3 ms·

I’m pretty sure this way they’ve hardcoded the NTPs is actually against the ToS for use of the NTP pool too. The way a vendor embedding NTP is _meant_ to do so

I’m pretty sure this way they’ve hardcoded the NTPs is actually against the ToS for use of the NTP pool too. The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html https://www.ntppool.org/en/vendors.html On another note, back when I ran a web hosting business we hosted a few NTP servers in the pool. It’s such a simple thing to give back, and worth anyone who can make a stable contribution doing so.

robinpie 20d ago
Yes, they should absolutely be using a vendor zone instead of a CNAME under tesla.com.
jameshilliard 20d ago
> The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html https://www.ntppool.org/en/vendors.html Note that in the past I've had companies writing embedded linux based firmware using ntppool for time sync request their own vendor zones, however a lot of those requests were ignored so it's unclear if that's still expected. In the end they ended up just using the default ntppool domains since they never got their own vendor zones.
- Aurornis 20d ago
  I remember going through the same thing. No response. This was a long time ago, though.
lgeek 20d ago
If you do run an NTP server, please make sure it's not vulnerable to DDoS amplification (monlist, readvar, etc need to be disabled) and apply some rate limiting to make it less useful for reflection attacks. And be proactive about monitoring its traffic volume. If you see high packet rate from a specific IP address or prefix, it's very likely not them abusing your service, but rather you attacking them by responding to spoofed requests.
kelnos 20d ago
> The pool is currently keeping the time of an estimated 5-15 million systems accurate. When was this page last updated? I would expect that number to be in the hundreds of millions these days, perhaps even billions.
- TheDong 20d ago
  To quote from the page: > Do not use the standard pool.ntp.org names as a default configuration in your system Apple's default is time.apple.com, ubuntu has their own pool, android as well, same for windows. All the big linux distros also run their own ntp servers. The ntppool.org stats show about 100k queries per second https://status.ntppool.org/ https://status.ntppool.org/ 100k/s is consistent with on the order of lower 10s of millions of devices, with most checking every 10 or so minutes, and a few misconfigured ones hammering the server at a high frequency. It certainly isn't billions of devices.
  - dxjxjdjsssb 20d ago
    Since when do Linux distros host their own NTP? Having a vendor zone in the pool is not about selecting a set of servers to use, its for mitigating the hard coded server issue. The standard NTP pool gets used (usually).
    - TheDong 20d ago
      > Since when do Linux distros host their own NTP? Amazon Linux uses their own NTP server for EC2 instances (and a large number of distros on AWS use it too). Android, the most popular linux distro in the world, uses Google's NTP servers rather than NTP. ChromeOS, another quite popular linux distro, also uses Google's NTP servers.

robinpie 20d ago

Yes, they should absolutely be using a vendor zone instead of a CNAME under tesla.com.

jameshilliard 20d ago

> The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html https://www.ntppool.org/en/vendors.html Note that in the past I've had companies writing embedded linux based firmware using ntppool for time sync request their own vendor zones, however a lot of those requests were ignored so it's unclear if that's still expected. In the end they ended up just using the default ntppool domains since they never got their own vendor zones.

Aurornis 20d ago
I remember going through the same thing. No response. This was a long time ago, though.

lgeek 20d ago

If you do run an NTP server, please make sure it's not vulnerable to DDoS amplification (monlist, readvar, etc need to be disabled) and apply some rate limiting to make it less useful for reflection attacks. And be proactive about monitoring its traffic volume. If you see high packet rate from a specific IP address or prefix, it's very likely not them abusing your service, but rather you attacking them by responding to spoofed requests.

kelnos 20d ago

> The pool is currently keeping the time of an estimated 5-15 million systems accurate. When was this page last updated? I would expect that number to be in the hundreds of millions these days, perhaps even billions.

TheDong 20d ago
To quote from the page: > Do not use the standard pool.ntp.org names as a default configuration in your system Apple's default is time.apple.com, ubuntu has their own pool, android as well, same for windows. All the big linux distros also run their own ntp servers. The ntppool.org stats show about 100k queries per second https://status.ntppool.org/ https://status.ntppool.org/ 100k/s is consistent with on the order of lower 10s of millions of devices, with most checking every 10 or so minutes, and a few misconfigured ones hammering the server at a high frequency. It certainly isn't billions of devices.
- dxjxjdjsssb 20d ago
  Since when do Linux distros host their own NTP? Having a vendor zone in the pool is not about selecting a set of servers to use, its for mitigating the hard coded server issue. The standard NTP pool gets used (usually).
  - TheDong 20d ago
    > Since when do Linux distros host their own NTP? Amazon Linux uses their own NTP server for EC2 instances (and a large number of distros on AWS use it too). Android, the most popular linux distro in the world, uses Google's NTP servers rather than NTP. ChromeOS, another quite popular linux distro, also uses Google's NTP servers.