4 ms·

“For many applications, accurate network time isn’t essential: it suffices to be within 10 seconds of real time” I can’t imagine any application where the more

• wmf 7y ago
  IIRC Roughtime is for validating TLS certificates which have lifetimes of hours to months, so 10 seconds doesn't matter.
• wolfgang42 7y ago
  That's for their roughtime servers, which is a different service than the NTP servers they offer on the same page (though it could be clearer that they're distinct). The advantage of roughtime is that it's cryptographically signed and auditable, so you can be confident about using it to check things like TLS cert expirations (for which 10 seconds is plenty accurate).
• ac29 7y ago
  "within 10 seconds of real time, but security is paramount" You cut off the important bit. Roughtime servers sign their responses, so you can be sure you aren't getting a malicious time response (or if you do, you can penalize that server). Per google [0]: "With only two servers, the client can end up with proof that something is wrong, but no idea what the correct time is. But with half a dozen or more independent servers, the client will end up with chain of proof of any server's misbehaviour, signed by several others, and (presumably) enough accurate replies to establish what the correct time is." [0] https://roughtime.googlesource.com/roughtime https://roughtime.googlesource.com/roughtime