[HN Gopher] Encrypted DNS and NTP = Deadlock
       ___________________________________________________________________
        
       Encrypted DNS and NTP = Deadlock
        
       Author : cyounkins
       Score  : 10 points
       Date   : 2022-12-29 20:14 UTC (2 hours ago)
        
 (HTM) web link (cyounkins.medium.com)
 (TXT) w3m dump (cyounkins.medium.com)
        
       | LinuxBender wrote:
       | There _may be_ a clunky work around, depending on what else is on
       | the embedded devices. If it has curl, one could create a local
       | host entry for a known site _yes, bad practice I know_ and then
       | curl --head over plain http to get the date header and use
       | hwclock to bootstrap the system time prior to starting up NTP.
       | Some NTP daemons also have a way to do something like this.
       | Another method would be to bootstrap NTP with a few known
       | dedicated public NTP servers that are in  /etc/hosts then switch
       | to the pool. These are all clunky methods but I have seen them
       | used out of desperation for a myriad of _" but you shouldn't do
       | that"_ reasons. A cron job could check a _management_ site for
       | the latest configuration from a json or plain text file so that
       | the device does not fall too far out of sync.
        
       | jedisct1 wrote:
       | You can add IP addresses of the NTP servers being used in the
       | captive-portals.txt file, which serves records even before the
       | operating system considers a network interface as active.
       | 
       | Or add cert_ignore_timestamp=true to the main configuration file.
       | Initially, cert expiration won't be checked, but as soon as a DNS
       | server will be reachable, this feature will automatically disable
       | itself.
       | 
       | This is for dnscrypt-proxy. Alternative clients may have
       | something similar.
        
       ___________________________________________________________________
       (page generated 2022-12-29 23:01 UTC)