Hacker News Reader

Comment by gus_massa | Hacker News Reader

Is it possible that the unused machine has the wrong date? Perhaps that confused the operative system file dates and Dropbox.

(I have an old machine that hardly use now that has problems with the motherboard battery and sometime it travels in time to a funny date like 2000 and all the security certificates are marked as wrong.)

View on HN

You'd think Dropbox on each computer would check the last time it had synced, using the time reported from a Dropbox server.

I pray they wouldn't ever rely on users' own system clocks.

In my experience Dropbox won't sync if the local system time is too far off. Makes no sense IMO, but that seems to be how it works.

that's just SSL cert validation :-)

Seems questionable to use the local time for that. System time isn't exactly a trusted quantity, is it?

hmmm, I think it's fairly common practice amongst similar software (i.e. firefox, chrome, etc.) to use system time as a signal that you may be connecting to a server that has an outdated SSL certificate. while it's not perfect, it's a good first order security precaution to take (in addition to verifying the CA) to ensure you are talking to who you think you are.

Certificate validation for 802.1x networks relies on this, with the effect that you sometimes can't get an internet connection without fixing your clock.

What other time source would you propose using?

If you know you're on a network -- and Dropbox does -- then I'd fetch the time from a time server somewhere, perhaps Dropbox itself, or time.nist.gov. Of course, then you're at the mercy of the user's hosts file, I suppose.

If the time is just used to check for certificate expiration, maybe nobody considers it worth worrying about. Which I guess is fine as far as it goes... but the other day I couldn't get Dropbox to do its thing when my clock was only a few hours off. It didn't seem likely that an SSL date check was involved in that case.

Well. Chrome and Firefox won't let you log in to GMail, for instance. IE at least allows you to continue if you really want.

It's a common thing on school/university computers, where for various reasons, system time is always wrong and it requires Administrator privilenges to change it (I can't understand why).

iOS does it that way. My iPod touch always forgets date and time when it runs out of battery. After restart you can't do anything in the App Store or on https websites before you've set the correct date (it defaults to 1970 which is when the iPod was first introduced I believe).

1970 ipod would be awesome.

1970 is Unix Epoch :)

IE, Unix time started then.

Indeed. I once spent several hours debugging a desktop client application that relied on a correct system time.

Finally, we noticed the user's system time was set to several weeks in the future. "Oh yeah, that?" He showed us how he uses the system calendar to check dates in the future. When he was done, he'd click the "Ok" button, thereby setting the current date in Windows to some future day.

Lesson learned.

Reply on news.ycombinator.com