Re: [Ntp] Finding leap-seconds.list

[Thomas Peterson <[e-mail]>]

I don't think you are being paranoid and that your suggestion to let the 
distros handle the distribution is absolutely appropriate. A potential 
point of contention comes when some open source based distributions with 
limited resources have to find means of hosting data such as this in 
efficient means due to their much more finite resources.

Judging by a lot of the discussions that have been made through the past 
day on this subject it appears we have seen some concerns raised about 
pulling rug out from underneath at least one distribution, suggestions 
to look at extending protocols and many useful clarifications with 
regards to ownership, stewardship, and responsibility of the LSL.


I think it will require several pieces of work in parallel to avoid 
negative outcomes. It make sense for those interested in seeing an 
enhancement to TZDIST to explore the work to include this data (and I 
would be happy to help where I can, despite being unfamiliar with the 
standard) and at the same time the distributions dependant on the IETF's 
hosting of LSL work with the IETF to consider moving away from depending 
on it in a way that minimises any loss of service, and improves things 
for their users.


Regards


On 08/11/2018 11:26, Hal Murray wrote:
>> Why not use the leap second file directly from the IERS?
> Depends on the use.  If the target audience is a handful of geeks there is no
> problem.
>
> If it gets added as a cron job to a zillion systems, there is too good a
> chance that something will screwup and DoS their server.
>
> Packaging it with the tzdata seemed like a way to avoid that problem.
>
> If there is a need to run something like a cron job, I think each distro
> should host a copy of the file for their users.
>
> It's possible I'm being overly paranoid.  There are already quite a few ugly
> examples on the wiki NTP abuse page.  I'd be happier if my name as part of
> this discussion didn't get added to another one.
>    https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse
>
> Consider the case of a stupid bug in a widely deployed IoT device.
>
>