6 ms·

For whatever reason, ntppool.org is blocked at my work. And of course, you don't get the page that states why when the website is served via https. Not that I

For whatever reason, ntppool.org is blocked at my work. And of course, you don't get the page that states why when the website is served via https. Not that I need to see the page to know it was either blocked for "hacking" or "entertainment", and I'm guessing it's not entertainment. Edit: This probably explains why our clocks have been off by 45 minutes since Monday. I guess it will be entertaining to see how long it takes for IT to figure this one out.

ryanlol 10y ago
Gambling would be my guess.
Twirrim 10y ago
> I guess it will be entertaining to see how long it takes for IT to figure this one out. Why not just tell them. What have you got to lose? Hell, blame your charitable spirit on the holiday season if you must.
- Declanomous 10y ago
  I got told off for diagnosing issues in the past. The IT director is a megalomaniac and interprets it as a challenge to his power. The only time I offer suggestions now is when one of his employees specifically asks me for help. Edit: I realize "got told off" didn't really capture what happened. I came in early one day and noticed we were having a dns issue. I manually refreshed my DNS cache and it started to work. I sent him an email to let him know that the DNS cache was expired. He told me I was out of line and complained to HR. I had to go meet with HR, which was pointless since they think he is on a power trip as well. Anyways he added a line to the IT policy that specifically prohibits "performing a diagnosis on the network or any of IT managed systems."
  - leesalminen 10y ago
    I encountered a similar IT manager in high school. I kept telling him that netsend wasn't locked down and that any user could run a .bat. He told me I was wrong. So, I wrote a .bat with a netsend command and emailed it to all staff. Multiple staff clicked on the attachment. Once they figured out it was me, they made me start a computer club with the IT manager as the supervisor of the club. First order of business was locking down .bat execution.
    - andruby 10y ago
      > Once they figured out it was me, they made me start a computer club with the IT manager as the supervisor of the club. First order of business was locking down .bat execution. That seems like a great way to handle this situation. Some ignorant other schools might have kicked you to the curb because you were spreading "malware".
    - SomeStupidPoint 10y ago
      Im endlessly glad that my high school was extremely tolerant of us exploring the system and messing with things as long as we didn't try to cause harm (eg, deleting one file is okay, trashing a whole network drive is not) and reported what we found to the school IT manager. Most of us ended up as techs for the school and district as a student job. Several of those students went on to be whitehats. (Who knows where careers would've gone if they'd been discouraged and come to view the system as the enemy.) They also were way cooler than they had to be about the several times we took down the network or broke the porn filters, or the time we port-scanned a district tech's machine, or had a whole collection of malware on the network drive, or.... I just worry about how students like me would fare in schools these days.
      - JChase2 10y ago
        Me and my buddy in like 2010 ended up being questioned by police, then he caught some charges. No fun. All we did was spoof some emails.
        deleted 10y ago
        [deleted]
    - TeMPOraL 10y ago
      In secondary school I discovered Windows Registry - in particular, the LegalNoticeCaption and LegalNoticeText keys, which let you set a pre-login information dialog. I left a funny message on a computer in the school lab, saying something to the tune of "What a shame it isn't Linux". Two hours later, I faced an angry teacher (who was also a math teacher and the lead teacher for our class). She said something about the next person after me freaking out that "the computer has viruses". Got a bad note for behaviour, spot-check of math homework leading to three F grades, and she also tried to take away my notebook with notes about Windows Registry -.-
  - wjnc 10y ago
    What kind of firm are you in (and perhaps more important: country/culture)? I've actively been a friendly pita wherever I worked and always found people to help search for answers, even if the question was not really in the line of work. Have a discussion related to tax and payrolling going on right now. Couldn't make sense of company policy even when reading / quoting the law (ianal). Still the surroundings stay friendly (or I'm in massive bubble). Getting into trouble for having a (truthful) opinion, sounds like a showstopper to me. Just don't email the big shot CEO if you haven't got your story straight, that would be my perferred level of openness.
    - HCIdivision17 10y ago
      I really like the term "friendly pita". When people complain about tech support being unhelpful, I've often found the opposite. Be genuinely friendly and relentless and I've found even incompentent people will fix things. Which I also genuinely appreciate. Sincerity helps, both as a shield and as a way to diffuse the inevitable frustration that comes from troubleshooting tech. Of course, I've got a strong force of will, too, so I tend to mix poorly with charlatains like the grandfather's post. I really feel for the souls who have to work under that jerk.
    - Declanomous 10y ago
      Non-profit foundation. I'm definitely a friendly PITA. Most of my coworkers get it, though some definitely think that I'm just creating more work for myself. It's really only the IT director who is so defensive, and unfortunately he has the power to back it up. HR goes out of their way to find answers to questions, and my immediate coworkers are really driven.
  - deleted 10y ago
    [deleted]
  - twic 10y ago
    Have you thought about getting a new job, for someone who is not a nutcase?
    - Declanomous 10y ago
      Currently looking. I finally came to my last straw recently. A coworker sent me an email because some data I was in charge of adding to the system was missing. I looked, and somehow data in our database had gone missing. I use the data to add information to another database, and that database had the information in it. So somehow he managed to lose information in SQL Server. A few weeks later, my boss brought me in to his office because about 25k rows had incorrect information. I went to check my notes, and all of my notes from a period of 10 days were missing. I had been creating a changed file log (because files have been lost in the past), and I could see I had created notes during those dates, but they didn't exist anywhere. The only evidence I had done my job at all during that time were the emails I sent to other people. (Thankfully Microsoft hosts these, so the IT director can't mess it up.) I had sent somebody an email that basically said "I found error [x], but I fixed it." For a little while I was questioning whether I was insane. I mean, I would never have believed it was possible for data that you've added to an ACID database to just disappear. If you can't trust ACID principles, what can you trust?
      - koolba 10y ago
        I've seen this happen as well. Data "mysteriously" reverted and it turned out to be an unrequested database restore. They reverted to a recent backup but didn't mention it to anybody so a few days of data was missing.
        Declanomous 10y ago
        That is definitely what happened. One manager found out about this and called him and ended up verbally tearing in to him for like an hour. She is really task-oriented and gets really frustrated with how often I want to change things just to see what happens. It felt really good to hear her step up to defend me, because she would only do that for someone who she really respects.
  - setq 10y ago
    This sort of stuff fucks me off. I got into trouble at university when I was running a CAD session on X (Cadence VLSI design FTW, not). Some asshat had telnetted in and was trying to brute force root because it was a faster machine than the crappy sun4's dotted around. It was spewing all over the framebuffer. So I logged into another box and sent him an email saying pack it in and that I was trying to work and that I'd report him for AUP violation to the Sysops. He complained (?!!!) and the next thing I was in front of a tutor getting a bollocking for it. No explanation was allowed to be returned or appealed, permanent black mark on my record. And that's when I learned about university politics, gave them the fat middle finger and got a job and left a massive 11 page long diatribe about the charlatans at the place.
    - hood_syntax 10y ago
      Wow, I don't even know what to say. If it gives you any consolation I probably need to get my blood pressure checked after reading that.
      - setq 10y ago
        It took me about ten years to calm down :)
    - Declanomous 10y ago
      I sent a complaint to my boss and HR about IT recently that was around 30,000 words. It was basically 500 words describing the level of incompetence of the IT director, the remaining 29,000 words were just supporting evidence. I'd say it was a massive waste of time, but the IT director has basically made his expertise unassailable, and the only higher authority he recognizes is Microsoft. I basically went through all my tickets and emails, took IT directors claims, read the MSDN articles on the topic, and pointed out all of the places where what he said was not only wrong, but grossly wrong. Things like "sometimes databases lose data." That's funny, cause I'm sure the team that built SQL Server 2012 would have something to say about that. Why don't we look at the documentation on ACID principles. I've come to expect the IT director to be a moron at this point, and I had been trying to roll with the punches. However, my work has been going missing, and I got in trouble for it. He denied losing it, then he blamed the database for his incompetence. I was so angry I was awake for 3 days straight cross referencing everything. The lost data wouldn't have even been a problem if he had just told me within a day or two. I only find out it's missing when we try finding it weeks or months later. Then I have to waste my time doing a forensic investigation in to the scope of the problem. The most annoying this is that the last person in this role never had any of these issues because nobody ever audited our data. I have managed to instill the idea that data can be 100% correct, and we should always be checking our data to make sure it's right. So now I get blamed anytime information is missing or incongruous.
  - metaphorm 10y ago
    where do you work, and more importantly, why do you still work there?
    - Declanomous 10y ago
      I work in non-profit fundraising. I'm currently looking for a role, but I've worked here for 3 years because I have been able to basically do whatever I want. I'm a combination of analyst, data scientist, and marketer. I'm in charge of our appeals, from strategy all the way to the money coming back in house. We have over half a million constituents. It's really great if you are interested in testing. I've sent out mailings where I'm testing 10 or 11 different factors. I've tested basically everything: the size of the font, the weight of the letterhead, the format of the coupon, how the letter is mailed, the dimensions of the envelope, the structure of the ask, etc. Even with the added expense of testing, I've decreased our cost to raise a dollar by over 20 cents. On top of that, I've automated all sorts of processes. At this point, I think my processes save about a man-month per month. So, I have a lot to feel good about, but I'm really being limited on the technology side of things at this point. Biggest barrier is that I haven't quite decided what I want my next step to be at this point. I'm afraid I'll end up with a job with a much narrower focus and get bored.
      - lincolnq 10y ago
        If you're looking for a role, you might want to put contact info in your profile. I certainly looked :)
        Declanomous 10y ago
        Good call. I thought it was possible to message me as long as the email field was filled in. I hadn't put my email in the description because it's my actual name at gmail. I've added it now.
      - metaphorm 10y ago
        you've got a great skillset. I think you could find a similar role at another company where you weren't being limited by a shitty IT department and internal politics.
  - icameron 10y ago
    If a cached DNS record expired it would not be a problem. If a bad or old record was cached before TTL, clearing your cache works to update it. Maybe ITs ego didn't like your terminology of DNS cache being expired, and telling them theirs is- by definition expired records get looked up again because they no longer exist locally. As former IT it was mildly irritating to get unsolicited advice, But still it sounds like a redicilous over reaction on ITs part. I'm assuming you didn't actually clear a local IT managed server's local DNS cache.
    - Declanomous 10y ago
      Right, the DNS records weren't expired, they were no longer accurate. I'm not sure what the word for that is. The Windows DNS Cache on the local machines was inaccurate. Basically, I couldn't access any websites I had accessed before, but if I tried accessing a new site it worked fine. If I forced a DNS request for a site I had already visited, that site would start working but all the other sites would still be broken. I knew what the problem was because I had run in to that issue a few years back with my own computers. After I updated my DNS, all the Windows computers were having issues, but none of the Linux ones were. That's when I learned that Linux doesn't typically cache DNS records on local machines.
      - xorcist 10y ago
        It's called the resolver cache, and Linux does it too. Most commonly with nscd (use "nscd -i hosts" to clear it, keep in mind this is not specific to DNS requests). In the specific situation of a web browser it's more complicated and you'll find that the web browser caches these things too. If you run Chrome check out chrome://net-internals to get a glimpse of what's going on there.
        Declanomous 10y ago
        Thanks for the tip on net-internals. I think I used a similar feature in Firefox a long time ago, but I've never used this tool in Chrome before. I know Chrome in Linux definitely doesn't cache DNS requests. I believe Linux only keeps the DNS info around until the socket closes, but I don't know the actual implementation. I looked in to the ncsd man page, and it looks like DNS info isn't cached, only open sockets. I know Chrome uses the system DNS cache in Windows, and my understanding was that all browsers in Windows used the system DNS cache. I don't know a lot about how sockets are handled. I thought they were discarded as soon as they were closed, but they could function similarly to a DNS cache. I though a DNS cache stuck around for a lot longer though.
  - discreditable 10y ago
    If you want to sidestep your IT, you can report the site to your filter provider as miscategorized. I'd argue that ntppool.org is not related to hacking. Most of the filter providers have publicly available forms or email addresses for this stuff. There's not a high burden of proof to worry about either.
  - AdamN 10y ago
    You should be looking for another job unless you absolutely love your organization. Just look, you don't need to accept any offers.
  - uremog 10y ago
    So he forbids anyone from considering possibilities of why any IT might be broken? LOL
- Spooky23 10y ago
  I take it you've never dealt with jackass IT types. They are very important people.
unethical_ban 10y ago
I don't know why an org would be blocking NTP. But ideally, IT would run their own NTP service (if the shop is big enough), block NTP to any other org, and sync their server with upstream. Similar to package management, DNS, etc. - self-host it all.
- scurvy 10y ago
  Blocking UDP 123 upstream is a common tactic to avoid participating in NTP DDoS botnets. You're best off running your own NTP infrastructure that's isolated from the public Internet NTP servers if you want stable time sources. Put a CDMA NTP server in two locations, let them sync, and go. You can get cheap EndRun servers on eBay for a few hundred bucks.
  - xorcist 10y ago
    It's tempting to believe telecom has got their act together, but I've found the public Internet NTP infrastructure to be more stable than CDMA/GSM refclocks. YMMV.
    - scurvy 10y ago
      It's why you need multiple sources. The NTP protocol and implementation handles sudden skews from a source. When done properly, CDMA clocks can offer a much more stable source than the public internet, and you can filter out UDP 123 upstream.
- eigenvector 10y ago
  Yes, but when your IT is incompetent they do the first half (block NTP to anywhere outside your network), then don't provide their own time source. Then try to blame users when they complain that their time is always wrong.
  - Declanomous 10y ago
    We do have our own time source. Our NTP source is locked to that server via GPO. NTP requests aren't blocked, because I can still set NTP on things like my printer to other NTP sources and receive updates. I'm willing to bet they don't realize that they've blocked their server. What I want to know is how the drift got to be this bad in a matter of days. It's like whatever computer they are using as the NTP server doesn't have a real-time clock.
evilDagmar 10y ago
Odds are high that someone set up a high-accuracy server on the local network and expects everyone to get their time from that. ...which is not a bad idea if they had the sense to make it known that they've done so. AD and a few other systems get very snippy if the time various servers have isn't in sync, although they don't have much of a problem if every server has the wrong time (within reason).

ryanlol 10y ago

Gambling would be my guess.

Twirrim 10y ago

> I guess it will be entertaining to see how long it takes for IT to figure this one out. Why not just tell them. What have you got to lose? Hell, blame your charitable spirit on the holiday season if you must.

Declanomous 10y ago
I got told off for diagnosing issues in the past. The IT director is a megalomaniac and interprets it as a challenge to his power. The only time I offer suggestions now is when one of his employees specifically asks me for help. Edit: I realize "got told off" didn't really capture what happened. I came in early one day and noticed we were having a dns issue. I manually refreshed my DNS cache and it started to work. I sent him an email to let him know that the DNS cache was expired. He told me I was out of line and complained to HR. I had to go meet with HR, which was pointless since they think he is on a power trip as well. Anyways he added a line to the IT policy that specifically prohibits "performing a diagnosis on the network or any of IT managed systems."
- leesalminen 10y ago
  I encountered a similar IT manager in high school. I kept telling him that netsend wasn't locked down and that any user could run a .bat. He told me I was wrong. So, I wrote a .bat with a netsend command and emailed it to all staff. Multiple staff clicked on the attachment. Once they figured out it was me, they made me start a computer club with the IT manager as the supervisor of the club. First order of business was locking down .bat execution.
  - andruby 10y ago
    > Once they figured out it was me, they made me start a computer club with the IT manager as the supervisor of the club. First order of business was locking down .bat execution. That seems like a great way to handle this situation. Some ignorant other schools might have kicked you to the curb because you were spreading "malware".
  - SomeStupidPoint 10y ago
    Im endlessly glad that my high school was extremely tolerant of us exploring the system and messing with things as long as we didn't try to cause harm (eg, deleting one file is okay, trashing a whole network drive is not) and reported what we found to the school IT manager. Most of us ended up as techs for the school and district as a student job. Several of those students went on to be whitehats. (Who knows where careers would've gone if they'd been discouraged and come to view the system as the enemy.) They also were way cooler than they had to be about the several times we took down the network or broke the porn filters, or the time we port-scanned a district tech's machine, or had a whole collection of malware on the network drive, or.... I just worry about how students like me would fare in schools these days.
    - JChase2 10y ago
      Me and my buddy in like 2010 ended up being questioned by police, then he caught some charges. No fun. All we did was spoof some emails.
      - deleted 10y ago
        [deleted]
  - TeMPOraL 10y ago
    In secondary school I discovered Windows Registry - in particular, the LegalNoticeCaption and LegalNoticeText keys, which let you set a pre-login information dialog. I left a funny message on a computer in the school lab, saying something to the tune of "What a shame it isn't Linux". Two hours later, I faced an angry teacher (who was also a math teacher and the lead teacher for our class). She said something about the next person after me freaking out that "the computer has viruses". Got a bad note for behaviour, spot-check of math homework leading to three F grades, and she also tried to take away my notebook with notes about Windows Registry -.-
- wjnc 10y ago
  What kind of firm are you in (and perhaps more important: country/culture)? I've actively been a friendly pita wherever I worked and always found people to help search for answers, even if the question was not really in the line of work. Have a discussion related to tax and payrolling going on right now. Couldn't make sense of company policy even when reading / quoting the law (ianal). Still the surroundings stay friendly (or I'm in massive bubble). Getting into trouble for having a (truthful) opinion, sounds like a showstopper to me. Just don't email the big shot CEO if you haven't got your story straight, that would be my perferred level of openness.
  - HCIdivision17 10y ago
    I really like the term "friendly pita". When people complain about tech support being unhelpful, I've often found the opposite. Be genuinely friendly and relentless and I've found even incompentent people will fix things. Which I also genuinely appreciate. Sincerity helps, both as a shield and as a way to diffuse the inevitable frustration that comes from troubleshooting tech. Of course, I've got a strong force of will, too, so I tend to mix poorly with charlatains like the grandfather's post. I really feel for the souls who have to work under that jerk.
  - Declanomous 10y ago
    Non-profit foundation. I'm definitely a friendly PITA. Most of my coworkers get it, though some definitely think that I'm just creating more work for myself. It's really only the IT director who is so defensive, and unfortunately he has the power to back it up. HR goes out of their way to find answers to questions, and my immediate coworkers are really driven.
- deleted 10y ago
  [deleted]
- twic 10y ago
  Have you thought about getting a new job, for someone who is not a nutcase?
  - Declanomous 10y ago
    Currently looking. I finally came to my last straw recently. A coworker sent me an email because some data I was in charge of adding to the system was missing. I looked, and somehow data in our database had gone missing. I use the data to add information to another database, and that database had the information in it. So somehow he managed to lose information in SQL Server. A few weeks later, my boss brought me in to his office because about 25k rows had incorrect information. I went to check my notes, and all of my notes from a period of 10 days were missing. I had been creating a changed file log (because files have been lost in the past), and I could see I had created notes during those dates, but they didn't exist anywhere. The only evidence I had done my job at all during that time were the emails I sent to other people. (Thankfully Microsoft hosts these, so the IT director can't mess it up.) I had sent somebody an email that basically said "I found error [x], but I fixed it." For a little while I was questioning whether I was insane. I mean, I would never have believed it was possible for data that you've added to an ACID database to just disappear. If you can't trust ACID principles, what can you trust?
    - koolba 10y ago
      I've seen this happen as well. Data "mysteriously" reverted and it turned out to be an unrequested database restore. They reverted to a recent backup but didn't mention it to anybody so a few days of data was missing.
      - Declanomous 10y ago
        That is definitely what happened. One manager found out about this and called him and ended up verbally tearing in to him for like an hour. She is really task-oriented and gets really frustrated with how often I want to change things just to see what happens. It felt really good to hear her step up to defend me, because she would only do that for someone who she really respects.
- setq 10y ago
  This sort of stuff fucks me off. I got into trouble at university when I was running a CAD session on X (Cadence VLSI design FTW, not). Some asshat had telnetted in and was trying to brute force root because it was a faster machine than the crappy sun4's dotted around. It was spewing all over the framebuffer. So I logged into another box and sent him an email saying pack it in and that I was trying to work and that I'd report him for AUP violation to the Sysops. He complained (?!!!) and the next thing I was in front of a tutor getting a bollocking for it. No explanation was allowed to be returned or appealed, permanent black mark on my record. And that's when I learned about university politics, gave them the fat middle finger and got a job and left a massive 11 page long diatribe about the charlatans at the place.
  - hood_syntax 10y ago
    Wow, I don't even know what to say. If it gives you any consolation I probably need to get my blood pressure checked after reading that.
    - setq 10y ago
      It took me about ten years to calm down :)
  - Declanomous 10y ago
    I sent a complaint to my boss and HR about IT recently that was around 30,000 words. It was basically 500 words describing the level of incompetence of the IT director, the remaining 29,000 words were just supporting evidence. I'd say it was a massive waste of time, but the IT director has basically made his expertise unassailable, and the only higher authority he recognizes is Microsoft. I basically went through all my tickets and emails, took IT directors claims, read the MSDN articles on the topic, and pointed out all of the places where what he said was not only wrong, but grossly wrong. Things like "sometimes databases lose data." That's funny, cause I'm sure the team that built SQL Server 2012 would have something to say about that. Why don't we look at the documentation on ACID principles. I've come to expect the IT director to be a moron at this point, and I had been trying to roll with the punches. However, my work has been going missing, and I got in trouble for it. He denied losing it, then he blamed the database for his incompetence. I was so angry I was awake for 3 days straight cross referencing everything. The lost data wouldn't have even been a problem if he had just told me within a day or two. I only find out it's missing when we try finding it weeks or months later. Then I have to waste my time doing a forensic investigation in to the scope of the problem. The most annoying this is that the last person in this role never had any of these issues because nobody ever audited our data. I have managed to instill the idea that data can be 100% correct, and we should always be checking our data to make sure it's right. So now I get blamed anytime information is missing or incongruous.
- metaphorm 10y ago
  where do you work, and more importantly, why do you still work there?
  - Declanomous 10y ago
    I work in non-profit fundraising. I'm currently looking for a role, but I've worked here for 3 years because I have been able to basically do whatever I want. I'm a combination of analyst, data scientist, and marketer. I'm in charge of our appeals, from strategy all the way to the money coming back in house. We have over half a million constituents. It's really great if you are interested in testing. I've sent out mailings where I'm testing 10 or 11 different factors. I've tested basically everything: the size of the font, the weight of the letterhead, the format of the coupon, how the letter is mailed, the dimensions of the envelope, the structure of the ask, etc. Even with the added expense of testing, I've decreased our cost to raise a dollar by over 20 cents. On top of that, I've automated all sorts of processes. At this point, I think my processes save about a man-month per month. So, I have a lot to feel good about, but I'm really being limited on the technology side of things at this point. Biggest barrier is that I haven't quite decided what I want my next step to be at this point. I'm afraid I'll end up with a job with a much narrower focus and get bored.
    - lincolnq 10y ago
      If you're looking for a role, you might want to put contact info in your profile. I certainly looked :)
      - Declanomous 10y ago
        Good call. I thought it was possible to message me as long as the email field was filled in. I hadn't put my email in the description because it's my actual name at gmail. I've added it now.
    - metaphorm 10y ago
      you've got a great skillset. I think you could find a similar role at another company where you weren't being limited by a shitty IT department and internal politics.
- icameron 10y ago
  If a cached DNS record expired it would not be a problem. If a bad or old record was cached before TTL, clearing your cache works to update it. Maybe ITs ego didn't like your terminology of DNS cache being expired, and telling them theirs is- by definition expired records get looked up again because they no longer exist locally. As former IT it was mildly irritating to get unsolicited advice, But still it sounds like a redicilous over reaction on ITs part. I'm assuming you didn't actually clear a local IT managed server's local DNS cache.
  - Declanomous 10y ago
    Right, the DNS records weren't expired, they were no longer accurate. I'm not sure what the word for that is. The Windows DNS Cache on the local machines was inaccurate. Basically, I couldn't access any websites I had accessed before, but if I tried accessing a new site it worked fine. If I forced a DNS request for a site I had already visited, that site would start working but all the other sites would still be broken. I knew what the problem was because I had run in to that issue a few years back with my own computers. After I updated my DNS, all the Windows computers were having issues, but none of the Linux ones were. That's when I learned that Linux doesn't typically cache DNS records on local machines.
    - xorcist 10y ago
      It's called the resolver cache, and Linux does it too. Most commonly with nscd (use "nscd -i hosts" to clear it, keep in mind this is not specific to DNS requests). In the specific situation of a web browser it's more complicated and you'll find that the web browser caches these things too. If you run Chrome check out chrome://net-internals to get a glimpse of what's going on there.
      - Declanomous 10y ago
        Thanks for the tip on net-internals. I think I used a similar feature in Firefox a long time ago, but I've never used this tool in Chrome before. I know Chrome in Linux definitely doesn't cache DNS requests. I believe Linux only keeps the DNS info around until the socket closes, but I don't know the actual implementation. I looked in to the ncsd man page, and it looks like DNS info isn't cached, only open sockets. I know Chrome uses the system DNS cache in Windows, and my understanding was that all browsers in Windows used the system DNS cache. I don't know a lot about how sockets are handled. I thought they were discarded as soon as they were closed, but they could function similarly to a DNS cache. I though a DNS cache stuck around for a lot longer though.
- discreditable 10y ago
  If you want to sidestep your IT, you can report the site to your filter provider as miscategorized. I'd argue that ntppool.org is not related to hacking. Most of the filter providers have publicly available forms or email addresses for this stuff. There's not a high burden of proof to worry about either.
- AdamN 10y ago
  You should be looking for another job unless you absolutely love your organization. Just look, you don't need to accept any offers.
- uremog 10y ago
  So he forbids anyone from considering possibilities of why any IT might be broken? LOL
Spooky23 10y ago
I take it you've never dealt with jackass IT types. They are very important people.

unethical_ban 10y ago

I don't know why an org would be blocking NTP. But ideally, IT would run their own NTP service (if the shop is big enough), block NTP to any other org, and sync their server with upstream. Similar to package management, DNS, etc. - self-host it all.

scurvy 10y ago
Blocking UDP 123 upstream is a common tactic to avoid participating in NTP DDoS botnets. You're best off running your own NTP infrastructure that's isolated from the public Internet NTP servers if you want stable time sources. Put a CDMA NTP server in two locations, let them sync, and go. You can get cheap EndRun servers on eBay for a few hundred bucks.
- xorcist 10y ago
  It's tempting to believe telecom has got their act together, but I've found the public Internet NTP infrastructure to be more stable than CDMA/GSM refclocks. YMMV.
  - scurvy 10y ago
    It's why you need multiple sources. The NTP protocol and implementation handles sudden skews from a source. When done properly, CDMA clocks can offer a much more stable source than the public internet, and you can filter out UDP 123 upstream.
eigenvector 10y ago
Yes, but when your IT is incompetent they do the first half (block NTP to anywhere outside your network), then don't provide their own time source. Then try to blame users when they complain that their time is always wrong.
- Declanomous 10y ago
  We do have our own time source. Our NTP source is locked to that server via GPO. NTP requests aren't blocked, because I can still set NTP on things like my printer to other NTP sources and receive updates. I'm willing to bet they don't realize that they've blocked their server. What I want to know is how the drift got to be this bad in a matter of days. It's like whatever computer they are using as the NTP server doesn't have a real-time clock.

evilDagmar 10y ago

Odds are high that someone set up a high-accuracy server on the local network and expects everyone to get their time from that. ...which is not a bad idea if they had the sense to make it known that they've done so. AD and a few other systems get very snippy if the time various servers have isn't in sync, although they don't have much of a problem if every server has the wrong time (within reason).