Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

121–130 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#121

Post by flukus »

peterwwillis wrote: post #77

I've pointed out this consequence of "put TLS on everything" before, but people shrugged it off.

It seems like the commenters here are still shrugging it off. At least facebook and the oculus division are still around to fix the issue, imagine if this was a company that was now defunct, which could easily have been oculus if facebook hadn't purchased them. You're hardware would now be bricked and you would have no recourse because no one is left to create a new certificate. Or imagine if the occulus 2 was out and they decided that they no longer wish to support the old one, this is the ultimate vehicle of planned obsolescence.

It's not just people shrugging it off, many are defending this as being a perfectly fine state of affairs.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#122

Post by stryk »

Filligree wrote: post #109
stryk wrote: post #55

Earlier quoted context omitted.

Call me when it's a wireless & self-contained unit. Until then, I just cannot honestly see it taking off in the commercial space. Industrial & enterprise-ish use maybe, but to regular consumers hell no. It's still a mess of wires and sensor installation, not to mention you still need that high-end gaming PC (and with the prices of GPUs being what they are it's a no-go for the vast majority of people).

HTC is close to releasing a wireless module for the Vive. Combine that with their next-generation headset, with the screen-door effect mostly gone and much higher resolution, and I think we'll have something. Still need the sensors, but those aren't that large.

You're forgetting the $1200+ PC to plug it into (that's @ MSRP, if you were to build it today it's more like $2k)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#123

Post by 8bitsrule »

I'm -constantly- seeing 'certificate expired' in my browser. This certificate stuff is so hard that they can't pay some Chief Certificate Officer $15/hr. to -do nothing else- but assure that stuff is renewed in a timely fashion?

We furry 'self-reproducing' (YMMV) mammals are simply not ready for all of this.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#124

Post by Sylos »

taberiand wrote: post #84
sdrothrock wrote: post #79

Earlier quoted context omitted.

I work with time a lot and have always advocated running practical simulations, especially over year changes, leap year changes, leap year days, etc. with the junior engineer I mentor as well as the hardware company that partners with us -- it's only recently after we got bitten by a time-based bug that people have started listening.

Of course, if they had listened and therefore never been bitten, they would have seen the work as a waste of time.

I mean, they would have noticed when a test actually runs into a problem, but yeah, it's not nearly as visible as something actually going wrong in production.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#125

Post by IncRnd »

sebazzz wrote: post #7
legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

This also suggests that if the decide they stop supporting it, eventually the software will stop working due to these certificate errors for which will then there be no fix.

It may appear to suggest that, but it doesn't. These are code signing certificates not TLS. The certificate isn't for the executable but for the ability to sign an executable. If you update an executable with a new executable that was signed with a certificate that was expired at the time of signing, then you will encounter the issue.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#127

Post by wtallis »

ryanlol wrote: post #116
wtallis wrote: post #112

Earlier quoted context omitted.

That puts the blame on Oculus, but the blame really should rest on Microsoft for enabling and enforcing a signature mode that shouldn't exist at all.

Does that really not sound ridiculous to you? Microsoft needs to be blamed for their certificate validation implementation because people might use it to make their software expire? Instead of just writing code that does so?

Microsoft's driver signing model has a mode that is a giant footgun with no redeeming value. Oculus is a victim of Microsoft's bad design. They weren't trying to build in a self-destruct timer for their whole product stack, and if they were, they wouldn't have used the driver signing certificate as the lynchpin.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#128

Post by gambler »

StavrosK wrote: post #15

Why is it possible for a device that is basically a display to stop working because a certificate expired? This future worries me.

This kind of stuff worries me as well. Security experts generally don't seem to give a fuck about things being unusable due to security systems "Working as Designed". It just doesn't factor into their analysis. As long systems are not "compromised" in some narrowly defined sense, everything is considered fine.

Generally this attitude doesn't backfire, because individual users loosing access to their data, their accounts or their software can be simply dismissed. But in this case it happened to everyone at once, so it's suddenly a big deal.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#129

Post by wtallis »

slededit wrote: post #114
wtallis wrote: post #98

Earlier quoted context omitted.

> The expiration date is the fallback if you don't have confirmation from the timestamp server that it was signed prior to expiration. The fact that the driver was installed locally before the expiration should be taken as proof that the driver was signed before expiration.

Then you would need an internet connection just to install a driver. It would make getting your network driver installed pretty difficult. You could look at the system clock but that was not designed to be secure for this purpose.

> Then you would need an internet connection just to install a driver.

If you think I'm proposing any changes to how drivers are installed, then you have misread me. I'm proposing a change to how already-installed drivers are handled: absent any new information, the code that was trusted yesterday should be trusted today, and be allowed to keep running.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#130

Post by paulddraper »

Ajedi32 wrote: post #117
lopmotr wrote: post #81

Earlier quoted context omitted.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

> Certificates aren't supposed to stop working just because they've expired! Except TLS certs. That's the whole point of those certs having an expiration date in the first place.

And of course, those are meant to operate in this crazy interconnected madness.
Post reply on HN