[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Dec 2014 12:50:07 -0500
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: can we talk about secure time?
On 21/12/14 06:31 AM, Florian Weimer wrote:
>
> In contrast, servers with long-running connections and I/O polling
> loops often do not react gracefully to jumps in time. (I once
> disconnected a few hundreds, if not thousands of users from an IRC
> server just by setting its time correctly.) Sure, you can avoid that
> by using the appropriate kernel clock for timeout handling, but I have
> the impression that the correct clock changes every couple of years.
I don't think it has ever changed. CLOCK_MONOTONIC won't *ever* jump
either forwards or backwards, but is impacted by clock skew. I don't
think most use cases actually want CLOCK_MONOTONIC_RAW, especially
considering that there's no vdso implementation so it's slow.
Of course, there's lots of buggy software which is why we have stuff
like ASLR / SSP in the first place. :)
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
