Comments (11)
Yeah its too bad, but pretty sure this is dead, since most modern TLS servers no longer send time but instead send random numbers..
Here is a quick blurb that sums it up well
https://security.stackexchange.com/questions/71364/tls-reliance-on-system-time
from tlsdate.
ok, thanks a lot for the info and link!
from tlsdate.
@ioerror: CrOS uses this project quite a bit and continues to maintain it. would you be OK with having some of us help out with maintenance here ?
obviously we wouldn't turn this into some CrOS-only project, but merge fixes/general improvements that make sense everywhere.
from tlsdate.
from tlsdate.
i was thinking you'd add a few of us (security minded peeps) as Members and then we'd be able to review/merge changes directly in this particular repo
from tlsdate.
from tlsdate.
I just want to let you know that since there is no activity, the package was masked and will be removed on the gentoo repository unless there will be activities again..
@ioerror since the package is maintained for chrome os, what's the progress to add the CrOS people to this repository?
TIA
from tlsdate.
from tlsdate.
Is Gentoo carrying any patches that need to be merged?
In our case, atm the tlsdated daemon crashes (because of glibc changes), so we have two ways:
- find patches around the world
- find patches in the official repo and/or make a snapshot which contains the patch and/or obtain a new release.
Usually we prefer the latest.
@ioerror since the package is maintained for chrome os, what's the progress to add the CrOS people to this repository?
I haven't received an email from them yet.
@vapier any news?
from tlsdate.
Is Gentoo carrying any patches that need to be merged?
In 2015 I opened a pull request with a gentoo patch: #171
There was no feedback whatsoever since then!
from tlsdate.
Note to anyone who comes here:
There is an active fork by the ChromiumOS project here:
https://chromium.googlesource.com/chromiumos/third_party/tlsdate
In general, it appears to be a bad idea to rely on TLS handshake using the timestamp, rather than some random data.
But since the Chromium project is by Google there is probably some long term commitment that at least TLS services on google.com continue supporting it.
from tlsdate.
Related Issues (20)
- Test for BIG/LITTLE ENDIAN in test-bio.c
- Time
- minor building issues on debian testing HOT 2
- Sandboxing on other platforms HOT 1
- Tlsdate has no installation candidate HOT 2
- Make tlsdate read proxy environment variables if present
- tlsdate fails to build with openssl-1.1 (new API) HOT 1
- TLS 1.3
- tlsdate-0.0.13 fails to compile with libressl-2.5.0 HOT 1
- Help: How can I disable automatic start of tlsdated? HOT 3
- How do I embed tlsdate into a C++ application? Is there any sort of "libtlsdate"?
- Why times are all different? Only "google.com" returns accurate time! HOT 2
- By default tlsdate uses the non-standard 'nogroup' group
- [EXPIRED] Windows binary
- compile error on raspberrypi HOT 1
- Compile error
- Make error in ubuntu 18.04 HOT 1
- where to find tlsdate servers? HOT 1
- Fails to build with `tlsdate-helper.c:377:11: error: invalid use of incomplete typedef ‘SSL’ {aka ‘const struct ssl_st’}` and subsequent errors.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tlsdate.