7 ms·

I see the strapline of NTPsec on Github is: "ntpsec/ntpsec: The NTP reference implementation, refactored". So is it or isn't it? A few quotes from ESR from he

by scandox 10y ago

I see the strapline of NTPsec on Github is: "ntpsec/ntpsec: The NTP reference implementation, refactored". So is it or isn't it? A few quotes from ESR from here http://esr.ibiblio.org/?p=6881Interesting http://esr.ibiblio.org/?p=6881Interesting > tossing out as many superannuated features as I could > full of port shims for big-iron Unixes from the Late Cretaceous > I do have an an advantage because I’m very bright and can hold more complex state in my head than most people [speaks to attitude :)] > This differs dramatically from the traditional Unix policy of leaving all porting shims back to the year zero in place because you never know when somebody might want to build your code on some remnant dinosaur workstation or minicomputer from the 1980s. > Yet another important thing to do on an expedition like this is to get permission – or give yourself permission, or fscking take permission – to remove obsolete features in order to reduce code volume, complexity, and attack surface. > Then ntpdc was deprecated, but not removed – the NTP Classic team had developed a culture of never breaking backward compatibility with anything. > I shot ntpdc through the head I don't know the facts in the case at all, but I can imagine if you were the existing maintainer, you'd find this language and attitude incredibly difficult to take. And after all if you're not being paid to work on it, why should you swallow your pride?

acqq 10y ago
>> I shot ntpdc through the head ESR is definitely somebody I wouldn't like to even occur near to any project of mine. As Linus once wrote: "Anybody who thinks that developers don't have huge egos probably haven't ever met a software engineer." Some are a some sigma away even from that. I don't want to analyze most of his views(1) and how they reflect his personality traits, except to suggest that those who consider working with somebody first carefully inform themselves, but at least there's one opinion text that he wrote in 2004 that I really liked: http://www.catb.org/~esr/writings/cups-horror.html http://www.catb.org/~esr/writings/cups-horror.html --------- 1) http://www.catb.org/~esr/guns/ http://www.catb.org/~esr/guns/
- _wmd 10y ago
  I'm not sure why you're being downvoted, it seems a fairly straightforward statement to make about ESR. When he pops up on a project mailing list, he tends to cause a lot of noise before (in every case I know of) gently fading out again when he doesn't get his own way. It's especially fun (and painful) to watch strongly consensus-driven projects try to cope with his presence, for example when he turned up on the Subversion dev list. He popped up on python-dev a few days back with one of his archetypical shots across the bow: https://mail.python.org/pipermail/python-dev/2017-February/147391.html https://mail.python.org/pipermail/python-dev/2017-February/1... Literally nothing in that message except ego, and what amounts to a promise to ignite some flame wars in the near future, as if any of that information was worth wasting a few hundred peoples' time to read.
  - philh 10y ago
    It's basically pure insult. It has no semantic content beyond "I wouldn't want to work with ESR, he has a massive ego and he supports gun rights". (Adding a throwaway compliment does not significantly affect this.) The gun rights thing in particular is... if you want to say "I don't like guns and I don't want to work with anyone who supports gun rights", that's up to you. If you want to say "anyone who supports gun rights is probably a bad person to work with", you need to back that up. "I don't want to analyze most of his views(1) and how they reflect his personality traits" is the second one, and does not back it up. (It's hiding behind some ambiguity and hinting, but I think the broad intent is quite clear. Possibly it was intended as closer to: "ESR's position on guns is crazier than simply supporting gun rights, and this makes him probably a bad person to work with". In that case, there are two things that need to be backed up: what specifically does ESR believe that is crazy? There are a lot of links on that page. And why does that make him probably a bad person to work with?)
    - _wmd 10y ago
      I took the parent comment to be someone familiar with ESR's personality, the reference to gun rights was unfortunate, but indeed probably the parent comment intended to create that association. However, parent comment certainly didn't suggest gun rights were the exclusive reason not to want to work with ESR.
masklinn 10y ago
> I see the strapline of NTPsec on Github is: "ntpsec/ntpsec: The NTP reference implementation, refactored". > So is it or isn't it? It's technically correct since they started from the reference implementation then "refactored" it. They're skirting real close to claiming they are the reference NTP implementation but not quite doing that, just leaving the door open for misunderstandings.
- irishsultan 10y ago
  Refactoring shouldn't change functionality.
  - mgbmtl 10y ago
    "today neither NTP nor NTPsec shares code or patches with the other" So I guess it's not the "reference implementation".
- someguydave 10y ago
  The concept that your protocol is defined by a "reference implementation" and not a well-written specification is moronic. Someone should be able to articulate unambiguously (with words) what the NTP protocol is and what it does.
  - unethical_ban 10y ago
    That's how the majority of software on the internet is written, including Python and Ruby for much of their time.
    - gcp 10y ago
      Would people claim that Python and Ruby have "specifications", though?
      - steveklabnik 10y ago
        Ruby at least has an ISO standard; it's not exactly current with today's Ruby, though.
Oxitendwe 10y ago
You don't think removing dead code and needless complexity is a good thing? It seems to me like he's doing a very good and important job, there's no need whatsoever to retain support for systems many decades old at this point.
- eridius 10y ago
  If those systems are still in use, then surely they need an NTP implementation.
  - Oxitendwe 10y ago
    I need a house and a car and food, can I rely on NTP developers for those? Just because someone needs an NTP implementation doesn't mean that the NTP developers need to provide it, especially if providing it is to the detriment of everyone else's security. What do any of us who don't have to run 80's mainframes get out of tethering ourselves to the past?
    - eridius 10y ago
      Why does retaining compatibility with systems that you've always had compatibility with mean reduced security? That seems like a pretty big assumption without any supporting evidence. Normally retaining compatibility with old systems is a pain just because it's extra work, rather than actually hurting the security of the software.
      - PeterisP 10y ago
        If that compatibility is implemented by large quantities of otherwise unnecessary code, then having that code be there increases the potential attack surface and reduces security. Just as obscure, rarely used features - removing them would facilitate security. I don't know much about NTP, but if I would take their claims at face value - "reduction in code of over 2/3 (from 227kLOC to 74kLOC)" is a valuable gain even if means removing compatibility with some less used systems; and "NTPsec was immune to over 50% of NTP Classic vulns BEFORE discovery in the last year" is a realistic consequence of a large reduction in code size/attack surface.

by scandox 10y ago

acqq 10y ago

>> I shot ntpdc through the head ESR is definitely somebody I wouldn't like to even occur near to any project of mine. As Linus once wrote: "Anybody who thinks that developers don't have huge egos probably haven't ever met a software engineer." Some are a some sigma away even from that. I don't want to analyze most of his views(1) and how they reflect his personality traits, except to suggest that those who consider working with somebody first carefully inform themselves, but at least there's one opinion text that he wrote in 2004 that I really liked: http://www.catb.org/~esr/writings/cups-horror.html http://www.catb.org/~esr/writings/cups-horror.html --------- 1) http://www.catb.org/~esr/guns/ http://www.catb.org/~esr/guns/

_wmd 10y ago
I'm not sure why you're being downvoted, it seems a fairly straightforward statement to make about ESR. When he pops up on a project mailing list, he tends to cause a lot of noise before (in every case I know of) gently fading out again when he doesn't get his own way. It's especially fun (and painful) to watch strongly consensus-driven projects try to cope with his presence, for example when he turned up on the Subversion dev list. He popped up on python-dev a few days back with one of his archetypical shots across the bow: https://mail.python.org/pipermail/python-dev/2017-February/147391.html https://mail.python.org/pipermail/python-dev/2017-February/1... Literally nothing in that message except ego, and what amounts to a promise to ignite some flame wars in the near future, as if any of that information was worth wasting a few hundred peoples' time to read.
- philh 10y ago
  It's basically pure insult. It has no semantic content beyond "I wouldn't want to work with ESR, he has a massive ego and he supports gun rights". (Adding a throwaway compliment does not significantly affect this.) The gun rights thing in particular is... if you want to say "I don't like guns and I don't want to work with anyone who supports gun rights", that's up to you. If you want to say "anyone who supports gun rights is probably a bad person to work with", you need to back that up. "I don't want to analyze most of his views(1) and how they reflect his personality traits" is the second one, and does not back it up. (It's hiding behind some ambiguity and hinting, but I think the broad intent is quite clear. Possibly it was intended as closer to: "ESR's position on guns is crazier than simply supporting gun rights, and this makes him probably a bad person to work with". In that case, there are two things that need to be backed up: what specifically does ESR believe that is crazy? There are a lot of links on that page. And why does that make him probably a bad person to work with?)
  - _wmd 10y ago
    I took the parent comment to be someone familiar with ESR's personality, the reference to gun rights was unfortunate, but indeed probably the parent comment intended to create that association. However, parent comment certainly didn't suggest gun rights were the exclusive reason not to want to work with ESR.

masklinn 10y ago

> I see the strapline of NTPsec on Github is: "ntpsec/ntpsec: The NTP reference implementation, refactored". > So is it or isn't it? It's technically correct since they started from the reference implementation then "refactored" it. They're skirting real close to claiming they are the reference NTP implementation but not quite doing that, just leaving the door open for misunderstandings.

irishsultan 10y ago
Refactoring shouldn't change functionality.
- mgbmtl 10y ago
  "today neither NTP nor NTPsec shares code or patches with the other" So I guess it's not the "reference implementation".
someguydave 10y ago
The concept that your protocol is defined by a "reference implementation" and not a well-written specification is moronic. Someone should be able to articulate unambiguously (with words) what the NTP protocol is and what it does.
- unethical_ban 10y ago
  That's how the majority of software on the internet is written, including Python and Ruby for much of their time.
  - gcp 10y ago
    Would people claim that Python and Ruby have "specifications", though?
    - steveklabnik 10y ago
      Ruby at least has an ISO standard; it's not exactly current with today's Ruby, though.

Oxitendwe 10y ago

You don't think removing dead code and needless complexity is a good thing? It seems to me like he's doing a very good and important job, there's no need whatsoever to retain support for systems many decades old at this point.

eridius 10y ago
If those systems are still in use, then surely they need an NTP implementation.
- Oxitendwe 10y ago
  I need a house and a car and food, can I rely on NTP developers for those? Just because someone needs an NTP implementation doesn't mean that the NTP developers need to provide it, especially if providing it is to the detriment of everyone else's security. What do any of us who don't have to run 80's mainframes get out of tethering ourselves to the past?
  - eridius 10y ago
    Why does retaining compatibility with systems that you've always had compatibility with mean reduced security? That seems like a pretty big assumption without any supporting evidence. Normally retaining compatibility with old systems is a pain just because it's extra work, rather than actually hurting the security of the software.
    - PeterisP 10y ago
      If that compatibility is implemented by large quantities of otherwise unnecessary code, then having that code be there increases the potential attack surface and reduces security. Just as obscure, rarely used features - removing them would facilitate security. I don't know much about NTP, but if I would take their claims at face value - "reduction in code of over 2/3 (from 227kLOC to 74kLOC)" is a valuable gain even if means removing compatibility with some less used systems; and "NTPsec was immune to over 50% of NTP Classic vulns BEFORE discovery in the last year" is a realistic consequence of a large reduction in code size/attack surface.