Re: [Ntp] [tsvwg] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

["C. M. Heard" <[e-mail]>]

One the one hand I see:

On Dec 4, 2021, at 3:12 PM, Hal Murray wrote:
> Years ago (2013), NTP was used in a giant DDoS attack. That was due to a
bug/oversight
> that had been around since the early NTP work.  (I've tracked it  back to
1989.)
>  https://www.spamhaus.org/news/article/695/answers-about-recent-ddos
>  https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification
> The Wikipedia chart could use another column -- the number of sites
available.
> Almost all Linux or *BSD sites were running ntpd.
>
> The fix was trivial, but there are many essentially unattended sites
running
> old versions of ntpd that will never get fixed.

And  on the other hand I see:

On Sat, Dec 4, 2021 at 9:00 PM Steven Sommars wrote:
> NTP got a bad reputation as an amplification attack vector circa 2014.
> The offending NTP servers have largely been fixed; today few public
> servers will blindly amplify the Mode 7/monlist command (the major
> problem source). The organizations doing the filtering aren't receptive
> to suggestions that they alter/remove their filtering schemes.

We have two contradictory assertions by proponents of the alternate port.
Which, if either, is correct?

Are the servers largely fixed but the filters still in place out of
inertia, as Mr. Sommers says?

Or do the filters remain because of servers that have not been fixed, as
Mr. Murray says?

And I have another question, which I though had been asked, but which I now
cannot find:

What assurance is there that the alternate port won't be blocked by default?

Mike Heard