3 ms·
The presentation mentioned was where I learned of the project. It sounded very very strange to me. Script kiddies who don't what what NTP does, only that it's g
by xorcist 10y ago
The presentation mentioned was where I learned of the project. It sounded very very strange to me. Script kiddies who don't what what NTP does, only that it's good for DDoSing? What what that about..?
I wasn't surprised to learn that the project one year later was caught up evaluating Rust vs Go. That's great and all, but it's not saving the Internet from "meltdown".
Anyone who needs a modern ntpd and doesn't need the refclock stuff should probably just go with chrony.
- problems 10y ago> Script kiddies who don't what what NTP does, only that it's good for DDoSing? What what that about..? There were several large reflection issues in ntpd in the past few years which led it to become a popular DDoS method. Reflection is the big winner lately. No need for a botnet, just scan UDP services, find ones which reply with large packets or a series of packets and then spoof your IP (easy from many VPS and dedicated server providers) and flood out requests for those large packets. You can get amplification of 100x as much traffic with only a small request and it's quite challenging to trace back to the original source due to the spoofed packets.
- xorcist 10y agoThat much is well known. It's the other part that's questionable.
- feld 10y agoI'll bite. Which large VPS / dedicated server providers don't implement BCP38?
- problems 10y agoI'd rather not name and shame, but suffice to say a quick test with hping shows this is currently working on a number of my servers, some on larger, some on smaller providers. And all it takes is 1. You definitely have to hunt around if this is something you want and the number does seem smaller than I remember it being so many more are probably implementing it since I last checked, but still not all.