dredmorbius

If you're acting fraudulently and at scale, there will likely be consequences.

If this happens occasionally, it's a feature of the system, and your reports effectively become a super-opt-out.

And if perhaps the problem does become sufficiently widespread, I'd be interested in seeing how you'd address it given one constraint: operating within the bonding/surety system I've suggested. And that the State of California and others have already enacted in some form.

What activities are you engaged in which make you think you'd likely be considered a spammer? What specific harms do you see occurring? Might these be related to your present line of business / profession / employment?

Where there's legitimate business, and the risks are low (including the overwhelming majority of personal / residential lines, as well as most business / institutional lines), there's absolutely no problem.

The key is getting incentives right. Indexing bonding and payouts to the spam level, and having a target, is one way to approach this.

The problem with cheap comms, or cheap anything, is that it makes low-return, high-volume activities viable, including especially those which externalise costs and internalise benefits. Such as, say, fraud or spam generally.

What my proposal does is internalise those costs to spammer and telcos which facilitate them, by raising effort (most bulk calls are blocked) and shifting the financial incentives. From participating in the fight against spam for the past 30 years I've a pretty good notion that this will work. And unlike email, the phone system already has a costing and payment system built in.

With single spam operations generating hundreds of millions to billions of calls monthly and barely achieving profitability, I'm pretty sure we can knock things back a lot without inconveniencing legitimate players.

Yes, a real English word.

Machines that humidify air are called ... humidifiers.

(There are also dehumidifiers.)

This is one of the few publicly-available reports I've found breaking out trends by country. As of 2025, the US didn't have the worst record in the world (Brazil won that round). Patterns vary considerably worldwide.

There's not much publicly-available research on the topic. One better source I've found is "Robocalls: A Worldwide or US-only Problem? Analyzing Spam and Fraud in International Phone Calls" (30 Jun 2026)

<https://arxiv.org/html/2606.31790>

On the magnitude in the US vs. elsewhere:

Even though robocalls are an international problem, our findings indicate that US citizens are substantially more affected than the rest of the world. The median number of phone numbers in our US honeypot was 11 751, compared to 101 913 international phone numbers. Despite an almost tenfold difference in the number of available phone lines, the US honeypot numbers received 8 314 813 calls (95.1%) compared to 432 538 calls (4.9%) received by the international numbers. On average, a single phone number in our US honeypot received 707.5 calls during a nine-month period, about 2.62 calls per day. Non-US numbers received, on average 4.24 calls during the same period, about 0.016 calls per day.

The paper does not break out calls per person by country, though it discusses general patterns.

Hiya has an accessible report which highlights "seven key countries", with calls per month in parenthesis: The US (22), UK (5), Canada (6), Spain (13), France (18), Germany (3), and Brazil (29, highest in the world).

Americas: Brazil (29), Mexico (26), Chile (23), and the US (22) lead.

In Asia: HK (23), Indonesia (16), the Philippines (12), and India (8) lead.

<https://work.hiya.com/hubfs/2025/Global%20Call%20Threat%20Re...>

<https://www.t-mobile.com/benefits/scam-shield>

The free tier seems to identify but not block likely scam calls. T-Mobile's website skews sales-heavy, and doesn't feature much technical information.

The premium features appear to be app-dependent, and may not work on feature phones.

Commerce and crime go hand-in-hand.

The Greek and Roman gods of travel and communication were also the gods of tricksters (frauds) and thieves. The etymology of "Mercury" may be related to that of "merchant". (Hermes rather less so.)

<https://en.wikipedia.org/wiki/Mercury_(mythology)>

And why would you impose a highly-intrusive personal-tracking system across billions of subscribers?

<https://news.ycombinator.com/item?id=49130932>

There's a related issue apparently of small operators who can't afford (or haven't been bothered) to implement STIR/SHAKEN. Many of these are apparently small rural phone co-ops (its own interesting bit of telecoms history). There should be both support in providing them with such capabilities, and penalties for failing to do so, including liability for transiting spam calls to their own or other carriers' subscribers.

If I were to steelman the concern, I'd look at a few related scenarios, say, where a subscriber is running a poorly-secured VOIP system and spammers hijack that to make calls. I'll ... get to that.

First: the scenario here is phone systems, not email, so the traffic would be voice calls, possibly texts. That said, I'll consider your question as if it was calls and not newsletters.

I've given a more detailed breakdown of how I see a bonding system working here, you might want to read it before continuing with this comment: <https://news.ycombinator.com/item?id=49129679>.

Second: It's not subscribers who are on the hook for spam calls, but carriers. So Google isn't paying you, your carrier is paying you (via a Surety agent), with the option of recouping that penalty from an upstream carrier, if any. If you and Google are on the same carrier, and the call didn't transit any other networks, it's just you and your own telephony service provider (carrier).

A carrier might have its own TOU/TOS with its subscribers, and subscribers originating calls could and likely would attempt to recover abuse costs if they were incurred. That subscriber (say, Google) might also have its own TOU/TOS addressing the case of mis-reporting of authorised contacts. Those actions would be outside the bonding system itself. A party repeatedly abusing the system could be liable for other actions, including fraud or malicious damages.

Note that one of the interesting elements of bonding is that call origination becomes a risky activity for telcos. Presently, telcos are eager to enter such business, put few restrictions or obligations on their customers, and to prefer outbound traffic to inbound traffic. Under a bonding programme, this changes dramatically. Large-volume outbound traffic is a liability, where it does occur, it needs to be closely monitored and managed. Our poorly-secured VOIP system mentioned earlier would probably be subject to configuration/operation validation, pen testing, close monitoring for activity, and alerts/throttling if unexpected usage patterns emerge. All of this is now in the carrier's interest.

Third: The bonding scheme would be periodically settled among carriers. I've hand-waved how often this would occur, though somewhere between daily and monthly, with a shorter term more likely (malicious actors often shoot-and-scoot, we want to avoid that). So low-level skirmish actions such as you describe would tend to result in a net wash between carriers: claims on one would be balanced by claims on others.

Fourth: Just how Google came to communicate, what it's communicating, and the degree to which it's coercing, say, receipt of sales/marketing messages vs. strictly advisory messages tied to a service ... would probably have to be considered in a larger context, but would still be outside the bonding system itself.

Fifth: There's a model for how surety bonds and claims work in the State of California's syste. For a breakdown of that see: <https://www.jwsuretybonds.com/states/california/telemarketin...>.

A few other points:

- New relationships might be permitted through a contact request. This itself could be mediated by a known third party. Private individuals for personal contacts, commercial or governmental trusted parties in other cases. Effectively it's the social-introduction problem from before the age of mass communications brought forward. Such systems will have some friction (necessary to defeat spammers), but not so much friction that the system as a whole doesn't work.

- Bonding does not require strong KYC for small accounts. That is, the person wanting to buy a mobile phone and service anonymously could, but their device and service would be monitored for abuse. I expect a tiered system to emerge, with individuals, small, mid-sized, and large accounts, with increased controls and obligations proceeding with scale and/or capability.

- Generally, it's not individual accounts which are responsible for large volumes of outbound calls, absent an issue such as a proxy hijacking. Large outbound volumes will tend to be associated with known call- or data-centres, and can be managed as such.

- The goal is preservation of a general-availability, universally-accessible phone system. That works only if it is not systematically abused, which is presently the case. If trust in public-switched telephone networks, permitting direct-dial access to any other number, anywhere in the world, is lost, what we'll see is desertion to other options which serve specific individuals' and organisations' interest. We are already beginning to see this, though no one clear winner has emerged. Unfortunately, most of the alternatives are proprietary, though some federated networks might prove to be viable alternatives.

Your follow-up, here (<https://news.ycombinator.com/item?id=48938169>), was particularly insightful, and has influenced my thinking. Essentially: authentication / validation should happen out of band with phone number itself, for the reasons you've given.

I do suspect that for routing authentication, header-level signifiers should be reasonably useful, but for strong identity or authority attestation, they're not. That's ... a deeper problem, but also one which can be solved independently.

Oh, and I'd love to see that Dallas Morning News AT&T CEO interview story, if you could find it.

Would this be it?

"Watchdog Memo to AT&T's CEO: Didn't mean to get you in trouble", by Dave Lieber (July 8, 2016) <https://www.dallasnews.com/news/watchdog/2016/07/08/watchdog...>

Some carriers offer blocking all unknown calls from specified area codes. On Verizon that is "Neighborhood Filter", part of their "Call Filter" toolkit:

<https://www.verizon.com/support/knowledge-base-238154/>

<https://www.pcmag.com/news/verizons-neighborhood-filter-bloc...>

The way it's meant to be used is that the subscriber would block their own area code, and perhaps co-located overlays or neighbouring area codes. The limit for now is ten area codes.

Known or explicitly approved numbers are passed through.

The additional hack is that it's possible to request a number in any arbitrary area code, and spam and robocall rates vary tremendously across area codes. They're generally worst across the Deep South / Southeast (TX, OK, AR, AL, MS, TN, GA, SC, NC), and lowest in Alaska, Utah, Massachussetts, Washington, and North Dakota.

See:

"The Robocall Epidemic: Which states are hit hardest by spam calls?" (10 March 2026) <https://www.whistleout.com/CellPhones/Guides/robocall-epidem...>

"The Robocall Geography Tax: Why Your ZIP Code Determines Your Spam Reality" (23 October 2025) <https://www.karmacall.com/blog/southeast-spam-call-geography...>

I'd submitted the latter a few days ago: <https://news.ycombinator.com/item?id=49082473>.

Pick a low-spam, low-population state, request a number from one of its area codes (if not its one area code ;-), and then block all but known numbers from that area code.

Other organisations, institutions, and businesses too. HN discussion tends to focus on the consumer side of this, it's what most commenters have most familiarity with themselves, but you'd better believe that pretty much the entire phone customer base is fed up to there on this. Which puts the entire network at risk of defection, a risk that telcos have been talking publicly about for over a decade now:

[S]ince mid-2015, a consortium of engineers from phone carriers and others in the telecom industry have worked on a way to [stop call-spoofing], worried that spam phone calls could eventually endanger the whole system. “We’re getting to the point where nobody trusts the phone network,” says Jim McEachern, principal technologist at the Alliance for Telecommunications Industry Solutions (ATIS.) “When they stop trusting the phone network, they stop using it.”

<https://nymag.com/intelligencer/2018/05/how-to-stop-spam-rob...>

I've mentioned this on HN a few times: <https://news.ycombinator.com/item?id=21494300> <https://news.ycombinator.com/item?id=21542926> <https://news.ycombinator.com/item?id=28756827> <https://news.ycombinator.com/item?id=29003329> <https://news.ycombinator.com/item?id=31939562>.

Broadband Breakfast just addressed the issue as well in this Fediverse toot, calling out not just schools (subject of the legislation) but other affected entities: <https://mastodon.social/@BroadbandBreakfast/1169990755811584...>.

Which telcos?

Scenario:

- Spamford places an unsolicited call to subscriber Alice initiating from MalTelCo, transiting carrier hops BunnTel1 and BunnTel2, to Alice's telco carrier, EndTelCo.

- Carriers MalTelCo, BunnTel1, BunnTel2,[1] and EndTelCo have all placed surety bonds, held by BondCo, to practice telephony operations within the jurisdiction (regional/national). The carriers are the Principals, BondCo is the Surety, and receiving subscribers (or telcos, see below) are the Obligees.[2]

- Unbonded carriers may have their traffic refused by peers. Peering to an unbonded carrier places the bond obligation on the receiving carrier.

- Alice flags the call as spam. A per-call surety of $100 is paid to Alice, and charged to EndTelCo against its BondCo contract. As an additional option the call may be flagged as fraud through the phone system, in which case it is automatically referred to LEO by EndTelCo. Obligation of surety is independent of any fraud finding and is based SOLELY on the unsolicited nature of the call.

- EndTelCo has the option of 1) eating the charge or 2) filing a claim against its peer, BunnTel2, the 2nd hop in the chain, which EndTelCo does.

- BunnTel1 similarly files a claim on BunnTel2.

- BunnTel2 files a claim on MalTelCo.

- MalTelCo now eats the claim (it's paid out by BondCo). MalTelCo may seek further compensation from Spamford, but that's Out Of Scope of the bonding / surety schema, and would be covered by MalTelCo's own terms of use.

- BondCo assesses risks and adjusts its surety rates correspondingly based on observed behaviours (and financial risks) of EndTelCo, BunnTel1, BunnTel2, and MalTelCo. If risks are excessive and no surety can be issued, MalTelCo is unbonded, and hence, decertified. Peers may now refuse traffic without penalty.

Note that no one carrier needs to know anything more about a call's routing than its own network boundary. If EndTelCo has no idea that BunnTel2 and MalTelCo were involved, it doesn't matter, because BunnTel1 is on the hook for passing on the call. Spoofing or falsifying records doesn't save you.

There are some questions over how this might be implemented, though generally:

- If Spamford and Alice are both subscribers to EndTelCo, then EndTelCo eats the surety, which is paid to Alice. There's no upstream. Moral: Telcos, don't spam your own customers.

- One thought is that the surety is split among telcos and the subscriber. Rather than just facing a potential cost, transiting and reciving-end-point carriers could see revenue by tracking and prosecuting unsolicited calls. This could include calls received by monitoring numbers set up strictly to assess unsolicited call activity directed to the network. This would mean that calls transiting multiple carriers would be subject to compounded surety claims ... and ... I think I'm OK with that.

- There would all but certainly be classes of calls which would be exempted from claims. Those should be very limited, preferably to government and specifically qualified emergency services only. No political exemptions, no non-profit / NGO exemptions.

- How often claims are settled and risks re-assessed is open for discussion. Daily might be too often, weekly or monthly seems most likely. Longer than that gives too much free-run for malevolent actors to operate.

________________________________

Notes:

1. "BunnTel", because bunnies hop.

2. For an overview of surety bonds, see <https://www.suretybondsdirect.com/educate/what-is-surety-bon...>.

The delivery penalty applies to any unsolicited email, as determined by the recipient.

If also tagged as scam, those are further forwarded to law enforcement (state, national) for investigation.

Many US states are one-party regarding recording. Even in two-party states (CA, OR, WA, MT, IL, PA, MA, CT, NH, MD, DE, FL), disclosed recording and continuing a call will generally be construed as consent. If that's not the case, proposed state or national legislation could carve out exceptions as needed, and there'll likely need to be some legislation required anyway, so that's part of the process.

But shifting the fee element from fraud (one class of unsolicited call/text abuse) to undesired contact makes sorting when the fee applies far more evident, and eliminates a class of other objections (e.g., due process) from consideration.

If you look at real-world numbers, you're generally going to see 3x the thermal output as electrical output from any thermal energy plant. Two-thirds of that thermal output is wasted, and you'd see your 2x figure there. But the useful electrical output eventually ends up as heat as well, whether in direct thermal applications, from mechanical applications, lighting, refrigeration, audio equipment, or electronics.

The (admittedly theoretical) numbers in this example show that:

<https://energyeducation.ca/encyclopedia/Megawatts_thermal>

Incidentally: this all-but-inevitably leads to an online hand-wringing about the inefficiency of energy systems when an energy flow chart (Sankey diagram) is released, showing a 2:1 "rejected energy" ratio. It turns out that that's not a measured quantity but a modeled quantity, if you read the fine print. The 2/3 loss is just physics, thermdynamics and Carnot as noted previously.

See for example the LLNL (Lawrence Livermore National Labs) energy flow chart diagrams, here for 2023: <https://flowcharts.llnl.gov/sites/flowcharts/files/2024-12/e...>

Some of those qualifications are more legible in the fine print of the PDF: <https://flowcharts.llnl.gov/sites/flowcharts/files/2024-10/e...> (PDF).

Broadband Breakfast does seem to be one of those entities. ATIS (<https://atis.org/>) is another, though as a telco alliance I consider it highly suss.

(Submitter.)

California has introduced bonding to telemarketing firms specifically. I feel that should apply at the carrier level, where networks carry a guaranteed bond, pay regular premiums on it, and are dinged for unwanted calls, with the proceeds being split among the called party and any third-party network(s) traversed by the calls. Downstream networks could seek compensation from ANY upstream network carrying the traffic regardless of whether or not they originated it.

This would both create a penalty for providing, or transiting, unsolicited calls, AND create an incentive for carriers / network providers themselves to pursue unsolicited traffic from their peers.

<https://oag.ca.gov/consumers/general/telreg>

________________________________

Notes:

1. See for example <https://toot.cat/@dredmorbius/111099306069523624>

SHAKEN/STIR identifies whether or not a given number is originating from a specific network, but without knowing whether that's an approved network, rejecting unapproved-origin calls, or tracking how much unapproved traffic a given network is emitting and penalising it for this, the information isn't actionable.

"Measure it harder" doesn't solve problems. The information must direct meaningful action.

For spam mitigations to work, the cost of selling that business must exceed its revenue.

Some, and I won't mention AT&T by name, are very curiously opposed to any regulations touching this.

The other element is that carriers can act at the network level, noting how much abusive traffic arrives from given peers, and taking direct action against those peers. That could involve rejecting traffic outright, subjecting it to stronger challenges, and/or diverting it to investigative / law-enforcement bodies (I'd suggest both national and state entities) for both tracking and enforcement. Power-law relations mean that at any given time, a small number of networks will account for the overwhelming majority of spam, though which networks will likely change over time.

The key problem with this is getting the carriers to act, which ... will probably involve a few carrots and sticks. I'll address those in another comment, except to mention bonding: <https://oag.ca.gov/consumers/general/telreg>.[1]

Individual action will not solve this problem, but there are steps you can take.

Most major US carriers now offer some form of robocall blocking. "Scam Shield" from T-Mobile, "ActiveArmor" from AT&T, "Call Filter" from Verizon.

MVNOs (mobile virtual network operators) may or may not offer scam / robocall blocking themselves (though IMO they should, and should be required to). Some will identify spam calls, but those are still passed through to your handset.

Beyond this, there are on-device apps which can be used, some are carrier-based (e.g., "Call Filter Plus", from Verizon, similar tools exist for Verizon and AT&T), some are third-party. These of necessity share your voice/text activity with third parties, which is its own concern and consideration.

Full Android, iOS, and several full-featured Android alternatives (GrapheneOS, /e/OS, LineageOS, etc.) offer unknown caller rejection. Numbers not in your contact list are directed to voicemail. At present, few spam calls will leave voicemail, though some do, and as AI expands in capabilities, applications, and adoption this will all but certainly increase. I'd strongly encourage use of this.

Feature phones / dumbphones ... have far less capability. Most cannot even reject unknown numbers, which ... seems a ripe target for legislation and/or regulation. Phone frameworks such as AOSP / KaiOS seem to afford little capability for even creating a call-blocking app. This and other dumb devices (e.g., traditional landlines) are a strong argument for carrier/network level mitigations.

The company everyone loves to hate, Comcast/Xfinity, actually has one of the most sophisticated voice/text spam blocking systems, and one I'd like to see mandated to all carriers: <https://www.xfinity.com/support/articles/spam-blocker-overvi...>

It's risk based.

It classifies calls into three categories: high, medium, and low risk.

It adjudicates calls based on risk.

High-risk calls are terminated entirely.

Medium-risk calls are directed to voicemail.

Low-risk calls are subjected to an audio CAPTCHA (enter a two digit value to ring through), otherwise are directed to voicemail.

(It's not clear whether or not a whitelisted number will escape any treatment, perhaps subject to conditions such as originating from the appropriate/approved network for that call.)

I haven't used that system, but in advising people still moving off landlines, or looking at VOIP solutions, it's making Comcast an attractive option.

(I don't know what other VOIP providers, say, Twillo or Asterisk, offer, but suspect at least some have similar if not more-capable systems.)

________________________________

Notes:

1. California requires a $100,000 bond by all telemarketers in the state. The state has a small fraction of the incidence of robocalls of the worst US states. Several others have some bond. My view is that bonding should apply at the carrier level and be surrenderable to both contacted individuals and downstream peering networks, to provide both a strong financial penalty to abusers, and an incentive to downstream networks to pursue abusive calls.

________________________________

Notes:

1. Incidentally, the first and second largest-circulation magazines in the US now: <https://www.magazineline.com/blog/most-popular-magazines-in-...>.

Heat engines do turn heat into mechanical energy (motion).

What they don't do is do this with infinite efficiency.

In practice, Carnot engines (heat engines) tend to operate at efficiencies between about 20 to 50%, with an average close to 30% percent. This means that most thermal electrical generation produces roughly three times as much heat as it does electricity. This applies across thermal mechanisms: diesel generators, gas turbines, coal-fired steam, and nuclear-powered steam plants.

There's some room for increased efficiencies, and multi-pass systems, or systems with incorporated thermal applications (district space heat, industrial heat, food preparation) can achieve higher net efficiencies, though I believe the peak is around 60%, and that is rarely achieved.

The other parts of the generating cycle are far more efficient. Generators typically operate well above 90% efficiency (mechanical energy in to electrical energy out), and distribution typically sees about 6% losses.

But that first thermal step costs a lot. There's no such thing as a free lunch.

<https://en.wikipedia.org/wiki/Carnot_cycle>

The heat of vapourisation for water, converting liquid to steam, is 40.66 kJ/mol, or 2257 J/g. It takes a lot of energy to boil off water.[1]

That compares with the latent heat of liquid water, the energy required to heat one unit of water by one degree, which is 4.2 J/g*K (where K is the delta temperature in Kelvin).

Raising the temperature of input by, say, 10 degrees, would only reduce the cooling factor by less than 2%.

________________________________

Notes:

1. Which is why live steam is so dangerous. Steam condensing will release a huge amount of thermal energy, making steam burns especially harmful.

Largely, drones, ballistic missiles, unguided rockets, and artillery are area denial weapons. It seems that the game is less about occupying and controlling territory than it is about denying that capability to the enemy, and network disruption. The enemy with the longest, and least-redundant, supply lines is at a disadvantage. And "fire and motion" tactics become much more difficult, at least based on traditional ground-based infantry, cavalry (armour), and artillery.

This isn't new. Mines, air superiority (a "no-fly zone" is aerial area denial), and artillery have achieved this in the past. Drones permit persistent precision attacks on individual soldiers, equipment, and positions. At the same time, the payloads are relatively small, so that a small level of protection is often sufficient ... but this also effectively pins resources down to a single location (or set of bolt-holes). If locations are known, heavier-duty munitions (missiles, artillery) can be brought to bear.

Counterdefence (anti-drone, anti-missile, anti-artillery fire) become critical, as is being seen across Ukraine and Russia.

Supply lines, both bulk (road, rail, sea, bridge) and final (increasingly also by drone) also become critical links. Solving how to get troops and materiel to the front lines, and casualties back, is a huge logistical problem, and the side which addresses this most effectively has a major advantage.

Russia, often the world's largest gas and oil exporter, is discovering that its production, storage, and distribution infrastructure are highly vulnerable. Ukraine has already struck deep within Siberian regions knocking out refineries and storage depots. If this continues through the winter, Russia could be facing extreme hardship (and political backlash). My understanding is that many cities have largely centralised heating infrastructure, which if damaged would put large populations at risk.