Fedora Developers Discuss Retiring NTP, Deprecating SCP Protocol | Hacker News Reader

Fedora Developers Discuss Retiring NTP, Deprecating SCP Protocol

phoronix.com

17 pointsrbanffy8 comments

Sounds like click-bait to me. They intend to replace a specific package with another one for NTP.

And as far as SCP is concerned, it's just that they plan to switch the default internal protocol from SCP to SFTP with the former still available.

Every single thing from phoronix is clickbait, and has been for years.

What's wrong with SCP that it must be deprecated?

https://en.wikipedia.org/wiki/Secure_copy_protocol points out a few things:

> SCP does not expect text communicating with the ssh login shell. Text transmitted due to the ssh profile (e.g. echo "Welcome" in the .bashrc file) is interpreted as an error message, and a null line (echo "") causes scp to deadlock waiting for the error message to complete.

> As the Secure Copy Protocol implements file transfers only, GUI SCP clients are rare, as implementing it requires additional functionality (directory listing at least).

It points to https://www.openssh.com/txt/release-8.0 for the quote "The scp protocol is outdated, inflexible and not readily fixed."

This comment was related to a security problem last year, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111 . Part of the release notes comments "the scp protocol relies on the remote shell for wildcard expansion, so there is no infallible way for the client's wildcard matching to perfectly reflect the server's. If there is a difference between client and server wildcard expansion, the client may refuse files from the server. For this reason, we have provided a new "-T" flag to scp that disables these client-side checks at the risk of reintroducing the attack described above."

https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol further comments "SFTP attempts to be more platform-independent than SCP; with SCP, for instance, the expansion of wildcards specified by the client is up to the server, whereas SFTP's design avoids this problem."

It's not implemented as part of systemd...

It's hard to tell due to the poor wording in Phoronix's part, but they're talking about "retiring" the ntpd reference implementation -- not the protocol, obviously.

Personally, I'd rather see them move to chrony over NTPsec.

Replacing NTP? Good fucking luck.

They're replacing it with NTPsec:

https://www.ntpsec.org/FAQ.html

> NTPsec already fully interoperates with NTP Classic. They use the same protocols and the same time adjustment algorithms. User-visible differences are minor, and consist mostly of obsolete code being dropped and a few tools renamed to reduce NTPsec’s footprint in global namespace.

It's impossible to greenfield a new network time synchronization protocol at this point, sure, but NTPsec is not that; it's a cleanup and modernization project.

That said, they have removed things, from Mode 7 packets (a known DDoS amplification vector) to support for obsolete time sources and computers:

https://www.ntpsec.org/removal-plan.html

https://www.kb.cert.org/vuls/id/568372

Reply on news.ycombinator.com