Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

151–160 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#151

Post by cheeze »

ahelwer wrote: post #27
rb808 wrote: post #17

Has anyone got a good way of managing certificates in the wild? With no real management and staff turnover I've seen a bunch of expired certificate problems. EDIT: presumably you need your client apps/libraries in the field write back when they use a cert that is <X months away from expiry.

You can use secret management systems like Azure Key Vault to auto-roll/renew secrets, but your applications have to be built to use such systems. (disclaimer: work for Azure, but not on Key Vault)

Never trust somebody else to make sure your certificate is renewed.

Case in point: Even Azure had a huge outage due to cert issues (abeit quite a bit more complicated than a simple expiration, but my point here is that certificates are hard.)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#152

Post by jasonlotito »

r1ch wrote: post #23

This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can prove that the certificate was valid at the time of signing. It would appear that Oculus signed their binaries without using a timestamp server, so without a way to verify when signing happened they become invalid as soon as the cert expires.

Apparently this was changed in a recent update (1.22 to 1.23 iirc). In 1.22, it would have been fine.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#153

Post by wtallis »

wolco wrote: post #148
wtallis wrote: post #141

Earlier quoted context omitted.

TLS certificate expiration tells your browser to stop downloading new pages from that site. It doesn't tell your browser to close the page that's already been rendered and is still on-screen.

But you are making new requests to the Oculus api and that part is failing. You wouldn't expect the ajax requests to continue to work just because you left your browser open for years.

> But you are making new requests to the Oculus api and that part is failing.

Cloud-based APIs aren't the only thing that's broken. Locally-installed code is being prevented from running.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#154

Post by metavrsl »

stryk wrote: post #55
legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

Call me when it's a wireless & self-contained unit. Until then, I just cannot honestly see it taking off in the commercial space. Industrial & enterprise-ish use maybe, but to regular consumers hell no. It's still a mess of wires and sensor installation, not to mention you still need that high-end gaming PC (and with the prices of GPUs being what they are it's a no-go for the vast majority of people).

Oculus is working on their 'Santa Cruz' headset which they've already demoed to journalists. It's a standalone 6DOF headset with tracked controllers.

https://www.theverge.com/2017/10/12/16463844/oculus-santa-cr...

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#155

Post by mattnewton »

andrewstuart2 wrote: post #82
Retric wrote: post #53

Earlier quoted context omitted.

Which just means the expiration date is meaningless. If the driver was valid when it was signed, then revoking it will break the system. Not installing it is another story.

The expiration date is the fallback if you don't have confirmation from the timestamp server that it was signed prior to expiration. Ideally it's not used except by the timestamp service, but it seems like a fairly reasonable fallback.

Can’t Microsoft give you an error report when they do this, to let you know what you are doing is probably very dumb?

I guess I don’t know the time when Microsoft has their code and heir contact information and is doing some kind of preflight check, or if that ever actually happens, and there are already so many ways to be very dumb with drivers...

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#156

Post by CookieMon »

tomcam wrote: post #72
jimrandomh wrote: post #36

Earlier quoted context omitted.

It's more complex than a display; it's a display plus a collection of USB sensors and some low-level hooks into display management. This requires kernel-mode drivers, for good technical reasons, where a normal monitor wouldn't.

Why should the Rift fail when a certificate expires?

I imagine someone went to a site like this:

https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...

read the command for signing their code, and signed their code as instructed.

Today, the certificate they signed a driver with expired, and because the signature wasn't timestamped it means Windows can't know if the driver was signed with the certificate after it expired, so the signature is now treated as expired as well, so Windows doesn't trust the driver.

Why wasn't it timestamped? Probably because instructions like the link above treat that as a separate subject to signing your code, and when you sign your code it looks and works like it's fully correctly signed.

or, as wtallis puts it (https://news.ycombinator.com/item?id=16542204), someone left a foot-gun lying around that didn't have much value except to cause incidents like this.

...and if your own company makes Windows apps, go check they are timestamped ;)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#157

Post by itronitron »

aresant wrote: post #66
Gargoyle wrote: post #51

Earlier quoted context omitted.

Sure. But meanwhile my 10 year old nephew is having life shaping experiences with the Rift I set up for him.

I'd love to hear you expand on that comment. I've been surprised how many investors / technologists view VR as a niche market for enterprise / porn / limited gaming appeal.

having an expensive toy instantly rendered useless by a software update is a life shaping experience :)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#158

Post by flamedoge »

wtallis wrote: post #127
ryanlol wrote: post #116

Earlier quoted context omitted.

Does that really not sound ridiculous to you? Microsoft needs to be blamed for their certificate validation implementation because people might use it to make their software expire? Instead of just writing code that does so?

Microsoft's driver signing model has a mode that is a giant footgun with no redeeming value. Oculus is a victim of Microsoft's bad design. They weren't trying to build in a self-destruct timer for their whole product stack, and if they were, they wouldn't have used the driver signing certificate as the lynchpin.

you can't guard against every imaginable stupidity. you try but users will inevitably find a hole.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#159

Post by eksemplar »

lopmotr wrote: post #81
r1ch wrote: post #23

This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can prove that the certificate was valid at the time of signing. It would appear that Oculus signed their binaries without using a timestamp server, so without a way to verify when signing happened they become invalid as soon as the cert expires.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

> Certificates aren't supposed to stop working just because they've expired!

That’s exactly how they are supposed to work. In the public sector we rely heavily on certificates for inter sector communication for instance, if certificates kept working despite being invalid it would put security at risk.

You’re supposed to build your software with an enterprise certificate store in mind though, meaning you can auto renew and distribute certicates when needed.

I really don’t see the point of adding a certificate to your television though, even if it is a tv that you wear on your head.

Post reply on HN