Hacker News Reader

Comment by fouronnes3 | Hacker News Reader

I'm curious how spam protection works if you're an alternative, few users, chat app? I hate Meta's monopoly as much as the next guy but one thing you do have to credit them for is the second to none spam protection. I also wonder how much requiring a cell number is part of that strategy.

View on HN

It's just email and gpg so you'll get the same spam you do normally.

IMO people freak out about spam way too much. I'd rather have something that works with occasional spam than have to put up with the insanity of modern IM. Having push notifications from 10 proprietary IM apps is worse spam than a couple of emails a day from some retard trying to get me to download a "pdf." I don't block spam at all in my personal email (although I have a couple of tools automatically label it.) I'd rather have everything delivered.

i run my own email server, using a spam filter i set up years ago without explicit blocking (only tagging and filtering) and didn't touch it since. the amount of spam i get is negligible. a few false positives, but nothing serious. in fact it's so little i could probably just leave all the spam in the inbox. it is tagged as spam anyways.

I have my own email server with a wildcard address (I still use gmail for anything that's actually important). I put certain addresses in shady forms a few times. I get a couple of spam messages per day to those addresses - always the same spam few spam campaigns. One is offering to sell me electric bicycles or partner with me to sell electric bicycles (didn't really pay attention) and more recently I started getting business proposal advance fee spam. The volume is pretty manageable and if I wanted, a pretty simple filter tuned for the spam I actually get would catch all of it and no ham.

I got spam to postmaster once for some reason. That's a nice way to make admins aware of your spam campaign.

Spam is presumably more of a problem when you're more well-known and you don't have the option to control your own filters.

I've just been the target of some spam "campaign" on my own email server. By the time I was annoyed enough to block some IPs and add a custom spamassassin rule for them, they had already stopped. It lasted two days.

Other than that it looks like I get like 4 spams per week.

Mind, i don't publish my email anywhere. If you look at my profile on here you'll get a gmail address.

An alternative few users chat app probably won't be a major target for spam untill it has lots of users.

So I would say it's a low priority feature in the backlog.

If your need is security then really that should be based on in person trust.

Or at least via a proxy.

So contact invitation can just be handled with use-once codes (or at least trivially burnable ones).

deltachat distinguishes between normal email and deltachat messages. you can limit to the latter if you only use it to communicate with other deltachat users.

You can design your way around it

1. Manually screen who can send you messages like Hey[^1] and Apple[^2]

2. Basic filtering to ensure the promotional stuff gets blocked or put in a separate list [^3]

3. Rate-limit senders who are showing robot like behaviour

---

[^1]: https://www.hey.com/features/spam-corps/

[^2]: https://support.apple.com/en-il/guide/iphone/iph203ab0be4/io...

[^3]: https://f-droid.org/en/packages/spam.blocker/

I wouldn’t necessarily agree that WhatsApp‘s spam protection is that great. I’ve been invited to quite a lot of pyramid scheme/scam WhatsApp groups, however that’s mostly happened after having to expose my private cell number on the internet (thanks to app stores and GDPR requiring some kind of phone number for businesses of any size).

... always wondered if the cell phone requirements are not (also) tied to then wanting an actual, physical, person behind each account - as in most EU jurisdictions each SIM card is tied to an actual ID.-

In many EU countries, you can buy sim cards from some vending machine, in a grocery store or places where you can buy international telephone cards. No ID required. But phone plans are often tied to your home internet.

are you sure no ID is required to activate the cards? at least in austria and i believe in germany you can't get a sim card without an ID.

If you get a lyca sim card, even there you don't need ID to use it. There might be some restrictions after a month though.

afaik no businesses are required by the gdpr to collect phone numbers, and would like to see evidence otherwise

There are no occurrences of "cell" or "phone" in GDPR, and the only relevant occurrences of "number" are about "national identification numbers", which phone numbers are not.

Sorry, I should have been more specific. In Europe (or Germany at least) it’s required by law that you provide an imprint with contact information for every site you host, as well as a privacy policy that includes contact information of your GDPR officer if you collect any kind of personalized data. Since I’m a one-person company, that includes my personal phone number since I don’t have a business phone. Also chrome webstore for example requires a phone number if you host an extension on there.

Edit: Also this wasn’t about collecting phone numbers, but about providing one for your business if you host a publically accessible site

Reply on news.ycombinator.com