Yes, but often the easiest way to set up a time server is to sync with a time server on the internet (e.g. ntp.pool org). As far as I can tell, a big reason for people to use NTP is that they don't have a reliable atomic clock of their own, so they sync with other people who do.

I hadn't spotted the "restrict ... noquery" mitigation (which luckily I already had in place), but wouldn't servers still be susceptible to spoofed packets from one of the trusted servers?

Really, what's one of those?

If you close all your NTP ports you're not going to be able to sync with a time source on the internet. Once you allow responses to your NTP queries, then you can be spoofed and compromised.

This is a major bug in NTPd, so if you're using it on Linux, you'll want to patch it too (or switch to openNTP which isn't affected). The big problem is that it can be exploited with a single (specially crafted) UDP packet, so it's easy for malicious actors to probe lots of machines with very little overhead.

This is a major bug in NTPd, so if you're using it on Linux, you'll want to patch it too (or switch to openNTP which isn't affected). The big problem is that it can be exploited with a single (specially crafted) UDP packet, so it's easy for malicious actors to probe lots of machines with very little overhead.

You're right, I can see it now. It definitely wasn't there yesterday as I was looking for it to see if it would get submitted.

Yep, it's there now. I see that Apple have quietly released their fix as well.

You don't have to be running a public NTP server to be affected.

The U.S. by the look of things. I think it'd be a bit heavy-handed to call it a proportional response though as Sony is a lot smaller than a country.

You're welcome. I just switched to openNTPD as I mainly use Ubuntu and they don't seem to have patched NTPd yet.

I don't know why you're so bothered about it. If you don't like, you don't have to follow it (I don't). Look at it this way, the "paleo" people are testing if the paleo diet works and after several years we should get some free statistics on whether it makes any difference to health.

But yes, you're right about eating a balanced diet. That's the easiest, healthiest diet we know of for now (or maybe eat Japanese food; they seem to live a long time).

You don't necessarily need that. If we can figure out how to extend our lives by 15 years, then we've got another 15 years to wait for another advancement. Rinse and repeat.

Not quite. Maybe some people think that we should feel bad for going there, but not me (I think human culture is based on sharing whether allowed or not).

off-topic rant, but why are submissions about the NTP flaw disappearing? I heard about the latest CERT advisory for NTP and saw that there was a slashdot submission about it, but it later disappeared. I submitted a story earlier today (bored at work), and it's now disappeared from the "submissions" list. Here's the link if you're curious: http://slashdot.org/submission...