Re: can we talk about secure time?

[Florian Weimer <fw () deneb enyo de>]

* Dave Horsfall:

> On Sun, 21 Dec 2014, Florian Weimer wrote:
>
> > [...] but I have the impression that the correct clock changes every 
> > couple of years.
>
> This sounds like you're referring to leap seconds,

No, I meant the recommend time to use in this context.  If
clock_gettime(CLOCK_MONOTONIC) is the right choice, that's good,
because it has vdso accelleration (but I don't know how effective that
is in practice).  On some systems, obtaining time is really painfully
slow. [*]

> where due to the 
> Earth's rotation slowing down (as determined by the International Earth 
> Rotation Service), an extra second is inserted every so often, typically 
> in July; it's quite fun watching it on a GPS receiver (assuming that it 
> even survives the event, as I've seen a few cheaper ones lose the plot).

GPS time does not have leap seconds.

[*] If you upgrade OpenSSL and RAND_bytes is suddenly so much slower,
that's the place to look—upstream mixes not just the PID, but also the
current time into the pool to achieve more complete fork protection.