* strcpy, strncpy, strcat: Use strlcpy and strlcat instead.
* sprintf, vsprintf: use snprintf and vsnprintf instead.
* In scanf and friends, the %s format without length limit is banned.
* strtok: use strtok_r() or unroll this into the obvious loop.
* gets: Use fgets instead.
* gmtime(), localtime(), asctime(), ctime(): use the reentrant *_r variants.
* tmpnam() - use mkstemp() or tmpfile() instead.
* dirname() - the Linux version is re-entrant but this property is not portable.
Presumably, someone else, somewhere else, is solving the problem that needs to be solved, which is to get an NTP implementation that is simple but complete enough for the 98% use case deployed based either on thoroughly modern C code (which looks nothing like a heap of strlcats and snprintfs) or a safer language, like Rust or Go.
Maybe that's ntimed, maybe it's something else. It's not this, whatever the hell this is going to turn out to be.