Meta has integrated Network Time Security (NTS) into its public time infrastructure to protect against the transit tampering risks of legacy NTP. The implementation separates operations into a TLS 1.3 key-establishment phase and standard authenticated UDP time queries, maintaining a stateless server design using derived cookie keys. This rollout directly counters validation errors spurred by upcoming CA/Browser Forum rules that will slash TLS certificate lifespans down to 47 days by 2029.
Key points
The legacy Network Time Protocol has operated without built-in authentication mechanisms…: The legacy Network Time Protocol has operated without built-in authentication mechanisms since its introduction in 1985.
Meta is urging client maintainers across Android and iOS ecosystems to integrate native N…: Meta is urging client maintainers across Android and iOS ecosystems to integrate native NTS support into their systems.
The two-phase NTS architecture pairs a TLS 1.3 key establishment step with standard authe…: The two-phase NTS architecture pairs a TLS 1.3 key establishment step with standard authenticated UDP traffic to avoid storing per-client state.
Sources checked by our analysis pipeline: 1
- Meta’s public time service now speaks NTS (Network Time Security, RFC 8915) at nts.meta.com. Packets are authenticated, so a device can verify the time came from us and was not modified on the way.
- Our NTS servers hold no per-client state. Cookie keys are derived, not stored and not replicated.
- We’ve open sourced everything, including the protocol, server, client through Meta’s Time library on GitHub.
- We’re also encouraging everyone, particularly those who maintain an NTP client on Android or iOS, to join us in enabling NTS support.
We’ve previously written about building a more accurate time service at Meta scale – migrating from ntpd to chrony, going from 10 milliseconds to 100 microseconds, and opening time.meta.com to everyone.
That work made time precise. This work makes it verifiable.
Why NTS?
NTP has been unauthenticated since 1985, like a lot of the internet’s foundational protocols. But it is also the one every certificate, token, and signature is checked against. The client sends 48 bytes, something sends 48 bytes back, and the client believes it. There is no…
Originally spun out from Uber's acquisition of Postmates, the publicly traded robotics company is commercially releasing its proprietary data tools and connectivity architecture to external developers. This strategic pivot mirrors Amazon's cloud infrastructure strategy, enabling third parties to offload heavy onboard computing and improve how automated machines operate in complex human environments.
Autonomous mobility operations are slated for a regional capacity boost as service coverage scales up for local passengers. The fleet adjustments will enhance ride-hailing availability across the metropolitan area through targeted partner integration. This timeline reflects ongoing efforts to meet projected operational targets by the close of the calendar year.
Developers can now orchestrate one-time or recurring tasks across production, preview, and custom environments as Vercel introduces its successor to traditional Cron Jobs. The updated tool provides deeper integration with backend architectures by targeting private functions, HTTP paths, and queue topics directly. It also enables teams to manage or trigger executions on demand without having to initiate project redeployments.