Slashdot Mirror
"Father Time" Gets Another Year At NTP From Linux Foundation
dkatana writes: Harlan Stenn, Father Time to some and beleaguered maintainer of the Network Time Protocol (NTP) to others, will stay working for the NTP another year. But there is concern that support will decline as more people believe that NTP works just fine and doesn't need any supervision. NTP is the preeminent time synchronization system for Macs, Windows, and Linux computers and most servers on networks. According to IW, for the last three-and-a-half years, Stenn said he's worked 100-plus hours a week answering emails, accepting patches, rewriting patches to work across multiple operating systems, piecing together new releases, and administering the NTP mailing list. If NTP should get hacked or for some reason stop functioning, hundreds of thousands of systems would feel the consequences. "If that happened, all the critics would say, 'See, you can't trust open source code,'" said Stenn.
Everybody just needs to get their own atomic fountain and we're all good...
Oh how easily this would be solved if NTP was proprietary technology and Father Time could ask a small royalty for every piece of software that uses NTP. I just mean that by making things open source you are intentionally taking the risk that there can be problems with arranging well-rounded funding.
Why pay? Find a kid to do it for free. Silly rabbis.
Nor can you trust closed-source code.
But while "open source makes all bugs shallow" is demonstrably a fallacy, at least you CAN see the source if you need to. (Good luck understanding it, though - says this pretty good C developer who just about shit when he had to look at OpenSSL/SSH code...)
You are all cows. Cows say moo. MOOOOOOOO! MOOOOOOO! Moo cows MOOOOOOO! Moo say the cows. YOU TIME COWS!!
With all due to respect to Harlan Stenn, and working under the assumption that he will choose to continue to maintain NTP for the good of everyone who uses it, the biggest donation that could possibly be given to the NTP project would be to increase its bus factor. Basically, we need at least another small handful of people -- ideally distributed throughout the world -- who have the same level of knowledge and expertise as Harlan in the area of network time, and can thus take his place if, for any reason whatsoever Harlan can't continue to work on the NTP project.
Getting Harlan to continue working on it is a short-term solution, but the sustainable future is to ensure that we have maintainers who can take his place -- ideally, paid ones.
So what we need is for a company like Red Hat or IBM or Microsoft or Canonical to bankroll a developer who has at least strong fundamentals that would enable them to quickly pick up advanced knowledge of network time, and then spend most of their working hours acquiring more knowledge about it so that it can be maintained going forward. This would probably involve a lot of ML posts with Harlan (or reading his previous ones), as well as any other developers/maintainers working on pieces of the code.
If Harlan is absolutely instrumental to the project as it stands now, the solution is to have a backup or two, who ideally are being paid a living wage to ensure the continuity of knowledge and expertise if Harlan willingly or unwillingly stopped contributing.
Projects with a bus factor of 1 that are widely relied upon need to be identified and highlighted every now and again -- not to make a case to shower the developer in money, but to get other developers to work in the same space and increase the bus factor to at least 3.
If he doesn't like it, start a foundation and start transferring rights & control of NTP to the foundation. Instead, he refuses to give up control and complains about the heavy workload and lack of funds. The internet has grown up & out, the era of "Jon Postels" is over.
When we lose "NTP's father time" NTP will simply be merged into systemd. Problem solved! Running Windows or *BSD? Here's a middle finger! Just for you!
How is it that an old tech like NTP with a fixed protocol need so much maintenance? That should have already settled out and just need minor patching for new architectures.
How about we just use OpenNTP?
Well... where is the Bitcoin address for donations?
Poettering and the rest already have a time solution, why keep this old neckbeard around?
they're working "100 hours a week" aren't really doing it. No one works over 15 hours a day every day at one job for 3 1/2 years. Rubbish!
Uh, no. NTP needs to be redesigned so it doesn't use UDP anymore so we can stop worrying about spoofing and amplification/recursion attacks.
Buck Feta. You know what to do.
it's not just NTP that is languishing, perhaps a dozen other open source projects that the Internet depends on, each with one greybeard maintainer, underfunded or neglected entirely, going away soon, lose that institutional knowledge.
C'mon Apple, Google, Facebook, give back a little.
The problem with software is eventually it is finished and you have to move on. Keeping the wheels on should take 100 minutes a week, assuming it is half-way competently written, which I doubt.
an ill wind that blows no good
Every now and then, somebody has to change the soil for the plant to flourish. It's a dirty job, but a necessary one. People typically start to care only when the plant is already dead.
If NTP is a broadly used protocol on the inter-tubes, then maybe it is time to push the ownership onto the IETF. After all, this is a protocol to track the current the local or GMT clock time on internet connected devices.
7 days = 1 week
times 24 hours = 168 hours
Or in other words, he does not work in NTP 68 hours a week = 8.5h a day.
So considering that a person needs half an hour a day for eating, actually I eat longer, some sleep, some time on the toilet, some people even shower - shudder if that is longer than 5 mins - and usually you get dressed sometimes you have to go shopping ...
Well, I assume he is a nerd, sleeping in his bathrobe, so he saves dressing, showers only once a week and gets everything ordinary people shop via mail/internet order ...
Perhaps he should consider to hire an assistant? Or raise funds for one ... sorry: no one is working 100 hours a week.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Not particularly highlighted in the article is that the LF CII is funding a small team of developers with NTP experience to focus on security hardening, development process modernization, and opening the community. There is concern about the bus factor and an attempt is being made to address it.
No critical infrastructure project should ever be so dependent on a single developer.
Let's be clear here - we are talking about one particular software package - albeit a very popular one - and not the underlying protocol (which itself is subject to errata, some of which are still under discussion).
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Ah, well, this is how it always goes.
No private, for-profit entity will happily provide support for maintenance of a non-profit entity that provides a universal service, for example time-synchronization, upon which their lifeblood depends.
OK, so I am past wasting breath. For the uninitiated, just find the Wikipedia article on the "Tragedy of the Commons."
The concept is so simple, so obvious, and so accurate
Read on
Obviously no one has read the article. The Linux Foundation funded Harlan (who has a foundation) and a group to do NTPsec. An effort to harden NTP, modernize development processes, open the community, and fix the bus factor.
I wouldn't trust any software as it typically fits a set of requirements that don't fit mine at 3pm on a Tuesday.
I wouldn't even trust my own software--that why we test, test, test then validate.
Isn't the day we all blindly trust s/w is when skynet takes over?
NTP still stuck with MD5 authentication, when are they implementing modern crypto?
"If NTP should get hacked or for some reason stop functioning, hundreds of thousands of systems would feel the consequences."
Hah! Anyone attend DefCon23 last weekend? I am going to assume somebody did because it was awfully crowded at the old Paris Hotel, Las Vegas.
https://defcon.org/html/defcon-23/dc-23-speakers.html#Selvi
And that's a shame.
The Linux Foundation has already given funding to a few open source projects it considers "core" (which includes the original NTP project) and has been trying to assess which other core products are most at risk. From looking at the members page, at least two of the companies you mentioned (Google, Facebook) are part of the Linux Foundation so the giving back has at least started...
The Chrony comparison page compares ntpd, Chrony and OpenNTPd. Another yet to be finished alternative is ntimed (which seems to currently be around 6000 LoC). On some Linux's if you don't care about accuracy or trying to weed out false time you can always use an client such as systemd-timedated.
I'm not saying I don't appreciate his work, but 100 hours a week doesn't add up. Unless he's counting multiple people? Which would be reasonable, let's find funding for him and some sort of helper/assistant/apprentice.
--
Stay tuned for some shock and awe coming right up after this messages!
According to IW, for the last three-and-a-half years, Stenn said he's worked 100-plus hours a week answering emails, accepting patches, rewriting patches to work across multiple operating systems, piecing together new releases, and administering the NTP mailing list.
First off, bullshit. Well, bullshit or he sucks at his job or he doesn't want to do anything BUT his job.
If that was a problem, he could say 'I quit' and he would get help. But he doesn't. And he's not the maintainer of the protocol, just a daemon, arguably not even the best one at this point, especially based on his claims of how much work it takes to keep it going.
This whole thing wreaks of whiney little bitch syndrome.
If he wanted Apple to contribute to his lively hood he should have contracted like any more 60 year old person knows to do. Its not like he hasn't been doing software dev for a few years.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager