This is an example of the engineering "genius" within crapchat. Only yesterday we read an article about how the but chief keeps everyone apart and in the dark, lest they should discuss precious stuff, like maybe code reviews where spamming NTP is deemed OK.
Excessive load on NTP servers
71–80 of 157 posts
Re: Excessive load on NTP servers
#72According to the forum, the pattern matched this third-party library: https://github.com/jbenet/ios-ntp Specifically, all the servers(!) from here are contacted: https://github.com/jbenet/ios-ntp/blob/master/ios-ntp-lib/Ne... Note that the library author wrote: "ios-ntp is often (mostly?) used to make sure someone hasn't fiddled with the system clock. The complications involved in using multiple servers and averaging…
This is a really weird comment format. It almost suggests a lack of syntax highlighting. /*┌──────────────────────────────────────────────────────────────────────────────────────────────────┐ │ Prepare a sort-descriptor to sort associations based on their dispersion, and then create an │ │ empty array for associations to fill .. │ └──────────────────────────────────────────────────────────────────────────────────────…
Never saw something like this before… It looks kinda nice on HN though.
Re: Excessive load on NTP servers
#73Why on earth would you do that? If you want to prevent users from altering their time use your server and do a time compare with your server. NTP can be easily intercepted and altered so it would make a lot more sense to do this via a encrypted certificate pinned communication path increasing my work load drastically to alter the time. I snapchat going to pay for the DDOS they created?
Stupid decision by SC for sure, but is there a reason there is no rate-limiting on the NTP servers? I'm not up to date on their structure. Maybe it's just not feasible because they don't synchronize clients?
Re: Excessive load on NTP servers
#74Earlier quoted context omitted.
It's not isolated to iOS. Snapchat does something funky in userland. I think on the Nexus 4, Snapchat still ships with a warning that it doesn't work properly. Mine would reboot about every second time I took a picture.
I haven't investigated the issue, but I've heard that it was indeed a bug with the Nexus 4 drivers that caused the crash. Still, I've got to wonder, what are they doing that's so different than other camera apps that seem to work fine?
Not using the Camera API for starters, last I checked they still took a screenshot of the viewfinder on Android.
Re: Excessive load on NTP servers
#75Earlier quoted context omitted.
I got told off for diagnosing issues in the past. The IT director is a megalomaniac and interprets it as a challenge to his power. The only time I offer suggestions now is when one of his employees specifically asks me for help. Edit: I realize "got told off" didn't really capture what happened. I came in early one day and noticed we were having a dns issue. I manually refreshed my DNS cache and it started to work. I…
This sort of stuff fucks me off. I got into trouble at university when I was running a CAD session on X (Cadence VLSI design FTW, not). Some asshat had telnetted in and was trying to brute force root because it was a faster machine than the crappy sun4's dotted around. It was spewing all over the framebuffer. So I logged into another box and sent him an email saying pack it in and that I was trying to work and that I…
I sent a complaint to my boss and HR about IT recently that was around 30,000 words. It was basically 500 words describing the level of incompetence of the IT director, the remaining 29,000 words were just supporting evidence. I'd say it was a massive waste of time, but the IT director has basically made his expertise unassailable, and the only higher authority he recognizes is Microsoft.
I basically went through all my tickets and emails, took IT directors claims, read the MSDN articles on the topic, and pointed out all of the places where what he said was not only wrong, but grossly wrong. Things like "sometimes databases lose data." That's funny, cause I'm sure the team that built SQL Server 2012 would have something to say about that. Why don't we look at the documentation on ACID principles.
I've come to expect the IT director to be a moron at this point, and I had been trying to roll with the punches. However, my work has been going missing, and I got in trouble for it. He denied losing it, then he blamed the database for his incompetence. I was so angry I was awake for 3 days straight cross referencing everything.
The lost data wouldn't have even been a problem if he had just told me within a day or two. I only find out it's missing when we try finding it weeks or months later. Then I have to waste my time doing a forensic investigation in to the scope of the problem.
The most annoying this is that the last person in this role never had any of these issues because nobody ever audited our data. I have managed to instill the idea that data can be 100% correct, and we should always be checking our data to make sure it's right. So now I get blamed anytime information is missing or incongruous.
Re: Excessive load on NTP servers
#76Earlier quoted context omitted.
Have you thought about getting a new job, for someone who is not a nutcase?
Currently looking. I finally came to my last straw recently. A coworker sent me an email because some data I was in charge of adding to the system was missing. I looked, and somehow data in our database had gone missing. I use the data to add information to another database, and that database had the information in it. So somehow he managed to lose information in SQL Server. A few weeks later, my boss brought me in t…
I've seen this happen as well. Data "mysteriously" reverted and it turned out to be an unrequested database restore. They reverted to a recent backup but didn't mention it to anybody so a few days of data was missing.
Re: Excessive load on NTP servers
#77Earlier quoted context omitted.
This sort of stuff fucks me off. I got into trouble at university when I was running a CAD session on X (Cadence VLSI design FTW, not). Some asshat had telnetted in and was trying to brute force root because it was a faster machine than the crappy sun4's dotted around. It was spewing all over the framebuffer. So I logged into another box and sent him an email saying pack it in and that I was trying to work and that I…
Wow, I don't even know what to say. If it gives you any consolation I probably need to get my blood pressure checked after reading that.
It took me about ten years to calm down :)
Re: Excessive load on NTP servers
#78Earlier quoted context omitted.
The way they achieved their goal was misguided but what you've described skips over large parts of the problem. Why would the server time and phone time be in sync?
They could just use their own canonical time (from their server) instead of hammering NTP. It doesn't say anything about synchronisation between phone and server. EDIT: In fact it is easier to implement it this way than using NTP. I've implemented something similar and I found it easier to add an API endpoint that returns time() than to ship an NTP client...
But then you need to manage a server and ensure that the time is running accurately. Why add such a large level of responsibility for little to no gain?
Re: Excessive load on NTP servers
#79Why on earth would you do that? If you want to prevent users from altering their time use your server and do a time compare with your server. NTP can be easily intercepted and altered so it would make a lot more sense to do this via a encrypted certificate pinned communication path increasing my work load drastically to alter the time. I snapchat going to pay for the DDOS they created?
Stupid decision by SC for sure, but is there a reason there is no rate-limiting on the NTP servers? I'm not up to date on their structure. Maybe it's just not feasible because they don't synchronize clients?
Even without thinking about storing some context, replying to NTP request is probably similarly expensive as evaluating whether it should be rate limited.
Re: Excessive load on NTP servers
#80Earlier quoted context omitted.
They could just use their own canonical time (from their server) instead of hammering NTP. It doesn't say anything about synchronisation between phone and server. EDIT: In fact it is easier to implement it this way than using NTP. I've implemented something similar and I found it easier to add an API endpoint that returns time() than to ship an NTP client...
But then you need to manage a server and ensure that the time is running accurately. Why add such a large level of responsibility for little to no gain?
How is that extra responsibility? Do you think Snapchat aren't already running servers?
And you don't care whether the time on the server is running accurately if you're just using it to generate tokens which are checked against the time on the server. It just needs to be consistent, it could be an arbitrary counter and would still work fine as long as it counted up reliably at consistent intervals.