Re: [Ntp] Finding leap-seconds.list

[Warner Losh <[e-mail]>]

On Wed, Nov 7, 2018 at 8:13 PM Thomas Peterson <[e-mail]>
wrote:

> As I have said in my starting email to this thread [0], this file is
> hosted in many places to which the IETF is not an authoritive source and
> from my end. I have experienced issues reaching the NIST host, however
> USNO's FTP server [1] appears to work for me.
>

Right, and have you researched USNO's file? Did you know there's subtle
differences between that file and that NIST file? In the past, it has not
been updated in a timely manner, and it's expiration date has been
unreliable. It's the whole reason FreeBSD doesn't use it: it only kinda
sorta looks like the right file. Also, non-military users aren't really
supposed to use this source because USNO's charter is to provide support to
the military.


> Furthermore, leap-seconds.list is also packaged inside of FreeBSD itself
> [1] surely it would be more appropriate to reference this file instead
> of having the ntp service attempt to download it from a non-authoritive
> source on the internet, where it can fall under the same vendor software
> updates as all other critical files?
>

This points to a larger problem: There is no authoritative, authenticated
file that has this information.  Why should anybody trust the FreeBSD
project to say that something is authoritative? At least the NIST file is
nominally from an authoritative place (NIST in the US is the source of
time, and the file comes from their official services there). USNO's file,
when it hasn't skimped on the details, is also an authoritative file
provided by USNO to military users. So I don't think your assertion that
this is 'non-authoritative' is supported by history or the roles of NIST or
USNO to the time community. NIST and USNO have been providing these files
for at least two decades that I'm personally aware of. These files are
cryptographically checksummed, but not cryptographically signed.

The file that's in FreeBSD isn't the one used for ntpd because it goes
stale too quickly. FreeBSD does not necessarily need up to date timezone
information to properly function with the current separation of roles.
Requiring it to get the files via the timezone database updates to get
leapseconds, which are not a time-zone, is inverting the properly designed
dependency graph.

Surely it would be more appropriate to learn the history here rather than
shooting from the hip and being gratuitously insulting when an issue is
raised, but maybe I'm reading too much condescension into your statements.
Regardless, it's not helpful to having a civil conversation about it.

Warner


> Regards
>
>
> [0] https://mailarchive.ietf.org/arch/msg/ntp/COKDJAEBD5rsy5uOvHyO6QdXvN8
>
> [1] ftp://tycho.usno.navy.mil/pub/ntp/leap-seconds.list
>
> [2]
>
> https://svnweb.freebsd.org/base/head/contrib/tzdata/leap-seconds.list?view=log
>
>
> On 08/11/2018 02:56, Warner Losh wrote:
> >
> >
> > On Wed, Nov 7, 2018 at 7:49 PM Thomas Peterson
> > <[e-mail] <mailto:[e-mail]>> wrote:
> >
> >     I propose the following occurs if the working group agrees:
> >
> >     * draft-ietf-ntp-bcp is updated to remove reference to the IETF
> >     hosted leap second file (as has already been suggested)
> >     * The IETF ceases to host unpacked versions of tzdb
> >     * Updates sent to various other mailing lists that may be affected
> >     by this change (off the top of my head, [e-mail]
> >     <mailto:[e-mail]>, [e-mail]
> >     <mailto:[e-mail]>, [e-mail]
> >     <mailto:[e-mail]>) as a matter of courtesy
> >     before its hosting is removed.
> >
> >
> > So what's the new place to get it if the IEFT stops hosting it? All
> > the 'much better places' don't earlier in the thread do not resolve
> > for me at all (or resolved to web pages that aren't suitable for
> > automatic downloading). The ntp leapsecond file has a format that's
> > been fixed for at least two decades. So what's the real 'next step'
> > for people that download it outside of the TZ stuff?
> >
> > This is a very disruptive change to the FreeBSD community, at least.
> > It's not clear what it accomplishes.
> >
> > Warner
> >
> >
> >     Regards
> >
> >
> >     On 08/11/2018 01:28, Dieter Sibold wrote:
> >>
> >>
> >>     On 8 Nov 2018, at 2:17, Denis Reilly wrote:
> >>
> >>>     Thomas and Martin,
> >>>
> >>>     On doing my own research into this for the BCP, I found that the
> >>>     Time Zone database maintenance procedures are documented in BCP
> >>>     175 / RFC 6557.
> >>>
> >>>     However, after the discussion during the WG meeting, I think
> >>>     it's better to remove the mention of the leap second file hosted
> >>>     by the IETF in the BCP. As Martin notes, there are better places
> >>>     to get it.
> >>     I agree with Denis.
> >>
> >>>
> >>>     --
> >>>     Denis Reilly  |  Technical Lead  | [e-mail]
> >>>     <mailto:[e-mail]> [phone]
> >>>
> >>>     -----Original Message-----
> >>>     From: ntp <[e-mail]> <mailto:[e-mail]>
> >>>     On Behalf Of Martin Burnicki
> >>>     Sent: Wednesday, November 07, 2018 1:00 PM
> >>>     To: Thomas Peterson <[e-mail]>
> >>>     <mailto:[e-mail]>; [e-mail]
> >>>     <mailto:[e-mail]>
> >>>     Cc: Paul Eggert <[e-mail]> <mailto:[e-mail]>
> >>>     Subject: Re: [Ntp] Finding leap-seconds.list
> >>>
> >>>     Thomas Peterson wrote:
> >>>>     As was discussed at the working group meeting at IETF 103 [0],
> >>>>     I have decided to do some research on the leap-seconds.list
> >>>>     file that the IETF appears to be hosting at
> >>>>     https://www.ietf.org/timezones/data/leap-seconds.list, but for
> >>>>     some participants of this working group appear unclear about.
> >>>
> >>>     During the IETF NTP WG session I posted a link in the chat which
> >>>     points to a PDF I wrote some time ago:
> >>>
> https://www.meinbergglobal.com/download/burnicki/the_ntp_leap_second_file.pdf
> >>>
> >>>
> >>>     There are several "original" versions of that file published by
> >>>     the IERS, NIST, and USNO.
> >>>
> >>>     One of those original files (usually the version from NIST) is
> >>>     used to update the TZDB records, and the original file is also
> >>>     included in the TZDB distribution/tar ball, which is then
> >>>     unpacked and made available at the IETF web site.
> >>>
> >>>     The problem here is that first an update of the original leap
> >>>     second file appears, and only whenever the next TZDB version is
> >>>     released after that the file appears on the IETF web site.
> >>>
> >>>     So for most users it's better to pick up a file from one of the
> >>>     original sites.
> >>>
> >>>>     Where is this referenced in an RFC or other IETF document?
> >>>>     I ran a search of “leap-seconds.list” across the spread of
> >>>>     draft and RFC documents. No RFC that I have found makes direct
> >>>>     reference. However, the current NTP BCP draft Section 4.6 [1]
> >>>>     contains:
> >>>>
> >>>>     ... SNIP ...
> >>>>
> >>>>     The IETF maintains a leap second list [[7]] for NTP users who
> >>>>     are not
> >>>>        receiving leap second information through an automatic source.
> >>>>
> >>>>        Files are also available from other sources:
> >>>>
> >>>>     ... SNIP ...
> >>>>
> >>>>     With [[7]] holding reference to the file hosted at, and a list
> >>>>     of links to sources.
> >>>>
> >>>>     What else is www.ietf.org <http://www.ietf.org> hosting of a
> >>>>     similar nature?
> >>>>     This file alone is not the only thing hosted under www.ietf.org
> >>>>     <http://www.ietf.org>, in fact https://www.ietf.org/timezones/
> >>>>     directory listings show that all recent versions of the tzdb
> >>>>     (including 2018g the most recent) which suggests a human
> >>>>     maintaining the hosting of it, or automated process. Versions
> >>>>     only go back to 2016. These files are also available over FTP [2].
> >>>>
> >>>
> >>>     Yes, and since the leap seconds file is part of the TZDB, it
> >>>     also becomes available via the IETF web site.
> >>>
> >>>>     How long have these files been hosted on www.ietf.org
> >>>>     <http://www.ietf.org>?
> >>>>     Internet archive's Wayback Machine [3] shows it appearing back
> >>>>     in 2015.
> >>>>
> >>>>     Who is using the file?
> >>>>     ntpd does depend on it as was discussed at the WG meeting, [4].
> >>>>     FreeBSD [5] holds reference to it and users have reported
> >>>>     issues when being unable to access it in the past. In addition,
> >>>>     at least one library [6] make use of it outside of ntpd,
> >>>>     however I don't believe this is heavily used or cause
> >>>>     non-developers or system administrators any pain if it went
> >>>>     missing.
> >>>
> >>>     I'm sure the file *is* heavily used, but maybe not directly from
> >>>     the IETF web site.
> >>>
> >>>     It's a good source to become aware of an upcoming leap second,
> >>>     and it's a good source to be able to determine the current
> >>>     UTC/TAI offset, as e.g. required when using PTP which uses TAI
> >>>     timestamps by default.
> >>>
> >>>     Anyway, I think the file is mostly used by NTP or PTP servers
> >>>     since for most applications the information interesting for
> >>>     clients can be passed via the individual protocols.
> >>>
> >>>
> >>>     Regards,
> >>>
> >>>     Martin
> >>>     --
> >>>     Martin Burnicki
> >>>
> >>>     Senior Software Engineer
> >>>
> >>>     MEINBERG Funkuhren GmbH & Co. KG
> >>>     Email: [e-mail]
> >>>     <mailto:[e-mail]>
> >>>     Phone: [phone]
> >>>     Linkedin: https://www.linkedin.com/in/martinburnicki/
> >>>
> >>>     Lange Wand 9, 31812 Bad Pyrmont, Germany Amtsgericht Hannover
> >>>     17HRA 100322 Geschäftsführer/Managing Directors: Günter
> >>>     Meinberg, Werner Meinberg, Andre Hartmann, Heiko Gerstung
> >>>     Websites: https://www.meinberg.de https://www.meinbergglobal.com
> >>>     Training: https://www.meinberg.academy
> >>>
> >>>     _______________________________________________
> >>>     ntp mailing list
> >>>     [e-mail] <mailto:[e-mail]>
> >>>     https://www.ietf.org/mailman/listinfo/ntp
> >>>     ATTENTION: This email came from an external source.
> >>>     Do not open attachments or click on links from unknown senders
> >>>     or unexpected emails.
> >>>     _______________________________________________
> >>>     ntp mailing list
> >>>     [e-mail] <mailto:[e-mail]>
> >>>     https://www.ietf.org/mailman/listinfo/ntp
> >     _______________________________________________
> >     ntp mailing list
> >     [e-mail] <mailto:[e-mail]>
> >     https://www.ietf.org/mailman/listinfo/ntp
> >
>