Windows feature that resets system clocks based on random data is wreaking havoc (arstechnica.com)
from const_void@lemmy.ml to technology@lemmy.ml on 25 Aug 2023 17:43
https://lemmy.ml/post/3874812

threaded - newest

queermunist@lemmy.ml on 25 Aug 2023 18:05 next collapse

“feature”

floofloof@lemmy.ca on 25 Aug 2023 18:22 next collapse

"Microsoft hasn’t really been helpful in trying to track this, either. I’ve sent over logs and information, but they haven’t really followed this up. They seem more interested in closing the case.”

That’s the Microsoft way: ignore the bug report for a month or two then close the case for “inactivity”.

lobut@lemmy.ca on 25 Aug 2023 20:14 collapse

It’s sometimes the issue with relying on metrics and stuff and being purely quantitative. A lot of us of have worked at companies where it’s been like this. To deal with volume they need to rely on numbers to gauge so you tell the workers they’ll be ranked on closed cases.

comfortable_doug@hexbear.net on 25 Aug 2023 18:23 next collapse

Ok, but can we talk about the absolute doorknob who made that graphic? The clock has two different mounting points for the hands. Come on, now.

Thordros@hexbear.net on 26 Aug 2023 22:15 collapse

That’s the gag, I think. The clock is fundamentally broken.

elouboub@kbin.social on 25 Aug 2023 19:04 next collapse

With these updated routing tables, a lot of people were unable to make calls, as we didn't have a correct state

You're relying on windows for critical infrastructure? Are you nuts?

Appoxo@lemmy.dbzer0.com on 25 Aug 2023 22:09 next collapse

Linux can also die in weird ways…

It’s just that Windows is more prone to some issues.

elouboub@kbin.social on 25 Aug 2023 22:20 collapse

Indeed, nothing is perfect, but closed source stuff doesn't provide a lot of recourse. If you have a linux expert in your team, they can investigate and if need be even dig into the code of linux itself to find the core issue. Microsoft doesn't provide anything even remotely similar.

BeardedGingerWonder@feddit.uk on 25 Aug 2023 23:21 collapse

How many dev teams have a kernel dev on them?

ReversalHatchery@beehaw.org on 26 Aug 2023 01:45 next collapse

You don’t have to be a kernel dev for that. Reading source code is much easier than writing it. I myself have even read the code that handles the battery management drivers, and it’s mostly self documenting, even though I’m bad at C and it’s pointers, and also have never yet written a kernel driver.

elouboub@kbin.social on 26 Aug 2023 06:00 next collapse

Don't need one. If you can read C/C++ you can read the kernel code. And in most cases, you won't have to, as the problem is probably in a component in the distro. Those are written in python, ruby, or bash, which are all much more readable than C/C++.

No such luck on windows

sugar_in_your_tea@sh.itjust.works on 26 Aug 2023 15:41 collapse

I worked at a small company without a kernel dev and we periodically looked into the code to solve problems. I don’t know how much we upstreamed, but we relied on Linux so it was either the or try to get someone on the mailing list to care.

It’s really not that hard to look through the kernel source, it’s pretty well written and documented. It’s a lot harder to be a kernel developer writing new code, but finding bugs and contributing fixes isn’t that bad.

eee@lemm.ee on 27 Aug 2023 10:46 collapse

The US navy ran on windows xp for so long that they paid Microsoft to continue maintaining it after EOL.

theshatterstone54@feddit.uk on 25 Aug 2023 20:40 next collapse

Fun fact: Apparently M$ laid off their QA team for Windows so if you’re wondering why updates break so much, that’s why.

Kalkaline@programming.dev on 25 Aug 2023 22:07 next collapse

Makes sense. I had to trouble shoot my WiFi card for like an hour yesterday to get it to work after a Windows Update killed it for a bit.

theshatterstone54@feddit.uk on 26 Aug 2023 11:01 collapse

Well, now you know why.

rolandtb303@lemmy.ml on 26 Aug 2023 21:24 collapse

And when they laid off their QA team with the testing lab of thousands of unique computers, they replaced it with VMs and AI. Because VMs are a totally good way to troubleshoot very specific bugs. The AI part is used to supposedly figure out when you’re “idle” so what Windows can update.

Imagine needing AI to update a computer lmao

theshatterstone54@feddit.uk on 28 Aug 2023 10:33 collapse

They replaced it with VMs and AI

That… explains a lot.

Frederic@beehaw.org on 25 Aug 2023 21:02 next collapse

Last problem I had was our server serving 2FA decided it was not on the same timezone, so when I tried to connect with my Authenticator code, it says “check your time on your cellphone”. I had to call IT…

[deleted] on 25 Aug 2023 21:08 next collapse
.
candybrie@lemmy.world on 25 Aug 2023 22:33 collapse

If you read the article it’s explained that some SSL implementations put random data in the time field (OpenSSL was given as an example). Microsoft knows about this and so needs a certain number of closely matching timestamps to be confident about the new time to change the system time. However, if you get particularly unlucky with a string of random timestamps that match, you end up with a random time.

deegeese@sopuli.xyz on 25 Aug 2023 22:46 next collapse

Yes, it’s a dog shit implementation to rely 3rd parties to make guarantees about their data that they never agreed to.

Linux and MacOS handle this just fine. Why blame SSL when you’re the one using it wrong?

[deleted] on 25 Aug 2023 22:56 next collapse
.
SheeEttin@lemmy.world on 26 Aug 2023 00:02 collapse

And most NTP clients already handle this by not changing the time automatically if it would be too much of a jump. Microsoft is trying to fix what’s not broken.

argv_minus_one@beehaw.org on 25 Aug 2023 21:42 next collapse

Sounds like an interesting idea. Pity MS can’t be bothered to iron out the issues with it.

Echo71Niner@lemm.ee on 26 Aug 2023 11:11 next collapse

Ignoring tickets and than closing it for inactivity is how big companies ignore their own fuck-ups.

Treczoks@lemm.ee on 26 Aug 2023 11:39 next collapse

I’ve read the documentation on that feature, and still don’t get over it. How can anyone with knowledge of computers be so dumb to even consider such an idea, lest implement it?

This feature is just a BIG flag waving “AbUsE mE!”

Thann@lemmy.ml on 26 Aug 2023 21:56 next collapse

“The false assumption is that most SSL implementations return the server time,” Simen said. “This was probably true in a Microsoft-only ecosystem back when they implemented it, but at that time [when STS was introduced], OpenSSL was already sending random data instead.”

This is so amazing, NTP is too insecure, so we relied on random data from random servers instead

secret301@sh.itjust.works on 26 Aug 2023 22:13 collapse

Companies still using windows are causing problems