"Father Time" Gets Another Year At NTP From Linux Foundation

dkatana writes: Harlan Stenn, Father Time to some and beleaguered maintainer of the Network Time Protocol (NTP) to others, will stay working for the NTP another year. But there is concern that support will decline as more people believe that NTP works just fine and doesn't need any supervision. NTP is the preeminent time synchronization system for Macs, Windows, and Linux computers and most servers on networks. According to IW, for the last three-and-a-half years, Stenn said he's worked 100-plus hours a week answering emails, accepting patches, rewriting patches to work across multiple operating systems, piecing together new releases, and administering the NTP mailing list. If NTP should get hacked or for some reason stop functioning, hundreds of thousands of systems would feel the consequences. "If that happened, all the critics would say, 'See, you can't trust open source code,'" said Stenn.

Comments

Well, you *can't* trust open-source code

[Anonymous Coward]

Nor can you trust closed-source code.

But while "open source makes all bugs shallow" is demonstrably a fallacy, at least you CAN see the source if you need to. (Good luck understanding it, though - says this pretty good C developer who just about shit when he had to look at OpenSSL/SSH code...)

Re:Well, you *can't* trust open-source code

[Anonymous Coward]

I think it's even more about accountability.

Regardless of closed or open source, companies that offer support contract (ex. Redhat, Oracle, etc) will need to put in the effort to attract an retain customers. Voluntary projects, not so much. Mr Sten doesn't owe anything to any user of NTP.

Well, the corporate world rarely offers good models of accountability, but sometimes it's still a bit higher than from people who don't even need to care ;) But for open source companies, that's usually even more important since their business model is often centered about support, with the occasional extra management tool thrown in.

Re:Well, you *can't* trust open-source code

[DerekLyons]

But while "open source makes all bugs shallow" is demonstrably a fallacy, at least you CAN see the source if you need to. (Good luck understanding it, though - says this pretty good C developer who just about shit when he had to look at OpenSSL/SSH code...)

And understanding it is more than being a programmer - it's also understanding the problem domain.

Re:Well, you *can't* trust open-source code

[Anonymous Coward]

Some of that is just that SSL is complex, though, especially the crypto. I had to read the openssl verify code to figure out precisely which bits are needed in certain certs and it was pretty easy to figure out.

Re:Well, you *can't* trust open-source code

[serviscope_minor]

But while "open source makes all bugs shallow" is demonstrably a fallacy

Well, sure if you make stuff up on the spot you can generate arbitrary fallacies. The actual quote was:

"given enough eyeballs all bugs are shallow"

And I've only ever seen it "disproved" by people who thoroughly misunderstand it.

Good luck understanding it, though - says this pretty good C developer who just about shit when he had to look at OpenSSL/SSH code...

And this actually demonstrates the code, not disproves it. The OpenSSL code is apparently not for you. I doubt it's for me either. But there are people out there who can and do work with it, hence libressl.

Re:Well, you *can't* trust open-source code

[Anonymous Coward]

Nor can you trust closed-source code.

But while "open source makes all bugs shallow" is demonstrably a fallacy, at least you CAN see the source if you need to. (Good luck understanding it, though - says this pretty good C developer who just about shit when he had to look at OpenSSL/SSH code...)

If NTP should get hacked or for some reason stop functioning, hundreds of thousands of systems would feel the consequences. "If that happened, all the critics would say, 'See, you can't trust open source code,'" said Stenn.

To this I say: "You can't trust the opinions of bought-and-paid-for critics of open source code - especially a bunch of lobbying hacks who probably can't write a line of code to save their asses."

Re:Well, you *can't* trust open-source code

[Anonymous Coward]

But while "open source makes all bugs shallow" is demonstrably a fallacy, at least you CAN see the source if you need to. (Good luck understanding it, though - says this pretty good C developer who just about shit when he had to look at OpenSSL/SSH code...)

And understanding it is more than being a programmer - it's also understanding the problem domain.

Yes but it doesn't matter how well you understand the problem domain if the code is unreadable spaghetti.

Re:Well, you *can't* trust open-source code

[Anonymous Coward]

This might be going out on a limb, but I'd suggest that libressl exists precisely because the OpenSSL code was absolute shit.

That said, GP is a troll: OpenSSL is NOT the same as, nor by even remotely the same people as, OpenSSH. I'm not going to say anything about either party, because it'll look too much like a (probably well-deserved) hit-job on OpenSSL, but look up their people, and then look up OpenSSH, and you'll find that there's a wide gulf between them.

Re:Well, you *can't* trust open-source code

[fahrbot-bot]

"given enough eyeballs all bugs are shallow"

On the other hand, many (most?) people are taught or learn programming in the same way or much the same way. This means that we all (to simplify the point) will look at things the same way and may all overlook the same problem.

I worked on an N-version fault-tolerance research project in college way back in the mid 1980s that studied this and used different programming languages -- some wildly different, like Pascal and Prolog -- as the N versions to see if using different languages would provide more coverage against login errors. One of my tasks was to write the "gold" program in several of the alternative languages, like Prolog to which the sample programs operations were compared. I graduated before the study was complete, so I don't know the results, but know *I* had to think differently when writing the various gold programs.

Re: Well, you *can't* trust open-source code

[Anonymous Coward]

OpenSSL != OpenSSH

For Christ sakes. This mistake is made everyday it feels like. OpenSSH waS written by theo and the openbsd team. The OpenSSL code was a mess, hence why theo chose to fork it and created libressl.

Re:Well, you *can't* trust open-source code

[Mr. Slippery]

.

On the other hand, many (most?) people are taught or learn programming in the same way or much the same way

Citation needed.

When I was a lad we started programming in BASIC (not "Visual Basic, I mean 10 PRINT "HELLO WORLD" 20 GOTO 10) and moved on to Pascal in high school. The standard language of instruction in universities has gone from C to C++ to Java; most folks today probably pick up Javascript or PHP as their first language.

Re:Well, you *can't* trust open-source code

[fahrbot-bot]

The citation would be in the original research proposal way back in 1985 my instructor, and the principal researcher, did for NASA. In addition, most of the languages you mentioned Pascal, C, C++, Java, Javascript) are all very similar in structure/syntax and that influences the way they are used to solve problems.

Also most people -- or groups of people -- are taught how to program in a similar fashion, using the same or similar languages -- think university CS course sequence 100, 200, 300 that probably all use C++ (or, actually, Pascal at my school back then). That leads to a more common problem solving approach and process. Many of the really difficult errors in a system are in the fringe/grey areas -- eg. draw a triangle as the complete problem space and a circle within, 95-100% of all programmers will have solutions for situations within the circle, but few for issues in the corners. The study was to see if using different programming languages would help in those fringe areas.

Case in point. The Space Shuttle had 5 redundant computers, quoting Space Shuttle:

The four general-purpose computers operated essentially in lockstep, checking each other. If one computer provided a different result than the other three (i.e. the one computer failed), the three functioning computers "voted" it out of the system. This isolated it from vehicle control. If a second computer of the three remaining failed, the two functioning computers voted it out. A very unlikely failure mode would have been where two of the computers produced result A, and two produced result B (a two-two split). In this unlikely case, one group of two was to be picked at random.

The Backup Flight System (BFS) was separately developed software running on the fifth computer, used only if the entire four-computer primary system failed.

Ideally, each computer should be running independently written programs to solve the same problems, but that wouldn't be very helpful if all the programmers were taught and programmed in the same fashion, making the same assumptions and mistakes. Markedly different languages -- like C vs. Prolog -- require very different mindsets and approaches and will hopefully have different failure sets. Or that was the hypothesis.

Bus Factor

[allquixotic]

With all due to respect to Harlan Stenn, and working under the assumption that he will choose to continue to maintain NTP for the good of everyone who uses it, the biggest donation that could possibly be given to the NTP project would be to increase its bus factor. Basically, we need at least another small handful of people -- ideally distributed throughout the world -- who have the same level of knowledge and expertise as Harlan in the area of network time, and can thus take his place if, for any reason whatsoever Harlan can't continue to work on the NTP project.

Getting Harlan to continue working on it is a short-term solution, but the sustainable future is to ensure that we have maintainers who can take his place -- ideally, paid ones.

So what we need is for a company like Red Hat or IBM or Microsoft or Canonical to bankroll a developer who has at least strong fundamentals that would enable them to quickly pick up advanced knowledge of network time, and then spend most of their working hours acquiring more knowledge about it so that it can be maintained going forward. This would probably involve a lot of ML posts with Harlan (or reading his previous ones), as well as any other developers/maintainers working on pieces of the code.

If Harlan is absolutely instrumental to the project as it stands now, the solution is to have a backup or two, who ideally are being paid a living wage to ensure the continuity of knowledge and expertise if Harlan willingly or unwillingly stopped contributing.

Projects with a bus factor of 1 that are widely relied upon need to be identified and highlighted every now and again -- not to make a case to shower the developer in money, but to get other developers to work in the same space and increase the bus factor to at least 3.

Re:Bus Factor

[Anonymous Coward]

And why, exactly, is some company going to pay people to maintain NTP? Its been around for years and quite apparently it has been a time sink for the maintainer and no one has decided to bank roll the effort in any significant way.

Money makes the world go 'round folks. If it doesn't make money, people are not going to put money into it.

Re:Bus Factor

[zdzichu]

Linux Foundation sponsored developer who has extraordinary knowledge of NTP and time issues: http://phk.freebsd.dk/time/ind...
But apparently something went iffy between them, as last commit to https://github.com/bsdphk/Ntim... was over a half year ago.

Re:Bus Factor

[Your.Master]

One possible mercenary reason: because their consumers will blame them if the Internet fucks up, even if it's not their fault. Therefore it behooves them to ensure that the Internet keeps working without a major incident.

Re:Bus Factor

[jcdr]

Hope this effort will continue.

Re:Bus Factor

[Zontar The Mindless]

The phrase you're looking for is "single point of failure". And yes, Harlan Stenn is a single point of failure. And no, that's not good.

Re:Bus Factor

[Anonymous Coward]

The best paid maintainer could be Harlan himself, but this time as the CEO of his own company.

Re:Nature of open source

[Narcocide]

I got news for you; if NTP was non-free, it never would have been used outside of the lab where it was created. There would be 1000 competing network time sync strategies, Microsoft would blithely tell the whole world theirs is the best and universally compatible, while not actually being universally compatible with anything other than third-party malware, and it would be damned-near impossible for anyone without a Master's and 20 years of industry experience to succeed at establishing time synchronization across networks of machines supplied by a heterogeneous mix of OS and hardware vendors. You really want to take NTP and throw it in the same playpen where file-sharing and web-markup language standards got mangled? Really?

Boo Fucking Hoo

[Anonymous Coward]

If he doesn't like it, start a foundation and start transferring rights & control of NTP to the foundation. Instead, he refuses to give up control and complains about the heavy workload and lack of funds. The internet has grown up & out, the era of "Jon Postels" is over.

Re:Nature of open source

[tnk1]

Someone will likely take it up if he quits, but that is an interesting experiment in how this all works if there is a scramble. Will someone form a working group? Will some corporation take up the work by handing it to one or two devs? Will one, sole maintainer step forward and simply fill the vacancy?

Since he hasn't been hit by a bus, chances are good that some publicity will cause this issue to get resolved. But what happens when a similar situation is terminated unexpectedly?

Re:Nature of open source

[Midnight Thunder]

Oh how easily this would be solved if NTP was proprietary technology and Father Time could ask a small royalty for every piece of software that uses NTP. I just mean that by making things open source you are intentionally taking the risk that there can be problems with arranging well-rounded funding.

Maybe, but the challenge with business owned closed source is that the owners then want to find extra ways to monitise the resource. The alternative would be to keep it open source and charge for support or simply encourage sponsorship from anyone using it in commercial hardware?

Upkeep

[Anonymous Coward]

How is it that an old tech like NTP with a fixed protocol need so much maintenance? That should have already settled out and just need minor patching for new architectures.

Re:Upkeep

[david_bonn]

A lot of it has to do with the fact that the system calls that you use to arrange time sync are, well, fragile and obscure and all-too-frequently broken by a new OS release. Also, a lot of bugs with respect to time synchronization are subtle and quick to anger and require quite a bit of time to reproduce and analyze.

In some ways, it would be a heck of a lot easier if we just forgot about stuff like having a monotonically increasing clock and clock skew caused by network latency. Just have everyone hard-set their clock every day from a GPS receiver, say. Of course, you'd end up with poor synchronization amongst hosts, which would easily cause its own kind of havoc. And your timestamps would be untrustworthy during that period where you are hard-setting the clock. There isn't a perfect solution.

Re: Upkeep

[Anonymous Coward]

Telecom systems of the past had tneir own sync. It worked so it is possible. It cost money too. I'd say the guy should just guve up and we all see if he was needed. That ks how world works (or does not) anyway. Oc this is one way street then. Once many less committed resources pick it up it starts forking. That is how nature works too.

http://www.openntpd.org/

[Anonymous Coward]

How about we just use OpenNTP?

Re:http://www.openntpd.org/

[Narcocide]

Well, for starters, its not always drop-in compatible with existing clients and servers in the wild, and it lacks the necessary precision for doing any sort of work that that requires sub-second synchronization accuracy.

Re:http://www.openntpd.org/

[Bengie]

It's been able to do 10ms accuracy for around the last year after they added the ability to adjust the kernel tick rate.

Re:http://www.openntpd.org/

[Narcocide]

but sometimes that's still not enough, simply put

Re:http://www.openntpd.org/

[Bengie]

Good enough for most usages. Stratum 2 time servers can have up to 100ms of uncertainty. 10ms puts you into Stratum 1 for practical purposes.

Unless you're working in specialized situations where microseconds are important, like multi-master distributed systems, I wouldn't worry about it.

Re:http://www.openntpd.org/

[Zontar The Mindless]

As a matter of fact, I do work with multi-master distributed systems, so I do worry about it.

Donations

[Anonymous Coward]

Well... where is the Bitcoin address for donations?

Re:Nature of open source

[Anonymous Coward]

Is there anything stopping Harlan Stenn from charging a buck or two per minute for support services? That should shift a lot of the workload to user groups and bring in some extra compensation.

Isn't it built into systemd already?

[Anonymous Coward]

Poettering and the rest already have a time solution, why keep this old neckbeard around?

Re:Isn't it built into systemd already?

[umghhh]

You are being sickly sarcastic, are you? I am asking because there are many evil people around so maybe you are serious.

Re:Simple

[Smallpond]

BSD NTP client - 3K lines of code. Linux NTP client - 192K lines of code. Guess which has fewer bugs.

Re:Nature of open source

[Anonymous Coward]

The alternative would be to keep it open source and charge for support

Charge who for support? Look at the work specified:

answering emails, accepting patches, rewriting patches to work across multiple operating systems, piecing together new releases, and administering the NTP mailing list.

Now potentially "answering emails" could be charged out depending on what that actually means but accepting patches? You're going to charge people that do the work and then want to submit the patch? Who are you going to charge for the "new releases"? Are you going to charge the mailing list users a subscription fee for maintaining the mailing list? As far as "rewriting patches to work across multiple operating systems" is concerned there should be automated testing and if the patch fails it should be sent back to the submitter to do that work.

or simply encourage sponsorship from anyone using it in commercial hardware?

Well this is just basically the royalty licensing model that proprietary software uses, you need one for NTP, one for OpenSSH, one for OpenSSL, etc, etc... Making it voluntary clearly doesnt work so how do you suppose it should be "encouraged"?

Most people who say

[Anonymous Coward]

they're working "100 hours a week" aren't really doing it. No one works over 15 hours a day every day at one job for 3 1/2 years. Rubbish!

Re:Most people who say

[CrankyFool]

I don't keep up with Harlan's schedule these days, but I worked with him briefly back when he was at Netflix. At the time, he didn't strike me as much of a braggart or prone to exaggeration. And his work ethic was ... not high on work/life balance.

I wouldn't bet against him working that hard on NTP -- I've never before met anyone who loved a protocol as much as Harlan loves NTP :)

Re:Most people who say

[Anonymous Coward]

You're so very wrong.
I worked 15-20 hours/day for more than 9 years.

Of course, 20 years later, I feel guilty when I stop working at 5:15pm...

Re:Most people who say

[Dutch Gun]

If he's actually working 100 hours per week for years at a time, he has NO life... period. You realize that's over 14 hours a day, seven days a week. Or if he wants one day off a week, that's well over 16 hours a day.

Really? Can someone actually work that much for over three years straight and not die or go insane? I suppose it's possible if you consider your work as both entertainment and social life as well.

Re:Most people who say

[umghhh]

There are some out there who believe that your working time is only when you press the keys and move the mouse. Gosh there is even SW that provides such metrics for the bosses if they so wish. I guess then he is not working 100h/week or his hands would fall off and his heart would just stop. But if you count thinking and discussing things at 'coffee machine' then it is manageable for some at least. Not for me tho - I did 60h/week few months in a row and this is it. Never again. It is 20ya now and it probably would kill me (and let my ex take custody of the kids away from me before that).

Re:Most people who say

[serviscope_minor]

Very very few people out there can work that hard. I certainly can't.

I'd bet that of the people you've ever heard of, a much higher proportion are out at the extreme end of work endurance compared to the average population.

Re:Most people who say

[Zontar The Mindless]

What's rubbish is that you're projecting your own laziness onto others.

Re:Most people who say

[cwsumner]

Very very few people out there can work that hard. I certainly can't.

I'd bet that of the people you've ever heard of, a much higher proportion are out at the extreme end of work endurance compared to the average population.

It's obvious that you have never been in the military, at least in time of war.
Or in a "Tiger Team" developing a completely new system.

And, fery few people are anywhere near average. Really! 8-)

Re:Simple

[phantomfive]

Why is the Linux client so much longer? What is it doing?

"NTP works just fine"

[buckfeta2014]

Uh, no. NTP needs to be redesigned so it doesn't use UDP anymore so we can stop worrying about spoofing and amplification/recursion attacks.

Re:"NTP works just fine"

[Anonymous Coward]

UDP needs to be used, for timing reasons. TCP would be wholly inappropriate for this.

Re:"NTP works just fine"

[Bengie]

UDP and TCP, choose which one you want. TCP is great if you want the accuracy of calling someone on the phone and saying "now". It's isn't UDP's fault for spoofing and amp attacks, that's that application's fault. UDP blindly does what it's told, no questions asked. Application says respond with a payload, UDP does it.

Re:"NTP works just fine"

[FranTaylor]

TCP is great if you want the accuracy of calling someone on the phone and saying "now".

this is totally bizarre statement, tcp streams get backed up, packets get retransmitted, data arrives at the client at a completely indeterminate time.

Re:"NTP works just fine"

[Bengie]

The GP said to stop using UDP. You take it up with him, I was making a sarcastic remark.

Re:Simple

[Predius]

I'm assuming the 'BSD NTP client' is OpenNTPd. The 'Linux NTP client' is NTPd that we all know and is not linux specific.

Primary differences between the two:

OpenNTPd just cares about getting the local clock close to the remote NTP's supplied time. Nothing more.

NTPd wants to get the local clock as closely as possible to actual time as well as disciplining the local timesource such that 1 second is accurately 1 second, while weeding out faulty or maliciously bad sources of time. It also can act as a server, or as a peer in a server group. It can also directly interact with multiple reference clocks.

In short, you're comparing a simple client that just looks at the time on the wall vs something that's trying to be accurate and can act as the server side of the equation.

not just NTP

[Anonymous Coward]

it's not just NTP that is languishing, perhaps a dozen other open source projects that the Internet depends on, each with one greybeard maintainer, underfunded or neglected entirely, going away soon, lose that institutional knowledge.

C'mon Apple, Google, Facebook, give back a little.

Re:not just NTP

[Anonymous Coward]

Yes they need to pay usage fees to OpenSSH, OpenSSL, NTP, etc and then you will complain when they use advertising to fund that. So you can either pay money to Facebook and Google for the services they currently provide to you in exchange for presenting advertising or you can just pay money to OpenSSH, OpenSSL, NTP and all the others directly yourself.

Re:not just NTP

[jcdr]

In the case of NTP there is a even bigger problem: the definition of UTC is done by international organisations that have trouble finding a consensus.

Re:not just NTP

[Anonymous Coward]

From the Core Infrastructure Initiative FAQ:

The Core Infrastructure Initiative is a multi-million dollar project to fund and support critical elements of the global information infrastructure. It is organized by The Linux Foundation and supported by Amazon Web Services, Adobe, Bloomberg, Cisco, Dell, Facebook, Fujitsu, Google, Hitachi, HP, Huawei, IBM, Intel, Microsoft, NetApp, NEC, Qualcomm, RackSpace, salesforce.com, and VMware.

The Core Infrastructure Initiative (CII) and its members have come together to invest in core infrastructure, providing funding for fundamental projects like OpenSSL, OpenSSH, NTPd and others.

Re:not just NTP

[Zontar The Mindless]

OP said "give back", not "pay for". Meditate for a week or two on the difference between those, then come back and try again.

Re:Simple

[Anonymous Coward]

Hint: Is a mislabled SNTP client a NTP client? Is the full blown reference NTP server/client/kitchen sink a NTP client?

Re:Simple

[Anonymous Coward]

There's yer problem. Using a server as a client is never a good idea.

Re:Simple

[Bengie]

OpenNTPd added the ability to tweak the kernel tick rate to reduce skew. It can now keep your clock within 10 milliseconds between syncs. Still not as good as the official NTP.

Pot Plants and Software

[Anonymous Coward]

Every now and then, somebody has to change the soil for the plant to flourish. It's a dirty job, but a necessary one. People typically start to care only when the plant is already dead.

Re:Nature of open source

[viperidaenz]

The problem would get resolved quicker if he did get hit by a bus.

IETF a more appropriate owner?

[Anonymous Coward]

If NTP is a broadly used protocol on the inter-tubes, then maybe it is time to push the ownership onto the IETF. After all, this is a protocol to track the current the local or GMT clock time on internet connected devices.

Re: IETF a more appropriate owner?

[Anonymous Coward]

The IETF owns the standard but the implementations are independent of that.

Lets calculate that ...

[angel'o'sphere]

7 days = 1 week
times 24 hours = 168 hours

Or in other words, he does not work in NTP 68 hours a week = 8.5h a day.

So considering that a person needs half an hour a day for eating, actually I eat longer, some sleep, some time on the toilet, some people even shower - shudder if that is longer than 5 mins - and usually you get dressed sometimes you have to go shopping ...

Well, I assume he is a nerd, sleeping in his bathrobe, so he saves dressing, showers only once a week and gets everything ordinary people shop via mail/internet order ...

Perhaps he should consider to hire an assistant? Or raise funds for one ... sorry: no one is working 100 hours a week.

Re:Lets calculate that ...

[Bengie]

At one of my hourly jobs back in college, someone had 110 hours on their pay-check. Punch in, punch out, and even punch out on breaks. It can be done, but I don't recommend it.

Re:Lets calculate that ...

[Anonymous Coward]

yup, I once had an 85 hour week... good paycheck sucky life.... I was a zombie the whole next (regular 45 hour) week.

Re:Lets calculate that ...

[Anonymous Coward]

Of course you don't recommend it, guessing your neck still hurts.

Re:Lets calculate that ...

[Anonymous Coward]

I worked with a few 100 hour week dudes.

They were intense. The smell was amazing too.

Re:Lets calculate that ...

[meregrota]

Yes, he really does work that many hours! I live with him and am the one that runs errands, cooks, cleans, maintains the workspace, cares for his health, and makes sure the bills are paid just so he can spend his entire waking day sitting in front of a freakin' huge pile of computer equipment, have hundreds of browser windows open and monitor them all just so y'all can snark and have a jolly good laugh at his obvious exaggeration and whining. You're welcome. He is the hardest working human I have ever met (and I come from a large family of workaholics). He has worked on NTP for many more years than I have known him and in 2008 he realized that there needed to be a more stable system of funding and support. Harlan has worked tirelessly since then to create that system. All the money that comes in goes right back to the project. No one is getting rich off of this. I keep a large garden and have chickens to help with food costs. No one around here has had anything that looks like a vacation in 7 years. My house needs painting. I could go on but I will finish by saying that I'm not trying to garner pity, believe me there are days when I want to walk out just because I have to live with the consequences of all the entities that rely on this "bit" of the internet being a bunch of freakin' moochers and I'm tired of it. I am doing my (sometimes begrudging) part. Why don't a few of you clever sorts step up to help also?

Re:Lets calculate that ...

[umghhh]

It depends on the job. The discussion about legally allowed work loads in EU was quite informative and sometimes funny. There was a guy there for instance - a president of a small country, claiming that he is putting more than 100h/week and all is well. OC this job was including dinners with other assholes from other states etc on which they stuffed themselves with expensive, tax payer funded food. I do not care about the food, his job is doing that but comparing that to any other job (operating table personnel in a hospital) may be quite idiotic. In other words: being a president is good. At least in civilized world where you do not get killed in a process.

Re:Lets calculate that ...

[Anonymous Coward]

Your math is wrong and appears to assume an eight day week. Working 100 hours in 7 days is about 14 hours per day, leaving about 10 hours each day for rest, eating and hygene. That would be stressful, but it is certainly possible. Heck,I did that for a while in college.

Re:Lets calculate that ...

[pao93]

try looking at jobs in the medical profession or medical research. i'm pretty sure our director does 100hrs a week easily. mind you he once told me that because his wife didn't book dinner reservations on a saturday night that meant he could work instead (and that made him happy). more relevant: a game company i worked at people ate and slept sometimes for weeks on end at work. personally i didn't last long on that schedule but that's me. it's not a great life but that's IMO. lots of people do this type of work week. some seem to not be the worst for wear for it either.

Re:Lets calculate that ...

[Zontar The Mindless]

If you're telling the truth, then we all owe you our thanks. You've got mine.

Re:Lets calculate that ...

[strikethree]

sorry: no one is working 100 hours a week.

You have clearly lived a very sheltered life.

I used to work two jobs to make ends meet. 16 hours a day (lol, more like 18 once everything was done) working as a manager at a security guard agency 4 days a week and then for the other 3 days each week, I worked 12 hours a day assembling powermacs for Apple. I averaged 116 hours a week for 2 years.

Many single moms have it just as bad or worse since kids do not allow time off. You clearly have no idea what life is like near minimum wage. If you did, you would know that a non-neglible percentage of the workforce does actually work 100+ hours a week.

But I am not attacking you. I am merely enlightening you. Have an awesome day. :)

Re:Lets calculate that ...

[cwsumner]

It depends on the job. ... There was a guy there for instance - a president of a small country, claiming that he is putting more than 100h/week and all is well. OC this job was including dinners with other assholes from other states etc ...

Going to dinners with assholes can get really old, really quick. Particulerly, when you can't say no.
I don't think fancy food would make up for it.

Re:Lets calculate that ...

[angel'o'sphere]

That is because you live in a fucked up country.

Of course I know that some people indeed work 100h a week.

My claim was more figurative. Pointing at the "high skilled worker" who claims to work 100h a week for NTP.

Re:Nature of open source

[angel'o'sphere]

There would be 1000 competing network time sync strategies There would be 1000 competing network time sync strategies
Actually, there wouldn't. Because there is only one that works. And that is how NTP works.
If you had spent some time to figure how it works you had not such a strange idea.

succeed at establishing time synchronization across networks of machines supplied by a heterogeneous mix of OS and hardware vendors.
You see ... OS and hardware and vendor have nothing to do with synchronizing time in a network. (* facepalm *)

Linux Foundation Core Infrastructure Initiative

[Anonymous Coward]

Not particularly highlighted in the article is that the LF CII is funding a small team of developers with NTP experience to focus on security hardening, development process modernization, and opening the community. There is concern about the bus factor and an attempt is being made to address it.

No critical infrastructure project should ever be so dependent on a single developer.

NTP the protocal vs NTP the software package

[davidwr]

Let's be clear here - we are talking about one particular software package - albeit a very popular one - and not the underlying protocol (which itself is subject to errata, some of which are still under discussion).

Re:Nature of open source

[Narcocide]

So you think because you disagree with my use of the word "strategies" where maybe I should have typed "services," "products," or "protocols" invalidates the entire rest of my statement?

I'd love to see you justify your apparently hyper-naive assumption of how having a mix of entirely separate OS and hardware compatibility issues to contend with would have "nothing to do with" the task of getting network time to properly sync up in the hypothetical world where NTP wasn't already the de-facto industry stanard but Microsoft's non-cooperation strategy still permeates everything.

Re:Nature of open source

[Anonymous Coward]

I'd love to see you justify your apparently hyper-naive assumption of how having a mix of entirely separate OS and hardware compatibility issues to contend with would have "nothing to do with" the task of getting network time to properly sync up in the hypothetical world where NTP wasn't already the de-facto industry stanard

Well it is the Network Time Protocol, you're going to have a hard time leveraging the services of time synchronization servers if your operating system doesn't correctly implement this protocol.

but Microsoft's non-cooperation strategy still permeates everything.

Last time I looked Microsoft used NTP, it's even licensed under a permissive open source license so they could create their own incompatible, proprietary fork if they wanted to but they haven't. So what exactly is this "non-cooperation strategy" that permeates everything?

Tragedy of the Commons

[Sir Holo]

Ah, well, this is how it always goes.

No private, for-profit entity will happily provide support for maintenance of a non-profit entity that provides a universal service, for example time-synchronization, upon which their lifeblood depends.

Gasp! That would put us at an economic disadvantage to our competitors! We donate a few thousand $$$, but others don't donate a thing. I say, "No. no. no."

OK, so I am past wasting breath. For the uninitiated, just find the Wikipedia article on the "Tragedy of the Commons."

The concept is so simple, so obvious, and so accurate

Read on

Re:Nature of open source

[FranTaylor]

Who are you going to charge for the "new releases"?

There are actually people out there who want features bad enough, that are willing to pay other people to write them. Generally people do not work for free.

there should be automated testing and if the patch fails it should be sent back

Yeah that one made me laugh pretty good, assuming that all your tests are perfect and any failures are bad patches.

Linux Foundation Did Fund Alternative

[Anonymous Coward]

Obviously no one has read the article. The Linux Foundation funded Harlan (who has a foundation) and a group to do NTPsec. An effort to harden NTP, modernize development processes, open the community, and fix the bus factor.

Re:Nature of open source

[Anonymous Coward]

I got news for you; if NTP was non-free, it never would have been used outside of the lab where it was created. There would be 1000 competing network time sync strategies, ...

Oh yeah, good thing there is no fragmentation or duplication of effort or competing incompatible layers in open source.

None at all.

Okay, not that I don't love open source, but you're not making a great argument.

Re:Nature of open source

[Narcocide]

You've never actually tried to use Microsoft products with anything else, have you?

Re:Nature of open source

[FranTaylor]

Oh yeah, good thing there is no fragmentation or duplication of effort or competing incompatible layers in open source.

None at all.

who is talking about open source in general? Nobody. we are talking about NTP implementations. How much fragmentation is there in NTP implementations? Really? Huh?

Okay, not that I don't love open source, but you're not making a great argument.

duh, straw men don't fight back. you put words in their mouth and you argue with those words. haven't you got the basics of bad arguing down yet?

It's software stupid!

[Anonymous Coward]

I wouldn't trust any software as it typically fits a set of requirements that don't fit mine at 3pm on a Tuesday.

I wouldn't even trust my own software--that why we test, test, test then validate.

Isn't the day we all blindly trust s/w is when skynet takes over?

Re: He uses Linux?

[jep77]

Kicks are for Trids!

Re:Nature of open source

[Anonymous Coward]

Oh yeah, good thing there is no fragmentation or duplication of effort or competing incompatible layers in open source.

None at all.

who is talking about open source in general? Nobody.

Actually, we all are talking about open source in general (except for you, I guess). The subject of this thread is "The nature of open source."

So... yeah. Welcome.

Re:Nature of open source

[Anonymous Coward]

You've never actually tried to use Microsoft products with anything else, have you?

Actually I have, the Network Time Protocol functionality that we are talking about here works perfectly fine between Microsoft's Windows products and operating systems such as GNU/Linux and Apple's OSX. As does the SMB/CIFS protocol for file transfer and even at the application level using their Office 365 product with the Firefox browser on GNU/Linux. Now are there examples of things that don't work well? Of course, their .doc document format for example, but I'm not sure why you think that's relevant here. Given the opportunity, would they create their own network time protocol that only worked on Windows and not with anything else? Well they have always had that opportunity and the answer is a resounding "no".

Re:Who needs NTP?

[FatdogHaiku]

Everybody just needs to get their own atomic fountain and we're all good...

No, the drinks from those things go right through me...

Re: Nature of open source

[Anonymous Coward]

Sntp

NTP still stuck with MD5 authentication

[sinij]

NTP still stuck with MD5 authentication, when are they implementing modern crypto?

Re:NTP still stuck with MD5 authentication

[Anonymous Coward]

Depends on when you submit the patch.

Re:NTP still stuck with MD5 authentication

[Bengie]

Even worse is that newer strong crypto hashes are much faster than MD5.

Re:Nature of open source

[Narcocide]

... answer is a resounding "no".

Here's the point where we differ. You actually think this statement has been proven to be anything other than completely farcical, despite failing to show why. You purport to naively assume this to be the case, but its provably factually inaccurate based on numerous prior incidents. Microsoft is NO friend of interoperability, despite the fact they haven't managed to completely quash it in all aspects of their software interactions with foreign systems. In your gleeful fervor to try to show off your sophomoric understanding of tech terminology and attempt to sound intelligent and invalidate my entire argument based on one subjective choice of wording, you've clearly missed the point of my entire argument, which is that Microsoft *certainly* would sabotage NTP, and its probable that this one old man is the only thing cultivating the industry-wide support for NTP that has so far held them back from doing so. And you can bet that his desk chair won't even be cold before they're trying to figure out how to stuff banner ads into the protocol so you have to watch a 30 second clip about erectile dysfunction medication before your clock will sync up to the network time.

Frankly I've satisfied myself that you're a paid shill, so this conversation is over.

Re:Nature of open source

[Anonymous Coward]

Yes, for instance, look at video codecs. Modest royalties on those have stifled adoption of patent- and copyright-encumbered solutions and software for YEARS! You can't even play standard video on most devices with a screen!

It's ludicrous! LUDICROUS, I tells ya!

Re:Nature of open source

[Anonymous Coward]

Here's the point where we differ.

Except that is you just saying a fact is not a fact because you don't want it to be a fact. Microsoft uses the Network Time Protocol and it works across all the major operating systems, this is a fact and no amount of you saying "we differ" is going to change that.

but its provably factually inaccurate based on numerous prior incidents.

No you have it backwards, they use the open source, permissively licensed Network Time Protocol just like everybody else. That's why Windows, GNU/Linux and OSX machines can all synchronize time between them.

which is that Microsoft *certainly* would sabotage NTP

Except the irrefutable fact is that they did not and have not despite always being able to had they wanted to. You clearly need to be educated on permissive open source licensing.

You purport to naively assume this to be the case

I am not assuming anything, Windows syncs time perfectly well from a Linux server and it uses the Network Time Protocol (again permissively licensed) to do so, this is a fact, not an assumption. Does Windows *have* to use NTP? Of course not, but it would be pretty silly if they didn't. So why do you think they wouldn't? And if your thoughts on that are valid then why do they use the NTP instead?

Frankly I've satisfied myself that you're a paid shill, so this conversation is over.

Off you go then, ignore that NTP works just as well with Windows as it does with everything else, ignore that it is permissively licensed, ignore that if they wanted to then Microsoft could have created their own incompatible derivative any time they wanted yet they didn't.

You're obviously upset that despite the *ability* to be as evil as you think they are they didn't capitalize on that opportunity. So the real question is why would *anybody* be so upset about that? It's not at all logical.

If NTP should get hacked...

[Anonymous Coward]

"If NTP should get hacked or for some reason stop functioning, hundreds of thousands of systems would feel the consequences."

Hah! Anyone attend DefCon23 last weekend? I am going to assume somebody did because it was awfully crowded at the old Paris Hotel, Las Vegas.

https://defcon.org/html/defcon-23/dc-23-speakers.html#Selvi

Re:Nature of open source

[exomondo]

There are actually people out there who want features bad enough, that are willing to pay other people to write them. Generally people do not work for free.

Contribution of patches doesn't seem to be a problem. There are plenty of patch submissions but looking at that list of tasks it's hard to see who you would charge for the task of "piecing together new releases" or "accepting patches" or "maintaining the mailing list".

Re: Nature of open source

[Anonymous Coward]

This.

In any event, if you've ever run "w32tm /stripchart" against 50+ domain member servers running on bare metal, you'd know that Microsoft doesn't understand time synchronization, or these days, much of anything.

re: John Postel

[Anonymous Coward]

And that's a shame.

Re:Nature of open source

[icebike]

The software has essentially been DONE, Finished, Complete, for years, decades.
Why does the guy work 100 hour weeks on software that if feature complete and stable?

Re:Nature of open source

[Anonymous Coward]

Yep, thank god there's only one free unix-like operating system out there, with Ubuntu blithely telling the whole world theirs is the best. No, wait, I'm sorry. I meant Darwin, blessed by Jobs himself. But, you're right, it didn't really leave the *lab* until it became free...

Linux Foundation trying to work out who to give to

[Sits]

The Linux Foundation has already given funding to a few open source projects it considers "core" (which includes the original NTP project) and has been trying to assess which other core products are most at risk. From looking at the members page, at least two of the companies you mentioned (Google, Facebook) are part of the Linux Foundation so the giving back has at least started...

Re:Nature of open source

[mirix]

Yeah I'm not sure either. It's a single packet!

The chrony web page has some nice comparisons

[Sits]

The Chrony comparison page compares ntpd, Chrony and OpenNTPd. Another yet to be finished alternative is ntimed (which seems to currently be around 6000 LoC). On some Linux's if you don't care about accuracy or trying to weed out false time you can always use an client such as systemd-timedated.

Re: Nature of open source

[Anonymous Coward]

The argument is curcular now. Why don't you just go fuck hourself?

Re: Nature of open source

[Anonymous Coward]

Well you know, once a sw has been "finished", you never need to touch it again. Ever.

Re:Nature of open source

[Hognoxious]

Does Windows *have* to use NTP? Of course not, but it would be pretty silly if they didn't.

And we all know that silly things never happen.

Re:Accurate timekeeping is for cows.

[Warma]

Can someone explain this joke/meme/thing to me? I see it in pretty much every article.

Re:Accurate timekeeping is for cows.

[RoccamOccam]

Nothing to explain. Just somebody trying to create a meme and failing.

Re:He uses Linux?

[Anonymous Coward]

Can't we have even a hint of fun anymore?

Apparently not! What a bunch of dickheads you people are! Go suck on an exhaust pipe, you fools!

Re:Simple

[jcdr]

The very basic idea of the NTP protocol is to disseminate the time using a hierarchical layers of stratums: https://en.wikipedia.org/wiki/...

So by design all nodes that are not a leaf need to be both client and server. This is common to all hierarchical protocols like for example DNS, and proved as an effective solution to reduce the bandwidth of the upper part of the hierarchy.

If you have a better idea, please publish an RFC for an more effective protocol.

Re:Simple

[ThePhilips]

It can now keep your clock within 10 milliseconds between syncs. Still not as good as the official NTP.

Depends on your perspective.

To me it is: 10ms with the OpenNTPd vs seconds if not minutes with the official NTPd, which occasionally blankly starts logging some errors or warnings like "oops shit, not syncing anymore".

Official NTPd is capricious as hell. And the documentation is just horrible.

I generally replace it with OpenNTPd which "just works". Because, at the end of the day, I can live probably even with 25ms skew, but the seconds/minutes of official NTPd is just unacceptable.

Re:Nature of open source

[jcdr]

Various operating systems NTP is designed for are evolving so it have to be modified to take advantage of new syscall, libraries, or API.

The protocol itself must be urgently improved to include TAI, leap second table, and timezone database update, because in his current state any precise time computation crossing a possible leap second slot or a timezone change is unreliable for the past (and impossible for the future because of the unpredictable Earth rotation physics).

Re:Nature of open source

[jcdr]

Precise time dissemination over a long period is a hard problem, unless you use TAI that NTP sadly do not provides...
Fact is that humans use a local timezone defined and redefined by each governments on a (almost) spherical planet with a physically unpredictable rotation rate variation.

Re:Nature of open source

[jcdr]

NTP is just a tool to disseminate UTC time. As today international relation so deeply rely on the UTC time, I believe that the best solution would be to find a international solution to finance the support of the tool. In this case, an open source solution will be critical to ensure that the project will not be sink under a Vogon style administrative layer.

Re:Simple

[Anonymous Coward]

Ridiculously stupid statement by someone who has never done anything in their life, including sign op for a Slashdot account. Of course neither have I, but the advantage is that I am not the single most stupidest person in this quadrant of the galaxy.

Re:Nature of open source

[Anonymous Coward]

In fact it was not that long time ago you had to mess with register to use NTP. And I could swear you still have to, but fortunately I am not a Windows, but a Linux sysadmin.

Are there even 100 hours in a week?

[Punto]

I'm not saying I don't appreciate his work, but 100 hours a week doesn't add up. Unless he's counting multiple people? Which would be reasonable, let's find funding for him and some sort of helper/assistant/apprentice.

Re: Are there even 100 hours in a week?

[Anonymous Coward]

You are a complete idiot and moron. Seriously, you are mad because this guy works 100 hours a week and you are worthless. So you try to make it seem impossible to work that many hours. Here is a hint. 24 hours in a day x 7 days is how much? Exactly, it's way more than 100.

Re:Are there even 100 hours in a week?

[ImprovOmega]

There's 168 hours in a week. But 100+ hours of work doesn't leave much time for sleeping, eating, and pooping.

Re:Simple

[BitZtream]

I think you actually just made his point for him, but good job.

Re:Nature of open source

[RabidReindeer]

You have no clue, do you?

You cannot simply send a string "It is not 21 hours, 14 minutes, Coordinated Universal Time" across the Internet and reliably set a clock. Network latencies vary. The NTP service attempts to minimize that by working with multiple time sources and attempting to form a consensus. It will never be totally precise, but it will be better than single-source timing. It's just one possible solution out of potentially thousands, but it's the popular one.

And, like any Internet service, there are Bad Guys out there looking to exploit it. Worse, to minimize overhead, a lot of NTP's work is done via UDP, which means that it's a candidate for DDOS reflection attacks just like DNS is. In fact, I learned about this the hard way recently. Seems that the Red Hat NTP daemons haven't yet been updated to a version that's immune to that particular exploit and as a result I had my entire front-end LAN bombed.

So I think it's important that someone keeps up with things.

Not impressed

[BitZtream]

According to IW, for the last three-and-a-half years, Stenn said he's worked 100-plus hours a week answering emails, accepting patches, rewriting patches to work across multiple operating systems, piecing together new releases, and administering the NTP mailing list.

First off, bullshit. Well, bullshit or he sucks at his job or he doesn't want to do anything BUT his job.

If that was a problem, he could say 'I quit' and he would get help. But he doesn't. And he's not the maintainer of the protocol, just a daemon, arguably not even the best one at this point, especially based on his claims of how much work it takes to keep it going.

This whole thing wreaks of whiney little bitch syndrome.

If he wanted Apple to contribute to his lively hood he should have contracted like any more 60 year old person knows to do. Its not like he hasn't been doing software dev for a few years.

Re:Not impressed

[Anonymous Coward]

News flash: While you seem inclined never to let anything get in the way of Keez Quality Time, some people are actually dedicated to their work, Richard.

Re:Simple

[mburnicki]

Why do you think ntpd provides only seconds or minutes accuracy? This is certainly not true. In a normal local LAN with Linux or *BSD machines you can easily yield sub-millisecond accuracy between real NTP nodes. If you run Windows, though, the accuracy which can be achieved is much worse, which is due to the limited timekeeping capabilities of the windows OS. The trick is not in the format of the network packets but how good an NTP *client* evaluates the packets received back from a server, does statistics to reduce network jitter and outliers, adjusts the local system time, and compensates the clock drift of the local machine which varies with ambient temperature, system load, etc.

Re:Simple

[mburnicki]

It's not just a "Linux client". The code base can be used on a wide variety of operating systems, including Linux, *BSD, Solaris, a few other *IX-like systems, and Windows. It also includes lots of code which allows using it as a primary time server which gets the accurate reference time from a directly connected GPS receivers, or similar.

Re:Simple

[mburnicki]

... and guess which has fewer features.

You can write a tiny daemon which just sends and receives NTP network packets, with just a few lines of code. If you're satisfied with the resulting accuracy of your system time then that's fine. This is called SNTP.

Re:Simple

[gustygolf]

In short, you're comparing a simple client that just looks at the time on the wall vs something that's trying to be accurate and can act as the server side of the equation.

OpenNTPD does run as a server. Or have I been syncing my clocks all these years to something non-existent?

listen on address [rtable table-id]
        Specify a local IP address or a hostname the ntpd(8) daemon should listen on.

Re:Simple

[Predius]

I didn't know OpenNTP added server support recently, so new info for me today.

Re:Simple

[ThePhilips]

Why do you think ntpd provides only seconds or minutes accuracy? This is certainly not true.

Oh, you probably haven't had the problem. But for some the problem is relatively commonplace: NTPd after some time starts refusing to sync time. And no matter what you do (restart HW, restart NTPd, sync manually, and restart again everything) that POS would still within hours again start refusing to sync the time.

And when the NTPd refuses to sync time, the skew easily rises into the minutes. On some buggy virtualizations - even more. (I have said hours - because some VMware versions/configurations I have seen seem to have a bug in time implementation, where guest runs faster(?) by about 1 minute per hour. 2 days uptime == 20-30 minutes of time skew.)

In the same configuration under the same conditions, the OpenNTPd runs just fine.

The f***ed up configuration and documentation of the official NTPd was the main reason why people have actually developed the OpenNTPd. If NTPd was perfect, nobody would have even bothered.

Re:Simple

[gustygolf]

Reading comprehension: Because the official NTPD often loses the connection to the servers and bails out.

I've had it happen. I've seen it happen on someone else's server as well. The clock ended up off by well over an hour. Switched to OpenNTPD. Very happy with it.

Re:Simple

[gustygolf]

OpenBSD 3.6 (Nov 2004) changelog:

New functionality:
- A new NTP daemon written from scratch, which ought to fit the needs of most NTP users.

Man page for 3.6

Ergo, OpenNTPD has been a server since its birth. New information indeed.

Re:Nature of open source

[Anonymous Coward]

Right, let's just give it to the UN. Then we don't have to worry about politics interfering with it at all.

Right?!

RIGHT?!

Re: Nature of open source

[Anonymous Coward]

When did Darwin become an OS?

Re:Nature of open source

[jcdr]

I was more thinking about something like the International Telecommunication Union allocating some financial support to the Linux Foundation core infrastructure initiative that already try to make a descent future for the NTP protocol.

Re:Nature of open source

[angel'o'sphere]

"I'd love to see you justify your apparently hyper-naive assumption of how having a mix of entirely separate OS and hardware compatibility issues to contend with would have "nothing to do with" the task of getting network time to properly"

Would much more easy if you pointed out one single issue that is(might be) OS related.

AFAIK sockets work on all OSes the same ...

Re:Nature of open source

[angel'o'sphere]

You have no clue, do you?

Yes, I have. The rest of your post implies: you have not.

Sorry, you lost me in the middle, what is your issue?

Re: Nature of open source

[JHL]

Oh yeah, name one alternative algorithm.

Re:Nature of open source

[Anonymous Coward]

That is if you are on a domain and want to synchronize with an external NTP server rather than the domain controller.

Re:Simple

[Bengie]

NTPd is decent for me. I don't need that kind of accuracy, but it is cool. OpenNTPd would be nice, but no package for PFSense.

Active Peer 67.202.100.50
Delay 10.325ms
Offset 0.487ms
Jitter 0.326ms

Re:Nature of open source

[Zontar The Mindless]

I got a suggestion for you: engage sarcasm detector before posting.

I think you and several other folks just got righteously whoooshed.

Re:He uses Linux?

[Zontar The Mindless]

Indeed. I first heard that joke at summer camp ca. 1972. It wasn't anti-Semetic then, and it isn't anti-Semetic now. Geeez.

Re:Simple

[Zontar The Mindless]

There's yer problem. Using a server as a client is never a good idea.

Proof positive that God provides us with a never-ending supply of idiots.