Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Excessive load on NTP servers

news.ntppool.org

Post reply on HN
Print view View original

61–70 of 157 posts

Re: Excessive load on NTP servers

#61

Post by sleepychu »

sschueller wrote: post #27

Why on earth would you do that? If you want to prevent users from altering their time use your server and do a time compare with your server. NTP can be easily intercepted and altered so it would make a lot more sense to do this via a encrypted certificate pinned communication path increasing my work load drastically to alter the time. I snapchat going to pay for the DDOS they created?

The way they achieved their goal was misguided but what you've described skips over large parts of the problem. Why would the server time and phone time be in sync?

Re: Excessive load on NTP servers

#62

Post by brainfire »

easytiger wrote: post #2

Wait.. they are saying the app itself is making NTP requests? > Confirmed - starting up the iOS Snapchat app does a lookup to the domains you listed, and then sends NTP to every unique IP. Around 35-60 different IPs. Hmm. Is that a fraud prevention thing or something? No way on earth a user app should be getting its own time

I've never used Snapchat but I believe one of its features is time-expiring photos. If they do the expiration in the client then this may be a way to check if a user is getting around it by setting the system clock backwards.

Re: Excessive load on NTP servers

#63

Post by hood_syntax »

setq wrote: post #48
Declanomous wrote: post #32

Earlier quoted context omitted.

I got told off for diagnosing issues in the past. The IT director is a megalomaniac and interprets it as a challenge to his power. The only time I offer suggestions now is when one of his employees specifically asks me for help. Edit: I realize "got told off" didn't really capture what happened. I came in early one day and noticed we were having a dns issue. I manually refreshed my DNS cache and it started to work. I…

This sort of stuff fucks me off. I got into trouble at university when I was running a CAD session on X (Cadence VLSI design FTW, not). Some asshat had telnetted in and was trying to brute force root because it was a faster machine than the crappy sun4's dotted around. It was spewing all over the framebuffer. So I logged into another box and sent him an email saying pack it in and that I was trying to work and that I…

Wow, I don't even know what to say. If it gives you any consolation I probably need to get my blood pressure checked after reading that.

Re: Excessive load on NTP servers

#64

Post by Splines »

skeptic2718 wrote: post #35
coleca wrote: post #30

FWIW my teenage daughter has been complaining about this latest Snapchat update for iOS the past couple days. It constantly crashes and causes the phone to reboot itself. Looking at Twitter, there's tons and tons of people reporting the same issue, so it seems pretty widespread. Wonder if it's related to this NTP issue.

Can apps cause iOS to reboot ? That's a bit shocking. I don't own an iPhone.

I've seen a test version of an app cause issues such that the launcher would crash (i.e. "respring"). Probably some intersection of particular api usage and OS bugs.

To the unobservant user it looks like the OS is rebooting, although it's much quicker than a real reboot.

Re: Excessive load on NTP servers

#65

Post by Declanomous »

metaphorm wrote: post #54
Declanomous wrote: post #32

Earlier quoted context omitted.

I got told off for diagnosing issues in the past. The IT director is a megalomaniac and interprets it as a challenge to his power. The only time I offer suggestions now is when one of his employees specifically asks me for help. Edit: I realize "got told off" didn't really capture what happened. I came in early one day and noticed we were having a dns issue. I manually refreshed my DNS cache and it started to work. I…

where do you work, and more importantly, why do you still work there?

I work in non-profit fundraising.

I'm currently looking for a role, but I've worked here for 3 years because I have been able to basically do whatever I want. I'm a combination of analyst, data scientist, and marketer. I'm in charge of our appeals, from strategy all the way to the money coming back in house.

We have over half a million constituents. It's really great if you are interested in testing. I've sent out mailings where I'm testing 10 or 11 different factors. I've tested basically everything: the size of the font, the weight of the letterhead, the format of the coupon, how the letter is mailed, the dimensions of the envelope, the structure of the ask, etc.

Even with the added expense of testing, I've decreased our cost to raise a dollar by over 20 cents.

On top of that, I've automated all sorts of processes. At this point, I think my processes save about a man-month per month.

So, I have a lot to feel good about, but I'm really being limited on the technology side of things at this point. Biggest barrier is that I haven't quite decided what I want my next step to be at this point. I'm afraid I'll end up with a job with a much narrower focus and get bored.

Re: Excessive load on NTP servers

#66

Post by tekromancr »

anc84 wrote: post #45
codazoda wrote: post #25

Earlier quoted context omitted.

As a developer, I'd rather they build it and sign it for me. The key signing stuff always seems difficult.

As a user, I'd rather you build your code and sign it for me. Enabling a third-party to alter your programs taking away the trust I would have in you.

But you are already trusting Apple to manufacture your device and the operating system the app runs on top of.

Re: Excessive load on NTP servers

#67

Post by dan1234 »

codazoda wrote: post #25
pooper wrote: post #7

Earlier quoted context omitted.

I think Apple should require app vendors to just submit source code and build instructions and have Apple just build it. It'd be harder to pull off on Google Play Store but I think Apple could make this happen if they wanted to.

As a developer, I'd rather they build it and sign it for me. The key signing stuff always seems difficult.

I would hate that. How could ever be sure Apple (or anyone else) hasn’t added/modified my code without consent?

I wouldn’t ever stake my reputation on signed code which hasn’t been signed by myself!

Re: Excessive load on NTP servers

#68

Post by jstanley »

sleepychu wrote: post #61
sschueller wrote: post #27

Why on earth would you do that? If you want to prevent users from altering their time use your server and do a time compare with your server. NTP can be easily intercepted and altered so it would make a lot more sense to do this via a encrypted certificate pinned communication path increasing my work load drastically to alter the time. I snapchat going to pay for the DDOS they created?

The way they achieved their goal was misguided but what you've described skips over large parts of the problem. Why would the server time and phone time be in sync?

They could just use their own canonical time (from their server) instead of hammering NTP.

It doesn't say anything about synchronisation between phone and server.

EDIT: In fact it is easier to implement it this way than using NTP. I've implemented something similar and I found it easier to add an API endpoint that returns time() than to ship an NTP client...

Re: Excessive load on NTP servers

#69

Post by pooper »

netsharc wrote: post #47
pavel_lishin wrote: post #31

Earlier quoted context omitted.

How so?

For him, and imagine how Microsoft or Google would feel if they have to submit their source code to Apple...

Well, it is only client-side code though. Yes, it'd require some discipline to have proper separation so there is no leakage but I imagine it can be done.

to be clear, this is the reaction I anticipated when I wrote the gp. I don't think this is a cut and dried topic. I was merely expressing one side of the argument.

I don't think Apple compiling and signing binaries changes much when it comes to the average user and their security and trust model. It is my impression that Apple could easily intercept any keyboard input if they wanted to and frankly I wouldn't put it beyond the people at some other companies like Facebook or LinkedIn but I don't think we have found any good reason to lose faith in Apple's (or Google's) ability and will to do the right thing. Of course, ideally the idea of Trust No One is great but at some point you have to trust someone because who can read all the lines of all the code in the world?

I don't think Apple needs access to the source code to do things it needs to do. I was just saying that they have enough clout that the platform iOS has a solid foundation and can weather the storm that would inevitably rise from such a divisive decision.

Re: Excessive load on NTP servers

#70

Post by wnevets »

skeptic2718 wrote: post #35
coleca wrote: post #30

FWIW my teenage daughter has been complaining about this latest Snapchat update for iOS the past couple days. It constantly crashes and causes the phone to reboot itself. Looking at Twitter, there's tons and tons of people reporting the same issue, so it seems pretty widespread. Wonder if it's related to this NTP issue.

Can apps cause iOS to reboot ? That's a bit shocking. I don't own an iPhone.

I know apps cause my ipad to reboot all the time.
Post reply on HN