Skip to content

Comment on Encrypted DNS and NTP = Deadlock

Comments

It would be great to see Google or Cloudflare use their infrastructure to provide anycasted NTP IP addresses.

Google, Cloudflare and Facebook has vanity IPv6 address, pretty sure they are all static anycast IPs.

time.google.com - 2001:4860:4806::

time.cloudflare.com - 2606:4700:f1::123

time.facebook.com - 2a03:2880:ff0c::123

I also run a pair of worldwide anycasted NTP instances if you don't want to deal with smearing or depending on the same company for DNS and time.

45.127.112.2

45.127.113.2

Cool! I searched but couldn't find any docs - looks like it might have been for ntpjs? What was the process like to get an ASN to do this?

One of the problems with Anycast is that you can get inconsistencies in the responses because you're potentially hitting multiple servers with different RTTs. So you'd want to ensure they're a higher Stratum number than your final, accurate servers.

Mind you that Google smeared the leap second. Not sure if the others do, but I think is important to recognize when selecting an NTP.

As long as they do not start smearing leap days I don't think it matters much for bootstrapping. You only need time accurate enough for validating certs, after that you can use whatever pool you want.

Smearing is probably what most people actually want...

Yeah, this comes up every now and then in these discussions. Both Amazon and Google have explained quite well why smearing is probably the best way to handle leap seconds.

As for IPv4, time.google.com has been 216.239.35.0 since 2016, so it's unlikely to change anytime soon either.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.