Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Excessive load on NTP servers

news.ntppool.org

Post reply on HN
Print view View original

21–30 of 157 posts

Re: Excessive load on NTP servers

#21

Post by acqq »

profmonocle wrote: post #15
lima wrote: post #10

Worst part is that they did not bother to use a vendor zone.

Indeed. This is a pretty clear misuse of the NTP pool. > You must absolutely not use the default pool.ntp.org zone names as the default configuration in your application or appliance. - http://www.pool.ntp.org/en/vendors.html#vendor-zone Hopefully they were just unaware of the vendor zone policy.

> Hopefully they were just unaware of the vendor zone policy.

It seems they didn't know, or didn't care, how both the third party iOS library they used and the NTP worked, see my other posts here.

They surely didn't need ntp.org pool at all.

Re: Excessive load on NTP servers

#22

Post by roymurdock »

monatron wrote: post #18
drzaiusapelord wrote: post #14

Earlier quoted context omitted.

Oh, if my app did this I'd get in all sorts of trouble and I imagine never approved by the app store. I suspect Facebook properties just play by a different set of rules, unfortunately for those of us who believe in meritocracy and fairness. edit: snapchat apparantly isn't a facebook property, but it has very deep pockets and as such my comment still stands.

Snapchat is not a Facebook property. Nor do I think Apple has resources allocated to review a library used by any app to facilitate if queries on the ntppool are kosher.

>Snapchat is not [yet] a Facebook property

Re: Excessive load on NTP servers

#24

Post by acqq »

mrweasel wrote: post #19
acqq wrote: post #8

According to the forum, the pattern matched this third-party library: https://github.com/jbenet/ios-ntp Specifically, all the servers(!) from here are contacted: https://github.com/jbenet/ios-ntp/blob/master/ios-ntp-lib/Ne... Note that the library author wrote: "ios-ntp is often (mostly?) used to make sure someone hasn't fiddled with the system clock. The complications involved in using multiple servers and averaging…

I think it's pretty safe to assume that the developers have no idea that things like vendor zones exists. NTP, like DNS or SMTP, is ubiquitous infrastructure, not something the average developer sets aside time to understand.

They didn't have to use ntp.org pool at all. They obviously wanted to check if somebody changed the time on the phone and to still use "the internet time." And for that contacting one Apple's server (time.apple.com) were enough.

It seems that the iOS library author "helpfully" provided the default of contacting 30 servers from the ntp.org pool.

Re: Excessive load on NTP servers

#25

Post by codazoda »

pooper wrote: post #7
AlphaWeaver wrote: post #6

Earlier quoted context omitted.

App Store vetting varies wildly and tends to trend towards more close introspection on smaller apps. Well known apps such as Facebook Messenger and Snapchat for example can get an update reviewed and pushed out faster than a standalone developer.

I think Apple should require app vendors to just submit source code and build instructions and have Apple just build it. It'd be harder to pull off on Google Play Store but I think Apple could make this happen if they wanted to.

As a developer, I'd rather they build it and sign it for me. The key signing stuff always seems difficult.

Re: Excessive load on NTP servers

#26

Post by Twirrim »

Declanomous wrote: post #12

For whatever reason, ntppool.org is blocked at my work. And of course, you don't get the page that states why when the website is served via https. Not that I need to see the page to know it was either blocked for "hacking" or "entertainment", and I'm guessing it's not entertainment. Edit: This probably explains why our clocks have been off by 45 minutes since Monday. I guess it will be entertaining to see how long i…

> I guess it will be entertaining to see how long it takes for IT to figure this one out.

Why not just tell them. What have you got to lose? Hell, blame your charitable spirit on the holiday season if you must.

Re: Excessive load on NTP servers

#27

Post by sschueller »

Why on earth would you do that?

If you want to prevent users from altering their time use your server and do a time compare with your server.

NTP can be easily intercepted and altered so it would make a lot more sense to do this via a encrypted certificate pinned communication path increasing my work load drastically to alter the time.

I snapchat going to pay for the DDOS they created?

Re: Excessive load on NTP servers

#28

Post by acqq »

dan1234 wrote: post #17
acqq wrote: post #9

Earlier quoted context omitted.

> Is that a fraud prevention thing or something? See my other post here, and the problems in the (third party) iOS NTP library "features" and its use. There "createAssociations" in that library without any parameters contacts all the IPs behind the big domain list of the NTP servers! And according to the forum every IP is contacted -- behind one server name there are 3-4 servers in the DNS in this case, I get 31 serv…

Just to be clear, this is a 3rd party library not part of iOS itself.

Yes, thank you, the third party library that Snapchat used without even thinking what it does by using some (wrong!) defaults. I thought it was obvious from the links I've given. I've edited my posts to name it as such.

Re: Excessive load on NTP servers

#29

Post by Fnoord »

acqq wrote: post #24
mrweasel wrote: post #19

Earlier quoted context omitted.

I think it's pretty safe to assume that the developers have no idea that things like vendor zones exists. NTP, like DNS or SMTP, is ubiquitous infrastructure, not something the average developer sets aside time to understand.

They didn't have to use ntp.org pool at all. They obviously wanted to check if somebody changed the time on the phone and to still use "the internet time." And for that contacting one Apple's server (time.apple.com) were enough. It seems that the iOS library author "helpfully" provided the default of contacting 30 servers from the ntp.org pool.

Is it possible to spoof the reply? Or block the request? This smells like security by obscurity to me.

Re: Excessive load on NTP servers

#30

Post by coleca »

FWIW my teenage daughter has been complaining about this latest Snapchat update for iOS the past couple days. It constantly crashes and causes the phone to reboot itself. Looking at Twitter, there's tons and tons of people reporting the same issue, so it seems pretty widespread. Wonder if it's related to this NTP issue.
Post reply on HN