4 ms·
The worst is, computer clocks drift, and ntp's domains are signed, so if your clock drifts enough, you cannot update your time, because dnssec invaliates time s
by b112 4y ago
The worst is, computer clocks drift, and ntp's domains are signed, so if your clock drifts enough, you cannot update your time, because dnssec invaliates time server records.
Good times.
Seen more than one org disable dnnsec, in bind, because of this.
- wahern 4y agoYou would have the same issue with TLS or any other scheme. When OpenNTPD added TLS-authenticated constraints, I immediately began having problems on one of my PCEngines APU with a broken RTC (same model as all my other ones, but clock would always reset when power removed, no matter how many times I changed the battery). I had to disable TLS constraints. Eventually they added a special "trusted" qualifier to NTP server directives for bypassing constraint checking. Authenticated time synchronization faces intrinsic dilemmas no matter the technology.
- EricE 4y agoHmm - my discord client wasn't updating and I suspected it was something with DNS - tried all kinds of things. Turned dnssec off and BAM! discord immediatel updated. Sigh.