Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Excessive load on NTP servers

news.ntppool.org

Post reply on HN
Print view View original

81–90 of 157 posts

Re: Excessive load on NTP servers

#81

Post by eigenvector »

unethical_ban wrote: post #44
Declanomous wrote: post #12

For whatever reason, ntppool.org is blocked at my work. And of course, you don't get the page that states why when the website is served via https. Not that I need to see the page to know it was either blocked for "hacking" or "entertainment", and I'm guessing it's not entertainment. Edit: This probably explains why our clocks have been off by 45 minutes since Monday. I guess it will be entertaining to see how long i…

I don't know why an org would be blocking NTP. But ideally, IT would run their own NTP service (if the shop is big enough), block NTP to any other org, and sync their server with upstream. Similar to package management, DNS, etc. - self-host it all.

Yes, but when your IT is incompetent they do the first half (block NTP to anywhere outside your network), then don't provide their own time source. Then try to blame users when they complain that their time is always wrong.

Re: Excessive load on NTP servers

#82

Post by mrweasel »

acqq wrote: post #24
mrweasel wrote: post #19

Earlier quoted context omitted.

I think it's pretty safe to assume that the developers have no idea that things like vendor zones exists. NTP, like DNS or SMTP, is ubiquitous infrastructure, not something the average developer sets aside time to understand.

They didn't have to use ntp.org pool at all. They obviously wanted to check if somebody changed the time on the phone and to still use "the internet time." And for that contacting one Apple's server (time.apple.com) were enough. It seems that the iOS library author "helpfully" provided the default of contacting 30 servers from the ntp.org pool.

I'm guessing of cause, but it's entirely possible that they used the ntp.org pool, because that's what a quick Google search would tell you to do. Getting a vendor zone require that you know it exists.

Re: Excessive load on NTP servers

#83

Post by devicenull »

CaptSpify wrote: post #73
sschueller wrote: post #27

Why on earth would you do that? If you want to prevent users from altering their time use your server and do a time compare with your server. NTP can be easily intercepted and altered so it would make a lot more sense to do this via a encrypted certificate pinned communication path increasing my work load drastically to alter the time. I snapchat going to pay for the DDOS they created?

Stupid decision by SC for sure, but is there a reason there is no rate-limiting on the NTP servers? I'm not up to date on their structure. Maybe it's just not feasible because they don't synchronize clients?

The NTP servers are all run by random members of the community. There's no real coordination between them (outside of being part of the pool), so you can't really rate limit between servers.

The library was only doing a couple request per NTP server, so rate limiting really wouldn't have helped.

Re: Excessive load on NTP servers

#84

Post by hueving »

dan1234 wrote: post #67
codazoda wrote: post #25

Earlier quoted context omitted.

As a developer, I'd rather they build it and sign it for me. The key signing stuff always seems difficult.

I would hate that. How could ever be sure Apple (or anyone else) hasn’t added/modified my code without consent? I wouldn’t ever stake my reputation on signed code which hasn’t been signed by myself!

Yeah, it's not like Apple is in charge of the entire operating system running the app and verifying said signatures. Having them sign your app is definitely what gives them too much power.

Re: Excessive load on NTP servers

#87

Post by discreditable »

Declanomous wrote: post #32
Twirrim wrote: post #26

Earlier quoted context omitted.

> I guess it will be entertaining to see how long it takes for IT to figure this one out. Why not just tell them. What have you got to lose? Hell, blame your charitable spirit on the holiday season if you must.

I got told off for diagnosing issues in the past. The IT director is a megalomaniac and interprets it as a challenge to his power. The only time I offer suggestions now is when one of his employees specifically asks me for help. Edit: I realize "got told off" didn't really capture what happened. I came in early one day and noticed we were having a dns issue. I manually refreshed my DNS cache and it started to work. I…

If you want to sidestep your IT, you can report the site to your filter provider as miscategorized. I'd argue that ntppool.org is not related to hacking. Most of the filter providers have publicly available forms or email addresses for this stuff. There's not a high burden of proof to worry about either.

Re: Excessive load on NTP servers

#88

Post by Declanomous »

eigenvector wrote: post #81
unethical_ban wrote: post #44

Earlier quoted context omitted.

I don't know why an org would be blocking NTP. But ideally, IT would run their own NTP service (if the shop is big enough), block NTP to any other org, and sync their server with upstream. Similar to package management, DNS, etc. - self-host it all.

Yes, but when your IT is incompetent they do the first half (block NTP to anywhere outside your network), then don't provide their own time source. Then try to blame users when they complain that their time is always wrong.

We do have our own time source. Our NTP source is locked to that server via GPO. NTP requests aren't blocked, because I can still set NTP on things like my printer to other NTP sources and receive updates.

I'm willing to bet they don't realize that they've blocked their server. What I want to know is how the drift got to be this bad in a matter of days. It's like whatever computer they are using as the NTP server doesn't have a real-time clock.

Re: Excessive load on NTP servers

#89

Post by matt_wulfeck »

cuonic wrote: post #60
easytiger wrote: post #2

Wait.. they are saying the app itself is making NTP requests? > Confirmed - starting up the iOS Snapchat app does a lookup to the domains you listed, and then sends NTP to every unique IP. Around 35-60 different IPs. Hmm. Is that a fraud prevention thing or something? No way on earth a user app should be getting its own time

Snapchat have a lot of "fraud protection" in the form of time sensitive tokens hashed with secret keys generated by strange .so libraries. This is used to keep third party apps from using their API, obviously a lot of user's devices have incorrect clocks, so when they reduced the secret token time frame lots of users probably started getting API errors, so this is their attempt at a solution.

Thank you! This is the most reasonable answer I've seen in the thread so far.

Re: Excessive load on NTP servers

#90

Post by johansch »

pavel_lishin wrote: post #34
acqq wrote: post #8

According to the forum, the pattern matched this third-party library: https://github.com/jbenet/ios-ntp Specifically, all the servers(!) from here are contacted: https://github.com/jbenet/ios-ntp/blob/master/ios-ntp-lib/Ne... Note that the library author wrote: "ios-ntp is often (mostly?) used to make sure someone hasn't fiddled with the system clock. The complications involved in using multiple servers and averaging…

This is a really weird comment format. It almost suggests a lack of syntax highlighting. /*┌──────────────────────────────────────────────────────────────────────────────────────────────────┐ │ Prepare a sort-descriptor to sort associations based on their dispersion, and then create an │ │ empty array for associations to fill .. │ └──────────────────────────────────────────────────────────────────────────────────────…

Brings back memories of MS-DOS oriented source code from the 80s.
Post reply on HN