Changing date/time can bypass block / cause it to end early

Changing the computer clock totally eliminates selfcontrol blocks. Any way to have this not happen?

Thanks

[slambert]

There are other ways we considered, but they seemed more risky if anything failed. You're welcome to suggest code changes.

[cstigler]

There's potentially a way to fix this by saving an encrypted reference to the time. I'll look into it.

That'd be pretty incredible!

[rilian]

this may be solved by counting the ticks, without relying on computer timer at all

[towlerj]

Could you refer to a couple of NTP servers as well as the system clock? If the system clock was ahead of, for example, two ntp servers, ignore it. If only the system is clock is available, just use that.

[3marcusw]

towlerj might really be on to something. I wish i hadn't figured out this way to bypass SelfControl

[cstigler]

@towlerj that'd be a nice addition, of course it's pretty trivial to work around also (disable the network interface, move the time forward, re-enable the network interface, move the time backward) but it'd add another step to the process. Probably won't be added in the very near future though because it's not a huge priority and I'm busy.

@rillian counting the ticks sounds good in theory, but I've actually experimented that and it'd take our permablock problems to a whole new level. Just nothing quite as reliable as system time to make sure your block comes off when it's supposed to...

[towlerj]

cstigler - that would work round the NNTP check, BUT... if someone knows enough to disable the network interface then they probably know enough to restore the relevant file anyway. (Hmm, but disabling a network interface could just be pulling the ethernet cable / turning off WiFi. so maybe not).

However - I do get that this isn't a huge priority. Am also busy, but as someone who is learning ObjC I may be interested in attempting a patch to try this (most likely in summer - have a degree to be studying for at the moment), if i do and the code isn't too embarrassing I'll send it through. (they are both big if's though, obviously)

[cstigler]

@towlerj Yup, I was thinking just going up to the menu bar and choosing "Turn Wi-Fi Off," which is pretty simple. But definitely still a worthwhile improvement!

If you get to doing a patch, please send over a pull request. We attempt to read all block details from our lockfile and then from defaults, so I think the best way to handle it would be to store an offset from local to server time, then check that as we check the date and adjust if the offset has changed. We can't store only server time because we need local time as a backup...

On Feb 11, 2013, at 10:24 PM, towlerj notifications@github.com wrote:

cstigler - that would work round the NNTP check, BUT... if someone knows enough to disable the network interface then they probably know enough to restore the relevant file anyway. (Hmm, but disabling a network interface could just be pulling the ethernet cable / turning off WiFi. so maybe not).

However - I do get that this isn't a huge priority. Am also busy, but as someone who is learning ObjC I may be interested in attempting a patch to try this (most likely in summer - have a degree to be studying for at the moment), if i do and the code isn't too embarrassing I'll send it through. (they are both big if's though, obviously)

—
Reply to this email directly or view it on GitHub.

[3marcusw]

Is there any way to require the user to type in their admin password multiple (say 20) times to make it a severe inconvenience to change time settings?

[cstigler]

@3marcusw we can't block any basic behavior of the system, such as changing the date/time settings. that's probably for the better.

[dpmccabe]

@cstigler, if you've done some work already on a ticks solution to this problem, do you think you could add the code to this repo in another branch? I'd be willing to sacrifice some reliability for a foolproof blocking solution, even though it might never be a good option for a general release.

[paulm6825]

Can't we edit the /etc/authorization file in a text editor to prevent this?

Something like the settings in here? http://support.apple.com/kb/TA23576?viewlocale=en_US&locale=en_US

Not a change to the program of course but there might be an interim solution there