I'm curious to know more. Can you please elaborate or point to some articles discussing this?
http://www.ntp.org/ntpfaq/NTP-s-refclk.htm
TL;DR Most NTP networks are relying on GPS versus a high precision on-site time keeping device. Break GPS, and you break timekeeping for a wide swath of the worldwide NTP pool. But thems the breaks when you can get access to atomic clocks in space (each GPS satellite carries an atomic clock on board) just by sticking an antenna out the window.
If you require precision time for critical business operations (financial transactions, global database operations), you should be running a precision time source locally at your datacenter; for under $20 an attacker could deny you GPS timing.
It has privilege separation, sandboxing and if your OS/distribution uses LibreSSL it implements HTTPS constraints.
Yes it is. I'm on a cable modem and currently using OpenNTPD to talk to 5 NTP servers. My largest offset is currently 3.6 milliseconds. That's fine for general purpose computing. Anyone who needs better should probably buy some NTP or PTP hardware for his LAN.
While the implementation is popular, there are alternatives. There is also OpenNTPd, chrony and ntimed for instance.
There are also alternatives to the NTP protocol too, such as PTP and SNTP.
[1]https://www.ietf.org/rfc/rfc5905.txt [2]http://www.ntp.org/
The most common embedded NTP implementation is probably busybox, being used on Linux routers/modems/etc.. is actually based on OpenNTPD.
And I've personally be using chrony for a while, although my needs are significantly less than whatever level of accuracy it provides. There are some other clients out there as well, such as OpenBSD's OpenNTPD, although I have a vague memory of it having issues of precision, congruent with the distribution's focus on security.
It was discovered a while ago for example that some part of the Linux default NTP servers are run by shodan. So when your machine gets the time it lets shodan know you've got a server running so they can port scan you.
It would be stupid not to run a bunch of NTP servers if you wanted a to run a bot net. A free list of every running Linux server and countless IoT devices! Without having to actively scan IP space at all
So it's hardly "a list of every running linux server".
