Re: [PATCH] correcting in-sane ntpd.conf

2019-12-09 Thread Theo de Raadt
Tim Kuijsten wrote: > > Nor do you bring up the traffic to the IP addresses offered by > > pool.ntp.org. That traffic has a pattern easily distinguished as > > "system startup". > > > > What's the difference? There isn't. Yet you brought up only google. > > I can understand why someone would

Re: [PATCH] correcting in-sane ntpd.conf

2019-12-09 Thread Stuart Henderson
On 2019/12/09 13:16, Tim Kuijsten wrote: > > Nor do you bring up the traffic to the IP addresses offered by > > pool.ntp.org. That traffic has a pattern easily distinguished as > > "system startup". > > > > What's the difference? There isn't. Yet you brought up only google. > > I can understan

Re: [PATCH] correcting in-sane ntpd.conf

2019-12-09 Thread Tim Kuijsten
> Nor do you bring up the traffic to the IP addresses offered by > pool.ntp.org. That traffic has a pattern easily distinguished as > "system startup". > > What's the difference? There isn't. Yet you brought up only google. I can understand why someone would be ok with sending some packets to

Re: [PATCH] correcting in-sane ntpd.conf

2019-12-08 Thread Theo de Raadt
>I meant that as a privacy concern that some users might not be aware of. What privacy concern? You don't bring up privacy concerns with DNS lookup of pool.ntp.org. Nor do you bring up the traffic to the IP addresses offered by pool.ntp.org. That traffic has a pattern easily distinguished as "s

Re: [PATCH] correcting in-sane ntpd.conf

2019-12-08 Thread List
I meant that as a privacy concern that some users might not be aware of. As a way of solving that problem one could suggest and point a finger explicitly on the default ntpd.conf. Reasons ? A privacy concern that most users won't be aware of. I might have understood you wrong, otto. Please corr

Re: [PATCH] correcting in-sane ntpd.conf

2019-12-08 Thread Otto Moerbeek
On Sun, Dec 08, 2019 at 11:15:55AM +0100, List wrote: > Please excuse that I wasted your time. You're absolutely right. > > The only thing that comes to my mind is that one could add something > like a small notice that tells the new user to maybe alter his ntpd > constraints to a "TLS-Provider"

Re: [PATCH] correcting in-sane ntpd.conf

2019-12-08 Thread List
Please excuse that I wasted your time. You're absolutely right. The only thing that comes to my mind is that one could add something like a small notice that tells the new user to maybe alter his ntpd constraints to a "TLS-Provider" that resides in his time zone. A good place for that could be th

Re: [PATCH] correcting in-sane ntpd.conf

2019-12-05 Thread Theo de Raadt
I guess you don't understand what is going on there. List wrote: > Hello, > > here a diff replacing www.google.com as a default time constraint by > www.openbsd.org. > It is claimed that OpenBSD would have sane and secure defaults. While > www.google.com might be secure it ain't sane from a pr

[PATCH] correcting in-sane ntpd.conf

2019-12-05 Thread List
Hello, here a diff replacing www.google.com as a default time constraint by www.openbsd.org. It is claimed that OpenBSD would have sane and secure defaults. While www.google.com might be secure it ain't sane from a privacy concerned perspective. Therefore the diff. Regards, Stephan Index: etc/