Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Dec 2014 12:50:07 -0500
From: Daniel Micay <>
Subject: Re: can we talk about secure time?

On 21/12/14 06:31 AM, Florian Weimer wrote:
> In contrast, servers with long-running connections and I/O polling
> loops often do not react gracefully to jumps in time.  (I once
> disconnected a few hundreds, if not thousands of users from an IRC
> server just by setting its time correctly.)  Sure, you can avoid that
> by using the appropriate kernel clock for timeout handling, but I have
> the impression that the correct clock changes every couple of years.

I don't think it has ever changed. CLOCK_MONOTONIC won't *ever* jump
either forwards or backwards, but is impacted by clock skew. I don't
think most use cases actually want CLOCK_MONOTONIC_RAW, especially
considering that there's no vdso implementation so it's slow.

Of course, there's lots of buggy software which is why we have stuff
like ASLR / SSP in the first place. :)

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.