Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows feature that resets system clocks based on random data is wreaking havoc

arstechnica.com

Post reply on HN
Print view View original

161–169 of 169 posts

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#161

Post by J_cst »

ewoodrich wrote: post #93
jmuguy wrote: post #12

Windows Time bullshit was one of the most annoying things I dealt with during my years as an IT guy. Registering and unregistering w32time, trying different NTP servers. Trying to figure out why domain systems werent getting their time from the DC. It always felt so... stupid. Surely having the correct time on a device isnt that complicated. Turns out, its not, unless you're on Windows. Somewhat ironic that these day…

I have a Windows work laptop that sometimes drifts up to 10 minutes off the correct time despite time/date settings saying it has synced every day. It won't even let me correct the time because of an enterprise policy requiring it to use network time. Then one day it will be back to the correct time and the drift cycle begins anew.

I have the exact same issue at my office. Do anyone has a solution to that. I'd appreciate it greatly. Thanks

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#162

Post by JohnFen »

biogene wrote: post #148
JohnFen wrote: post #58

Earlier quoted context omitted.

Yes, I read that. I think that if you're making mission-critical systems rely on nonguaranteed behavior from systems you don't control, then it's a Bad Idea.

The point is that it was guaranteed behavior before the spec was changed. As an aside, I do find it amusing that the memo was co-authored by a Googler. Google has the best fingerprinting & tracking tech baked into their core products. I guess they don't want competition! :) https://www.ietf.org/archive/id/draft-mathewson-no-gmtunixti...

Ah, right you are. My brain wasn't letting that sink in yesterday.

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#163

Post by gerdesj »

nullindividual wrote: post #158
gerdesj wrote: post #154

Earlier quoted context omitted.

I use wireshark instead - https://wiki.wireshark.org/TLS

They're not comparable tools. I wouldn't use Wireshark to debug HTTP. And Fiddler simply can't intercept other protocols.

Fiddler is a MitM proxy with knobs on. I don't deny it is rather handy. I use a lot of tools.

Wireshark simply listens. If you give it the private key for a TLS exchange it is able to decrypt the stream.

Fiddler makes changes to the stream - it turns a single stream into two streams with the Fiddler in the middle, Wireshark does not - per se - it just listens but because it will be a tap in a stream it will slightly affect that stream, unless you use a switch that can mirror ports - and that's what I do.

When it is your web server (int al) then you have access to the private key and then Wireshark's minimal touch is indicated. Otherwise Fiddler or similar (Squid and others for me) is indicated instead.

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#164

Post by jasonfarnon »

extraduder_ire wrote: post #149
jasonfarnon wrote: post #114

Earlier quoted context omitted.

A lot of shareware back then stopped working after a certain # of calendar days, which it used windows to figure out. So I always had my date set far in the future.

How does that work? Surely you'd set it to the past. Unless it's a $networkDate - $installDate > $x thing.

you're right--I think the trick must have been to set the computer date far in the future when installing the software, then return to the correct date for future executions.

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#165

Post by tpolzer »

orbital-decay wrote: post #45
jstanley wrote: post #43

Earlier quoted context omitted.

Computers do do this. The problem is that some computers are quite old and the battery that keeps the real-time clock running has gone flat. That means if the computer is powered off it forgets what time it is. If your quartz watch battery goes flat you replace it straight away because a watch with a flat battery is 100% useless. But if the battery on your motherboard goes flat you don't even notice, so why would you…

Timepieces last a decade on a shirt button sized battery. Surely you can afford a bit larger battery on a motherboard, probably even a rechargeable one, make the clock sufficiently autonomous from the rest of the system, and make the motherboard not boot when it doesn't have the battery, so you can leave it unattended for a while.

A decade is roughly the upper limit of specified battery shelf life for cheap batteries. Making the battery bigger doesn't really help much at that point where it's limited by shelf life, not capacity.

There are longer life batteries, but they're _expensive_, e.g. a Tadiran TL-4934, 1Ah, with a shelf life of 40 years will cost ~5$ in bulk.

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#166

Post by nullindividual »

gerdesj wrote: post #163
nullindividual wrote: post #158

Earlier quoted context omitted.

They're not comparable tools. I wouldn't use Wireshark to debug HTTP. And Fiddler simply can't intercept other protocols.

Fiddler is a MitM proxy with knobs on. I don't deny it is rather handy. I use a lot of tools. Wireshark simply listens. If you give it the private key for a TLS exchange it is able to decrypt the stream. Fiddler makes changes to the stream - it turns a single stream into two streams with the Fiddler in the middle, Wireshark does not - per se - it just listens but because it will be a tap in a stream it will slightly…

(I've used Fiddler for... ever, so I'm familiar with it)

The GP likely doesn't have the private key if they're using Outlook. As if they're using Outlook it is most likely with Exchange. And if they're using Exchange, it is most likely EXO. Hence, Fiddler as the appropriate recommendation for this portion of the thread.

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#167

Post by gerdesj »

nullindividual wrote: post #166
gerdesj wrote: post #163

Earlier quoted context omitted.

Fiddler is a MitM proxy with knobs on. I don't deny it is rather handy. I use a lot of tools. Wireshark simply listens. If you give it the private key for a TLS exchange it is able to decrypt the stream. Fiddler makes changes to the stream - it turns a single stream into two streams with the Fiddler in the middle, Wireshark does not - per se - it just listens but because it will be a tap in a stream it will slightly…

(I've used Fiddler for... ever, so I'm familiar with it) The GP likely doesn't have the private key if they're using Outlook. As if they're using Outlook it is most likely with Exchange. And if they're using Exchange, it is most likely EXO. Hence, Fiddler as the appropriate recommendation for this portion of the thread.

If you have to resort to a proxy (fiddler) then you are making changes. You do not get to sample unblemished data. Perhaps that is OK for the snag/issue in question but may not be.

Port mirroring/SPAN/RSPAN is the only way to be an observer without affecting the traffic you are inspecting. Fiddler literally does a man in the middle attack.

If you don't have access to a private key for a TLS exchange and stream, then you cannot do quite a lot of diags.

In the end, Fiddler and the like might do the job but to really get close to the wire requires full knowledge and a much lighter touch. That will be a port SPAN/mirror and Wireshark and a private key.

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#168

Post by nullindividual »

gerdesj wrote: post #167
nullindividual wrote: post #166

Earlier quoted context omitted.

(I've used Fiddler for... ever, so I'm familiar with it) The GP likely doesn't have the private key if they're using Outlook. As if they're using Outlook it is most likely with Exchange. And if they're using Exchange, it is most likely EXO. Hence, Fiddler as the appropriate recommendation for this portion of the thread.

If you have to resort to a proxy (fiddler) then you are making changes. You do not get to sample unblemished data. Perhaps that is OK for the snag/issue in question but may not be. Port mirroring/SPAN/RSPAN is the only way to be an observer without affecting the traffic you are inspecting. Fiddler literally does a man in the middle attack. If you don't have access to a private key for a TLS exchange and stream, then…

Again, irrelevant for the discussion at hand.

Re: Windows feature that resets system clocks based on random data is wreaking havoc

#169

Post by labawi »

anthk wrote: post #38
toast0 wrote: post #34

Earlier quoted context omitted.

NTP is trivially MITM. Secure NTP is basically not deployed anywhere. Someone with a google.com cert that's valid other than expiration is probably google and probably has a working clock.

You can always use a gpsd(4) compatible USB dongle as the time source.

GPS doesn't send full time. It wraps every 1024 weeks, or about 20 years, hence you need a (very) rough basis in case the system is over 20 years old.
Post reply on HN