From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from relay.sandelman.ca (relay.cooperix.net [67.23.6.41]) by huchra.bufferbloat.net (Postfix) with ESMTP id AD2B0202295 for ; Thu, 23 Aug 2012 08:30:07 -0700 (PDT) Received: from sandelman.ca (24-139-16-154.eastlink.ca [24.139.16.154]) by relay.sandelman.ca (Postfix) with ESMTPS id 2FA498659 for ; Thu, 23 Aug 2012 11:24:56 -0400 (EDT) Received: from sandelman.ca (quigon.sandelman.ca [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 057D6CA0C3 for ; Tue, 21 Aug 2012 21:21:29 -0400 (EDT) From: Michael Richardson To: cerowrt-devel@lists.bufferbloat.net In-reply-to: References: <502E064C.50305@etorok.net> <502E9609.5040800@etorok.net> <9246.1345321014@sandelman.ca> <19070.1345504767@sandelman.ca> Comments: In-reply-to Maciej Soltysiak message dated "Wed, 22 Aug 2012 00:03:42 +0200." X-Mailer: MH-E 8.3; nmh 1.3; XEmacs 21.4 (patch 22) Date: Tue, 21 Aug 2012 21:21:29 -0400 Message-ID: <26683.1345598489@sandelman.ca> Sender: mcr@sandelman.ca Subject: Re: [Cerowrt-devel] cerowrt 3.3.8-17: nice latency improvements, some issues with bind X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Aug 2012 15:30:08 -0000 >>>>> "Maciej" == Maciej Soltysiak writes: >> Good idea, but you need DNS to find that server, and you need >> time to do DNSSEC. Maciej> How about this: Maciej> 1) do a 1 time `host time.nist.gov 8.8.8.8` and feed that to NTP config file Maciej> 2) make NTP get time from the IP of time.nist.gov resolved from step 1 Maciej> 3) start bind with dnssec Sure, you could do this. There is no significant security advantage of doing this, vs starting bind with DNSSEC time validation disabled. A malicious attacker who wants to attack you also controls the answer that 8.8.8.8 returns, and also controls the NTP answer on port 123. Bad guys owns your uplink. It's as easy as plugging a *WRT box in front of yours, or any place upstream. (if you are paranoid, you are paranoid) Or turn off DNSSEC validation until you have some notion of time. That way, you wouldn't claim to have done validation. -- Michael Richardson -at the cottage-