Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Epochalypse Project

epochalypse-project.org

Post reply on HN
Print view View original

31–40 of 91 posts

Re: The Epochalypse Project

#31

Post by jmbwell »

jbeninger wrote: post #23
bongodongobob wrote: post #20

Earlier quoted context omitted.

What? Y2K did have many demonstrable problems... Having a 2 digit year did obviously cause problems. The reason nothing happened is because a shit ton of time and money was spent making sure it didn't.

Agreed. My point is that the orgs paying for all these updates were mostly motivated by the vague claims of experts rather than concrete examples

It was pretty easy for orgs with affected systems to produce concrete examples for themselves. Maybe to everyone else it seemed vague, but for the people who had to deal with it, it was taken pretty seriously from top to bottom.

It was thankless work that is still glossed over and waved away today, but it was all a very big deal throughout the late 90s.

Re: The Epochalypse Project

#32

Post by calibas »

Waterluvian wrote: post #9

I think this effort would benefit from trying to qualify what “unpredictable ways” actually means. If anyone is testing devices, a catalog of test results describing the actual failure modes that were revealed would help make this whole thing more concrete. I think many software engineers know that if you want to make any organization care about this type of issue, you need to be ready to demonstrate the severity and…

Worst case scenario, it bricks your device: https://issuetracker.google.com/issues/36928638?pli=1

Even if the system boots properly, there's various critical systems that depend upon having the correct time. Say goodbye to things like HTTPS and SSL/TLS certificates.

Re: The Epochalypse Project

#35

Post by hackyhacky »

lionkor wrote: post #29
fmbb wrote: post #10

Earlier quoted context omitted.

In the year 287390 (285420.9 years after 1970) according to my calculations using DuckDuckGo’s calculator. If you ask ChatGPT it’s: = 285,616 years after 1970 = Year 285,616

Why would you ask ChatGPT?

AI is the next big thing, I hear.

Re: The Epochalypse Project

#36

Post by Thorham »

fmbb wrote: post #10
panzi wrote: post #8

When will milliseconds since the Unix epoch not be precisely representable in IEEE double anymore? (As it's used in JavaScript.)

In the year 287390 (285420.9 years after 1970) according to my calculations using DuckDuckGo’s calculator. If you ask ChatGPT it’s: = 285,616 years after 1970 = Year 285,616

That seems a bit small seeing how doubles can represent 53 bit integers accurately.

Re: The Epochalypse Project

#37

Post by lambdaone »

Waterluvian wrote: post #9

I think this effort would benefit from trying to qualify what “unpredictable ways” actually means. If anyone is testing devices, a catalog of test results describing the actual failure modes that were revealed would help make this whole thing more concrete. I think many software engineers know that if you want to make any organization care about this type of issue, you need to be ready to demonstrate the severity and…

It means 'anywhere between being bricked and no problem at all, and we can't give you any idea of how severe or how likely any of those possiblities are'. The only way you can really know is to thorougly audit your system and/or test it. Preferably both.

Re: The Epochalypse Project

#38

Post by luckylion »

calibas wrote: post #32
Waterluvian wrote: post #9

I think this effort would benefit from trying to qualify what “unpredictable ways” actually means. If anyone is testing devices, a catalog of test results describing the actual failure modes that were revealed would help make this whole thing more concrete. I think many software engineers know that if you want to make any organization care about this type of issue, you need to be ready to demonstrate the severity and…

Worst case scenario, it bricks your device: https://issuetracker.google.com/issues/36928638?pli=1 Even if the system boots properly, there's various critical systems that depend upon having the correct time. Say goodbye to things like HTTPS and SSL/TLS certificates.

Will the root-certificates still be trusted in 12 years? Will we largely use the same TLS versions? And if systems can be updated to account for that, shouldn't they also be able to be updated to deal with the timestamps limitation?

Re: The Epochalypse Project

#39

Post by luckylion »

mmwako wrote: post #12
igleria wrote: post #6

my capitalist side remembers that many people made retirement money because of Y2K. Maybe I should start thinking about an early retirement :)

How exactly? asking for a friend

"You still know php4? We need someone to fix this 50000 loc file that was written in 2005. Willing to pay big money."

Re: The Epochalypse Project

#40

Post by perlgeek »

> And what’s worse, malicious threat actors can manipulate time synchronization protocols in many cases to trigger this vulnerability at the time of their choosing.

If you switch to 64 bit timestamps, and the network protocol supports dates > 2038, can you then just trigger the rollover bugs by pretending it's 2*64 - 1 seconds after epoch start?

Also, if the actions are potentially so severe, and NTP (or whatever is used) so vulnerable, why haven't we seen many such attacks in the wild?

Update: to be clear I'm not arguing that there isn't a problem, I've already run into it myself. I'm trying to understand how severe it is, how exploitable, and how robust a solution could be.

Post reply on HN