not enforcing the anti-spam laws. They seem perfectly content to let these bad actors operate on their network. There is no subterfuge, no hacking, no foul play of any kind to get their traffic onto the network. The telcos simply let it happen.
The telcos also explicitly allow anyone to spoof caller ID so that the receiving customer can never know the true number they're being called from. The customer can never block the spammer because they just generate a new number each time.
Email spam and phone spam are not the same problem at all. Not even close. Email spam is simply people abusing the technology in spite of everyone's best-effort attempts to stop it.
Phone spam is institutionalized. The telcos have made a deliberate decision to allow this, and not offer any way for customers to protect themselves. Again, despite laws existing which should force them to stop the abusive traffic.
I agree and disagree with this statement:
1. The distributed system can't solve the spam problem, because it's not a technical problem.
2. The population can immediately solve the spam problem by responding in the affirmative to every single request they get.
What makes spam profitable is the quality of the responses - right now only the marks respond, so every response is valuable to the spammer as it is a lead that will almost certainly result in money.
If the spammer sends out 3m SMS/robocall messages, and gets 5 responses, those responses are worth actual money!
OTOH, if the spammer sent out 3m SMS/robocall messages, and got 3m responses (of which only 5 are worth money), then the spam would quickly stop.
IOW, by self-selecting into one of two groups (will give you money/won't give you money) we are making spam profitable.
This is the only way to stop spam of any kind - poison the database.
It involves never blocking any SMS/robocall: for SMS always reply in the affirmative (i.e. you want an agent to phone you), for robocalls, keep the call active for as long as you can, and reply in the affirmative for future contact.
You do that, knowing full-well that you aren't going to be buying anything.
If even half the population did that, spam SMS and robocalls would become too expensive to do anymore.
I’ve never really had any issues at all with SMS spam in the UK and Europe - but I’m currently in Thailand where it’s awful! When you buy a new SIM card at the airport, the spamming starts within an hour or so. I count 18 sent yesterday alone, once every hour or so during the day.
I believe it is actually the carrier (true.th) sending them as they all follow a similar format and seem to arrive with a somewhat predictable regularity.
They even have an automated number (*137) you can call and supposedly turn off spam, but it doesn’t work: “System will cancel spam SMS within 24 hour. Thank you for using!”. Yeah right.
Only solution on iOS seems to be to disable notifications for SMS from unknown senders in System Settings. Then, at least, they only annoy you when you actually look at the messages app.
- How do you feel about the telcoms reading/filtering your texts?
- Where do you feel these controls would be most appropriately applied? Sender or recipient or both?
- How would you define SMS spam for filtering? Should the messages be manually reviewed or automatically filtered based on volume/content?
- Should recipient telcoms filter potentially malicious or spammy voice calls?
Eg: https://www.reddit.com/r/tmobile/comments/17aqv1z/tmobile_li...
Some of the companies are quite spammy. It’s frustrating as blocking the number risks blocking real ‘you have an appointment at xxx’ type messages.
They care, but in the way most people care about not being fat. They still can’t make the necessary lifestyle changes to do anything about it even if it is their most ardent wish.
Because it's a political problem, not an engineering or business problem.
In order to prevent monopolies, we have very strict requirements about carrying all calls that enter the network. Otherwise, phone companies would randomly block each other as part of anti-competitive tactics to push each other out of business.
The telephone spammers take advantage of these laws, because it is very difficult to legally block a spam call. Your phone provider must carry all phone calls without any prejudice!
(So I'm about to get very close to the line about hacker news's "no politics" guideline. Please consider that spammers "hack the law" and "hack politics" before you flag me. Instead, I would appreciate it if you take a minute or two to fact check my opinion disguised as fact.)
The primary way out of this is by a legal change, not by an engineering change or culture change: We must update our laws so that it is very difficult to make and carry spam calls on the telephone network.
I personally believe that one way to do this is to require that all phone calls provide rich metadata to the phone that is ringing. I really should know who is calling me, and the phone company that originates that call should be responsible for verifying it. I would even consider a requirement that makes it trivial, or automatic, to "lift the corporate veil" on who owns the company that is calling me. Otherwise there should be strict penalties for a phone network that allows originating calls with phony or spoofed metadata.
(I also don't think anyone has a right to make a 100% anonymous phone call. I think we can figure out how to allow people who need to make anonymous phone calls to make them, without exposing the entire phone network to SPAM.)
Ultimately, every phone call that enters the phone network needs to have a strict and auditable chain of liability.
In reality, if our laws included a requirement for strict metadata, and then a requirement to make an "abusive phone call" button really obvious, we could figure this out pretty quickly: at this point it becomes a simple reputation system.
Finally, we need laws that prohibit co-opting the phone network for marketing. We may want to start with prohibiting unsolicited commercial and political calls. We need to make sure that there are no loopholes, where the company you bought something from 2 years ago is still free to call you as if you have an ongoing relationship. We need to recognize that pulling out one's phone and looking at who is calling is really a significant burden to us, and that our government should protect us from companies and politicians who think that they have the right to interrupt our day at any moment to listen to a sales pitch.
If you really care and want to put time into this, advocate politically. (And remember that hacker news is not supposed to be political.) Don't waste your time reading instructions about how to report spam.
Notably they can't use autodialers without having prior consent from you.
Where political comments are problematic is generally where they run up against other guidelines, notably:
Eschew flamebait. Avoid generic tangents. Omit internet tropes.
The other red line is accounts that principally push political viewpoints.
A fair bit of political discussion tends toward each of these. Avoid those rails, however, and you're good.
Dang's posted often on what does and doesn't work with political discussion, see: <https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...>
I'd specifically point at: <https://news.ycombinator.com/item?id=34481375>
Where a problem, such as robocalls / spam phone calls, really is fundamentally one of politics and policy, discussing those political and policy elements is entirely appropriate.
They care, but not enough to spend what is required to address it.
Is it conceivable that they don't have control of who is using their network, and how they're using it?
It's not like they've just landed on the planet with this big telecoms network to manage. They created them, they set the rules, they own the gates.
It's purely profit driven, no question.
In the exact same way that Google and Meta claim to not be able to police advertising on their own fucking networks.
Features are being added, which enable phone number spoofing and other shenanigans, at some point deep in the network, such that common carriers, at the tips of the network, have no control over.
Thus creating a scammers/spammers paradise.