7 ms·

Amazon Time Sync is now available over the internet as a public NTP service

90 points by smitty1e 4y ago

mkraft 4y ago
What’s the motivation for this? Telemetry they can monetize?
- moepstar 4y ago
  ...and to add, what would be the motivation to use this (and thus feeding them telemetry data).
  - gtirloni 4y ago
    What telemetry data goes into a NTP request?
    - deleted 4y ago
      [deleted]
  - dementis 4y ago
    It looks to be targeted at large organizations that have very strict ITIL based change control and they have to go through a CAB level approval process for every single change. I've worked in one of those environments before and yeah, the CAB would question the need to have two different configurations to effectively handle the same job. The concept of ITIL is one of those "good on paper" type things but at some places they think its only a starting point and it's like death by meeting.
    - robertlagrant 4y ago
      I don't think it's good on paper any more. Change control should happen in source control with lots of automation keyed off it. Meetings should be designed around that primary principle.
- cheschire 4y ago
  Or taking away telemetry from other providers. If no other devices use this, Amazon devices would.
- 8organicbits 4y ago
  Better default NTP config for Amazon software that usually runs inside AWS but sometimes runs outside? Amazon Corretto, Amazon Linux, etc? This helps Amazon claim that those "run best on AWS", as NTP would be in the same datacenter (I think?) otherwise it looks like they use a regional endpoint[1]. 1. https://globaldnschecker.com/#/A/time.aws.com https://globaldnschecker.com/#/A/time.aws.com
  - Kwpolska 4y ago
    Being slightly closer to a NTP server doesn’t at all warrant saying a service runs best on AWS. Accurate time isn’t going to improve your Linux or Java performance in any way.
    - dementis 4y ago
      Accurate time is critical for ensuring Data accuracy and most apps utilize the system time. There are also a lot of Database functions that require accurate time. If you want to do DB clustering then a good reference time is required and Oracle even went so far as to make a service called "Cluster Time Synchronization Service (CTSS)" that specifically validates the system time configuration. Although why they still only support ntp and not chrony is something I would love to know. What is Data Accuracy, Why it Matters and How Companies Can Ensure They Have Accurate Data.[2020] https://dataladder.com/what-is-data-accuracy/ https://dataladder.com/what-is-data-accuracy/
- donavanm 4y ago
  Id expect its something that customers have asked for and theres ~0 marginal cost to provide it. I can see two aspects for customers; its simplicity & consistency with edge or on prem nodes using the same time source as your cloud infra. Theres a degree of trust and consistency for those same customers to get time from AWS instead of a random pool.ntp provider. Disclaimer: principal at AWS but the above are my sole conjecture/thoughts. I have no involvement or inside knowledge of this service release.
  - xiwenc 4y ago
    So if i started with AWS, and then later decide to add infra from other cloud providers. i must somehow remind myself to use AWS ntp servers. If not be ready for surprises?
stevewatson301 4y ago
What I'd have liked to see is a contribution to the pool.ntp.org project rather than providing this service at their their own domain.
- the_mitsuhiko 4y ago
  Pretty sure they would not be allowed to join the pool because they use leap second smearing.
recuter 4y ago
This means your devices and infrastructure outside of AWS, such as IOT devices and on-premises infrastructure, can synchronize to the same highly available time sources that were previously accessible only from within our data centers. If nothing else they can use it for all the Alexas and Kindles they sell and what not. There's no reason for them not to offer it as a public service, not necessarily nefarious. There's also no real reason for anybody else to use it as far as I can tell.
- deleted 4y ago
  [deleted]
amluto 4y ago
> In the event of a leap second, the Amazon Time Sync service automatically handles this for you by smoothing out the addition, or removal, of the leap second with a 24-hour linear smear from noon to noon UTC. No, wrong! Setting your system clock to use smeared time is legitimate. Doing this across a large fleet is even reasonable. But this is a policy decision, and it is not UTC. If a fleet wants shaded time, it should be explicit in the protocol or current configuration. Smearing time by having a server that claims to be NTP doing the smearing is simply a lie, and will confuse clients who expect the server to tell the actual time. Even chrony’s leapsecmode=slew option expects the upstream server to report the leap second. Last time there was a leap second, some smeared servers got into the NTP pool, and the result was a mess.
- vbezhenar 4y ago
  NTP protocol contains leap indicator. So I'd expect that chrony would not do anything if AWS NTP server would do smoothing out and not set that leap indicator.
  - amluto 4y ago
    Chrony would inherit AWS’s skew, which may or may not match chrony’s skew. (But maybe incorrectly because chrony does not expect the length of a second to suddenly change by about 11 ppm.) Chrony configured to not skew will obviously skew anyway.
- eternityforest 4y ago
  I wish UTC would just standardize smears. Computers should use perfect unsmeared clocks, translation for humans can just smear with a polynomial predictor that updates every few years. If you miss an update you get gracefully degraded accuracy, no jumps anywhere m
- the_mitsuhiko 4y ago
  These servers are not in the NTP pool so that concern does not apply. I'm pretty sure most cloud providers use smearing at the NTP level.
deleted 4y ago
[deleted]
dementis 4y ago
Here is a bit of a comparison with these three NTP servers in a /etc/chrony.conf pool time.aws.com iburst pool 1.amazon.pool.ntp.org iburst pool time.nist.gov iburst # chronyc sourcestats Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ============================================================================== ec2-54-86-189-11.compute> 4 3 7 -1128.596 60538.254 -17ms 9310us ec2-18-212-174-188.compu> 4 3 7 -3475.306 40696.289 -32ms 7334us ec2-54-224-100-122.compu> 4 3 7 -2748.130 71563.352 -26ms 11ms ec2-3-80-167-198.compute> 4 3 7 +827.953 78440.828 +1398us 12ms 38.229.57.9 4 4 7 +744.719 67529.711 +117us 9384us time.cloudflare.com 4 3 7 +957.450 44361.117 +3899us 6424us 3dhomejoe.com 4 3 9 -958.576 43000.809 -14ms 7052us shed.galexander.org 4 4 7 -4034.244 62138.637 -36ms 10ms time-a-b.nist.gov 4 4 7 +1475.911 50544.457 +9056us 5773us # chronyc sources MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- ec2-54-86-189-11.compute> 4 6 17 19 -5776us[-5776us] +/- 76ms ^- ec2-18-212-174-188.compu> 4 6 17 20 -22ms[ -22ms] +/- 57ms ^- ec2-54-224-100-122.compu> 4 6 17 21 -1057us[-1057us] +/- 77ms ^- ec2-3-80-167-198.compute> 4 6 17 21 +2093us[+2093us] +/- 57ms ^- 38.229.57.9 2 6 17 21 -769us[ -769us] +/- 185ms ^\* time.cloudflare.com 3 6 17 22 -2043us[+3354us] +/- 34ms ^+ 3dhomejoe.com 2 6 33 19 -23ms[ -23ms] +/- 102ms ^- shed.galexander.org 3 6 17 20 -32ms[ -32ms] +/- 114ms ^- time-a-b.nist.gov 1 6 17 21 +10ms[ +10ms] +/- 55ms And for comparison pool pool.ntp.org iburst pool time.nist.gov iburst # chronyc sourcestats Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ============================================================================== time.cloudflare.com 4 3 6 +1363.306 27212.342 +8424us 3911us time100.stupi.se 4 4 8 -1051.634 11864.409 -12ms 2419us ntp2.flashdance.cx 4 3 7 +183.591 78497.898 -1031us 9048us time.cloudflare.com 4 4 7 +566.874 56659.176 +1998us 8584us time-e-b.nist.gov 4 3 6 -5.327 7264.481 +710us 988us # chronyc sources MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^+ time.cloudflare.com 3 6 17 11 -1590us[-2743us] +/- 66ms ^- time100.stupi.se 1 6 17 10 -5597us[-5597us] +/- 116ms ^\* ntp2.flashdance.cx 2 6 17 10 -31ms[ -32ms] +/- 168ms ^- time.cloudflare.com 3 6 17 10 -17ms[ -17ms] +/- 98ms ^+ time-e-b.nist.gov 1 6 17 11 +504us[ -649us] +/- 56ms I'll stick with a config that queries Stratum 1 time server vs only Stratum 4 servers. \\EDIT: Formatting
nicolinox 4y ago
https://developers.google.com/time https://developers.google.com/time
- dementis 4y ago
  If you don't mind dealing with leap-smeared time then time.google.com is certainly better than the AWS or Amazon NTP server pools just based on the fact that Google's NTP server pool provide Stratum 1.
Jamie9912 4y ago
Can't ping time.aws.com. When I mtr it, it's over 60 milliseconds away, I think i'll stick to time.cloudflare.com which pings in 5 milliseconds
- rswail 4y ago
  How is ping latency a measure of time accuracy?
  - sgtnoodle 4y ago
    It's a bound on inaccuracy from assumptions made about communication delays? I believe a protocol like NTP assumes delays are symmetric, and uses half the round trip time. There's no guarantee that delays are symmetric or repeatable, though.
kseistrup 4y ago
No IPv6?
jwsteigerwalt 4y ago
This is really starting to hint of a James Bond/Superman plot. The billionaire villain gently takes control of the worlds timekeeping systems then covertly or overtly started making changes for their own benefit…
Uptrenda 4y ago
Anyone know if there's a more accurate alternative to NTP that doesn't require specialized hardware?
- zie 4y ago
  If you need more accuracy than NTP by itself can give you, then you have specialized needs and you need to understand those needs very well, as no general solution is likely to work for you. that said, there is a protocol for it, PTP: https://en.wikipedia.org/wiki/Precision_Time_Protocol https://en.wikipedia.org/wiki/Precision_Time_Protocol
  - mlyle 4y ago
    PTP and NTP are about the same without hardware support. With hardware support, and without any thought or tuning-- you probably get your machines synchronized 2 orders of magnitude closer. (From sub-millisecond to a few microseconds). And, of course, PTP can do much better than this.
    - zie 4y ago
      I agree with everything you said. Most problem domains probably have no need for more than what NTP can deliver. Regardless, if NTP alone can't solve your time problems, then you need to really understand what your actual problem is, as there is no guarantee that PTP can solve it either.
      - mlyle 4y ago
        > Regardless, if NTP alone can't solve your time problems, then you need to really understand what your actual problem is, as there is no guarantee that PTP can solve it either. Yah... on the other hand, there's a whole lot of applications where precision is a nice-to-have but not a necessity--- e.g. better ordering events between multiple machines without vector clocks, etc, when we're troubleshooting.
infinet 4y ago
> a global fleet of redundant satellite-connected and atomic reference clocks What does it mean? Is Amazon operating atomic clock or using GPS?

90 points by smitty1e 4y ago

mkraft 4y ago

What’s the motivation for this? Telemetry they can monetize?

moepstar 4y ago
...and to add, what would be the motivation to use this (and thus feeding them telemetry data).
- gtirloni 4y ago
  What telemetry data goes into a NTP request?
  - deleted 4y ago
    [deleted]
- dementis 4y ago
  It looks to be targeted at large organizations that have very strict ITIL based change control and they have to go through a CAB level approval process for every single change. I've worked in one of those environments before and yeah, the CAB would question the need to have two different configurations to effectively handle the same job. The concept of ITIL is one of those "good on paper" type things but at some places they think its only a starting point and it's like death by meeting.
  - robertlagrant 4y ago
    I don't think it's good on paper any more. Change control should happen in source control with lots of automation keyed off it. Meetings should be designed around that primary principle.
cheschire 4y ago
Or taking away telemetry from other providers. If no other devices use this, Amazon devices would.
8organicbits 4y ago
Better default NTP config for Amazon software that usually runs inside AWS but sometimes runs outside? Amazon Corretto, Amazon Linux, etc? This helps Amazon claim that those "run best on AWS", as NTP would be in the same datacenter (I think?) otherwise it looks like they use a regional endpoint[1]. 1. https://globaldnschecker.com/#/A/time.aws.com https://globaldnschecker.com/#/A/time.aws.com
- Kwpolska 4y ago
  Being slightly closer to a NTP server doesn’t at all warrant saying a service runs best on AWS. Accurate time isn’t going to improve your Linux or Java performance in any way.
  - dementis 4y ago
    Accurate time is critical for ensuring Data accuracy and most apps utilize the system time. There are also a lot of Database functions that require accurate time. If you want to do DB clustering then a good reference time is required and Oracle even went so far as to make a service called "Cluster Time Synchronization Service (CTSS)" that specifically validates the system time configuration. Although why they still only support ntp and not chrony is something I would love to know. What is Data Accuracy, Why it Matters and How Companies Can Ensure They Have Accurate Data.[2020] https://dataladder.com/what-is-data-accuracy/ https://dataladder.com/what-is-data-accuracy/
donavanm 4y ago
Id expect its something that customers have asked for and theres ~0 marginal cost to provide it. I can see two aspects for customers; its simplicity & consistency with edge or on prem nodes using the same time source as your cloud infra. Theres a degree of trust and consistency for those same customers to get time from AWS instead of a random pool.ntp provider. Disclaimer: principal at AWS but the above are my sole conjecture/thoughts. I have no involvement or inside knowledge of this service release.
- xiwenc 4y ago
  So if i started with AWS, and then later decide to add infra from other cloud providers. i must somehow remind myself to use AWS ntp servers. If not be ready for surprises?

stevewatson301 4y ago

What I'd have liked to see is a contribution to the pool.ntp.org project rather than providing this service at their their own domain.

the_mitsuhiko 4y ago
Pretty sure they would not be allowed to join the pool because they use leap second smearing.

recuter 4y ago

This means your devices and infrastructure outside of AWS, such as IOT devices and on-premises infrastructure, can synchronize to the same highly available time sources that were previously accessible only from within our data centers. If nothing else they can use it for all the Alexas and Kindles they sell and what not. There's no reason for them not to offer it as a public service, not necessarily nefarious. There's also no real reason for anybody else to use it as far as I can tell.

deleted 4y ago
[deleted]

amluto 4y ago

> In the event of a leap second, the Amazon Time Sync service automatically handles this for you by smoothing out the addition, or removal, of the leap second with a 24-hour linear smear from noon to noon UTC. No, wrong! Setting your system clock to use smeared time is legitimate. Doing this across a large fleet is even reasonable. But this is a policy decision, and it is not UTC. If a fleet wants shaded time, it should be explicit in the protocol or current configuration. Smearing time by having a server that claims to be NTP doing the smearing is simply a lie, and will confuse clients who expect the server to tell the actual time. Even chrony’s leapsecmode=slew option expects the upstream server to report the leap second. Last time there was a leap second, some smeared servers got into the NTP pool, and the result was a mess.

vbezhenar 4y ago
NTP protocol contains leap indicator. So I'd expect that chrony would not do anything if AWS NTP server would do smoothing out and not set that leap indicator.
- amluto 4y ago
  Chrony would inherit AWS’s skew, which may or may not match chrony’s skew. (But maybe incorrectly because chrony does not expect the length of a second to suddenly change by about 11 ppm.) Chrony configured to not skew will obviously skew anyway.
eternityforest 4y ago
I wish UTC would just standardize smears. Computers should use perfect unsmeared clocks, translation for humans can just smear with a polynomial predictor that updates every few years. If you miss an update you get gracefully degraded accuracy, no jumps anywhere m
the_mitsuhiko 4y ago
These servers are not in the NTP pool so that concern does not apply. I'm pretty sure most cloud providers use smearing at the NTP level.

deleted 4y ago

[deleted]

dementis 4y ago

Here is a bit of a comparison with these three NTP servers in a /etc/chrony.conf pool time.aws.com iburst pool 1.amazon.pool.ntp.org iburst pool time.nist.gov iburst # chronyc sourcestats Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ============================================================================== ec2-54-86-189-11.compute> 4 3 7 -1128.596 60538.254 -17ms 9310us ec2-18-212-174-188.compu> 4 3 7 -3475.306 40696.289 -32ms 7334us ec2-54-224-100-122.compu> 4 3 7 -2748.130 71563.352 -26ms 11ms ec2-3-80-167-198.compute> 4 3 7 +827.953 78440.828 +1398us 12ms 38.229.57.9 4 4 7 +744.719 67529.711 +117us 9384us time.cloudflare.com 4 3 7 +957.450 44361.117 +3899us 6424us 3dhomejoe.com 4 3 9 -958.576 43000.809 -14ms 7052us shed.galexander.org 4 4 7 -4034.244 62138.637 -36ms 10ms time-a-b.nist.gov 4 4 7 +1475.911 50544.457 +9056us 5773us # chronyc sources MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- ec2-54-86-189-11.compute> 4 6 17 19 -5776us[-5776us] +/- 76ms ^- ec2-18-212-174-188.compu> 4 6 17 20 -22ms[ -22ms] +/- 57ms ^- ec2-54-224-100-122.compu> 4 6 17 21 -1057us[-1057us] +/- 77ms ^- ec2-3-80-167-198.compute> 4 6 17 21 +2093us[+2093us] +/- 57ms ^- 38.229.57.9 2 6 17 21 -769us[ -769us] +/- 185ms ^\* time.cloudflare.com 3 6 17 22 -2043us[+3354us] +/- 34ms ^+ 3dhomejoe.com 2 6 33 19 -23ms[ -23ms] +/- 102ms ^- shed.galexander.org 3 6 17 20 -32ms[ -32ms] +/- 114ms ^- time-a-b.nist.gov 1 6 17 21 +10ms[ +10ms] +/- 55ms And for comparison pool pool.ntp.org iburst pool time.nist.gov iburst # chronyc sourcestats Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ============================================================================== time.cloudflare.com 4 3 6 +1363.306 27212.342 +8424us 3911us time100.stupi.se 4 4 8 -1051.634 11864.409 -12ms 2419us ntp2.flashdance.cx 4 3 7 +183.591 78497.898 -1031us 9048us time.cloudflare.com 4 4 7 +566.874 56659.176 +1998us 8584us time-e-b.nist.gov 4 3 6 -5.327 7264.481 +710us 988us # chronyc sources MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^+ time.cloudflare.com 3 6 17 11 -1590us[-2743us] +/- 66ms ^- time100.stupi.se 1 6 17 10 -5597us[-5597us] +/- 116ms ^\* ntp2.flashdance.cx 2 6 17 10 -31ms[ -32ms] +/- 168ms ^- time.cloudflare.com 3 6 17 10 -17ms[ -17ms] +/- 98ms ^+ time-e-b.nist.gov 1 6 17 11 +504us[ -649us] +/- 56ms I'll stick with a config that queries Stratum 1 time server vs only Stratum 4 servers. \\EDIT: Formatting

nicolinox 4y ago

https://developers.google.com/time https://developers.google.com/time

dementis 4y ago
If you don't mind dealing with leap-smeared time then time.google.com is certainly better than the AWS or Amazon NTP server pools just based on the fact that Google's NTP server pool provide Stratum 1.

Jamie9912 4y ago

Can't ping time.aws.com. When I mtr it, it's over 60 milliseconds away, I think i'll stick to time.cloudflare.com which pings in 5 milliseconds

rswail 4y ago
How is ping latency a measure of time accuracy?
- sgtnoodle 4y ago
  It's a bound on inaccuracy from assumptions made about communication delays? I believe a protocol like NTP assumes delays are symmetric, and uses half the round trip time. There's no guarantee that delays are symmetric or repeatable, though.

kseistrup 4y ago

No IPv6?

jwsteigerwalt 4y ago

This is really starting to hint of a James Bond/Superman plot. The billionaire villain gently takes control of the worlds timekeeping systems then covertly or overtly started making changes for their own benefit…

Uptrenda 4y ago

Anyone know if there's a more accurate alternative to NTP that doesn't require specialized hardware?

zie 4y ago
If you need more accuracy than NTP by itself can give you, then you have specialized needs and you need to understand those needs very well, as no general solution is likely to work for you. that said, there is a protocol for it, PTP: https://en.wikipedia.org/wiki/Precision_Time_Protocol https://en.wikipedia.org/wiki/Precision_Time_Protocol
- mlyle 4y ago
  PTP and NTP are about the same without hardware support. With hardware support, and without any thought or tuning-- you probably get your machines synchronized 2 orders of magnitude closer. (From sub-millisecond to a few microseconds). And, of course, PTP can do much better than this.
  - zie 4y ago
    I agree with everything you said. Most problem domains probably have no need for more than what NTP can deliver. Regardless, if NTP alone can't solve your time problems, then you need to really understand what your actual problem is, as there is no guarantee that PTP can solve it either.
    - mlyle 4y ago
      > Regardless, if NTP alone can't solve your time problems, then you need to really understand what your actual problem is, as there is no guarantee that PTP can solve it either. Yah... on the other hand, there's a whole lot of applications where precision is a nice-to-have but not a necessity--- e.g. better ordering events between multiple machines without vector clocks, etc, when we're troubleshooting.

infinet 4y ago

> a global fleet of redundant satellite-connected and atomic reference clocks What does it mean? Is Amazon operating atomic clock or using GPS?