Live data from Hacker News

Please donate to keep Network Time Protocol up – Goal 1k

ntp.org

111–120 of 242 posts

Re: Please donate to keep Network Time Protocol up – Goal 1k

#111
As someone working on an NTP implementation (specifically ntpd-rs) I have to add some context to this: I do believe that donating to the Network Time Foundation is fine, but it is not required to keep the Network Time Protocol up in any way.

Firstly, the most important reason the ntp.org domain name is so well known is because of the NTP pool, which is an entirely separate project (the Network Time Foundation calls it an associated project), which was allowed to use the `pool.ntp.org` domain name, but does not directly receive significant funding from the Network Time Foundation as far as I understand (I do not know the details of the domain name arrangement). That pool project was developed independently of the Network Time Foundation and is run by a different group of volunteers, mostly being developed and maintained by Ask Bjørn Hansen and hosting servers entirely consisting of (sometimes professional) volunteer operators. This is what many NTP implementations, specifically many Linux distributions, use as their standard source of time. But it does not appear to depend much on the Network Time Foundation for continued existence.

Secondly, despite all the claims made on the Network Time Foundation site, the IETF took over development and maintenance of the NTP protocol for something like two decades now already under the NTP working group. This was all done with the Network Time Foundation fully agreeing this was the way forward. But for some reason they still consider themselves exempted from any process that the IETF uses and consider themselves as the true developers of the protocol. They constantly frustrate the processes that the IETF uses, claiming that they should receive special treatment as being the 'reference implementation'. Meanwhile, the IETF NTP WG does not have a concept of the reference implementation at all, instead considering all NTP implementations equal.

Aside from this frustrating stance, the Network Time Foundation also didn't do much work on trying to forward the standard at all, instead relying on the status quo from the late 90s and early 2000s. Meanwhile the IETF NTP WG worked on standardizing a way to secure NTP traffic (with regular NTP traffic being relatively easy to man in the middle, with older implementations even being so predictable that faking responses didn't even need reading the requests). That much more secure standard, NTS, was fully standardized in September of 2020, but the Network Time Foundation continues to not implement this standard. All of this has resulted in almost every Linux distribution that I know of replacing their ntpd implementation with NTPsec (with ntpd not even being available as an alternative anymore for installation).

Meanwhile people also started working on NTPv5, in order to remove some of the unsafe and badly defined parts of the standard, and in general bring the spec back up to date. As part of this process, it was decided some time ago that in contrast to the previous NTP standards, the algorithms specifying what a client should do in order to synchronize the time should be removed from the standard (the algorithms specified in the previous standards were not being used by any implementation, not even the ntpd implementation by the Network Time Foundation itself). NTPv5 instead focuses on the wire format of NTP packets and the simple interactions between parties. Yet despite there having been a consensus call on this, and despite no current implementation following the exact algorithm as specified in NTPv4, the Network Time Foundation continues to frustrate the process by claiming that these algorithms are an essential part of the standard.

All of this frustration was also a large part of why the PTP protocol was eventually developed at the IEEE. That is to say: even though the operating mode of PTP is often quite different to that of NTP these days, the information that needs to be transferred is essentially the same, and the packets could have trivially been defined to be the same as long as NTP had built in a little bit of additional flexibility a little bit earlier. This would have also helped NTP in the end (with for example hardware timestamping only being implemented for PTP right now, even though it could have been just as useful in NTP), and with PTP now also aiming to introduce a simpler client-server model via CSPTP that looks a whole lot like what NTP was trying to achieve all this time with its most used operating mode.

It is my belief that the Network Time Foundation continues to push themselves in a corner of more and more irrelevance even though that did not need to be. The historical significance of David Mills' ntpd implementation is definitely there, and we should applaud the initial efforts and their focus on keeping the protocol open and widely available. And I do believe that the current people at the Network Time Foundation could still provide more than enough valuable input in the standardization process, but they cannot claim anymore to be the sole developers of the NTP protocol. Times have changed, there are now multiple implementations with an equally valid claim. Especially with GNSS (specifically GPS) being under attack more and more these days, we need alternative ways of synchronizing computer clocks to a standard time in a secure way. NTP and NTS are perfectly positioned to take on that task and we need to make sure that we keep the standard up to date for our evolving world.

Edit: if you want something else to donate to, I would consider donating to the IETF, NTPsec, or maybe donating some time to the NTP pool. I would also link to donations for Chrony (one of the other major NTP server implementations) but they do not appear to offer anything. Linking to my own project's donation page does not seem fair considering the contents of this post.

Re: Please donate to keep Network Time Protocol up – Goal 1k

#115
post #92

Earlier quoted context omitted.

Who's running ntpsec?

At least in part, someone you really don't want to be running a fork of an important project: ESR.

Oh, no, I mean, I know who's actually behind the project, I'm just wondering if there are any major deployments of it.

Re: Please donate to keep Network Time Protocol up – Goal 1k

#116

I refuse to donate. Trillion dollar companies depend leech on it and yet refuse to spend money on it. Let it fail and see what happens.

This raises a lot of questions. Did they actually ask for money to these big companies? Did they get rejected?

Another approach could be to move this under the umbrella of any of the other OSS foundations. I can imagine the Linux Foundation would be a good place. Well funded, already has most of the stakeholders involved, and this clearly falls in their scope of interest at least. It would not surprise me if that wasn't discussed at some point.

This smells a bit like something that might be more complicated than it looks.

Re: Please donate to keep Network Time Protocol up – Goal 1k

#117
post #2

I am surprised that NTP project is not funded, fully or partially, by larger organizations or governments, given the criticality of the project.

The reference implementation, while historically important, has largely been displaced by more secure/performant implementations (ntpsec, chrony), or by in-house implementations (Amazon, Google). Notably NTPd doesn't support leap-smear, which means those who absolutely must have monotonic time can't use it at all.

> Notably NTPd doesn't support leap-smear, which means those who absolutely must have monotonic time can't use it at all.

It should be noted that there currently exists no standard, technical or statutory, for how to do leap smearing. If an event happens and you need to tie your timestamped event logs to the 'greater reality' in some legally binding way there's (AIUI) no way to do that.

A few years ago there was a draft on the idea:

* https://datatracker.ietf.org/doc/draft-stenn-ntp-leap-smear-...

And the currently-draft NTPv5 has something about:

* https://datatracker.ietf.org/doc/draft-ietf-ntp-ntpv5/

Though the flag simply says that the timescale is smeared and not (AFAICT) how it is being done.

See also perhaps RFC 8633 § 2.7.1:

    […]

    Operators who have legal obligations or other strong requirements to
    be synchronized with UTC or civil time SHOULD NOT use leap smearing
    because the distributed time cannot be guaranteed to be traceable to
    UTC during the smear interval.

    […]

    Any use of leap-smearing servers should be limited to within a
    single, well-controlled environment.  Leap smearing MUST NOT be used
    for public-facing NTP servers, as they will disagree with non-
    smearing servers (as well as UTC) during the leap smear interval, and
    there is no standardized way for a client to detect that a server is
    using leap smearing.  However, be aware that some public-facing
    servers may be configured this way in spite of this guidance.
* https://datatracker.ietf.org/doc/rfc8633/

Re: Please donate to keep Network Time Protocol up – Goal 1k

#118
post #89

Earlier quoted context omitted.

Even a single highly paid employee of a FAANG, many of whom frequent this very forum, could pay for a year without breaking the bank.

100% true, but they shouldn't have to. If FAANG is using it, they should fund it. I don't want to work in a culture where the employees pay for the corporations' tools.

> I don't want to work in a culture where the employees pay for the corporations' tools.

Agreed. They call that 'open source' work (derogative)

Re: Please donate to keep Network Time Protocol up – Goal 1k

#119
post #92

Earlier quoted context omitted.

The reference implementation, while historically important, has largely been displaced by more secure/performant implementations (ntpsec, chrony), or by in-house implementations (Amazon, Google). Notably NTPd doesn't support leap-smear, which means those who absolutely must have monotonic time can't use it at all.

Who's running ntpsec?

The major Linux distributions replaced ntp with ntpsec. A better question would be who is still running ntp. I know about FreeBSD and NetBSD.

ntpsec as a project seems to be doing ok. They are releasing new versions, fix reported issues, accept patches, and develop the code publicly. While ntp still has a huge list of acknowledged but unfixed CVEs.

Post reply on HN