Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

191–200 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#191

Post by Piskvorrr »

KMag wrote: post #106
lopmotr wrote: post #81

Earlier quoted context omitted.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

Well, either it shouldn't have stopped working, or it never should have worked in the first place. It's arguable that no signed software should run without the code signature being timestamped/signed by a trusted timestamp server. Otherwise, simple developer laziness causes 99% of software to stop running a couple years after being published. On the other hand, maybe this is really a lazy feature. It's probably a goo…

Wonderful, let's just autokill all abandoned software out of laziness. I can think of multiple programs that I use which haven't been updated in years, sometimes because there is nobody to develop them (project was cancelled/company ceased to exist/sole developer got fed up and quit/whatever). What are my options? Get a crappier but new alternative, or nothing - just because someone thinks "old == bad" (Meanwhile, new and drool-proof programs tend to exhibit the same bugs of old, despite having been sprinkled with magic memory-safe dust and blessed by current signature)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#192

Post by tudorw »

mattnewport wrote: post #181

Our VR surgical training startup has been working for the last few months towards a big medical conference this week where we're showing multiple training procedures for multiple customers on Oculus Rift, as well as having our own booth. The headsets all stopped working the morning of the conference. Fortunately one of our engineers figured out we could get our demo rigs working by setting the clock back a few days.…

Give the engineer the day off, that's classic side think :)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#193

Post by moccachino »

tudorw wrote: post #192
mattnewport wrote: post #181

Our VR surgical training startup has been working for the last few months towards a big medical conference this week where we're showing multiple training procedures for multiple customers on Oculus Rift, as well as having our own booth. The headsets all stopped working the morning of the conference. Fortunately one of our engineers figured out we could get our demo rigs working by setting the clock back a few days.…

Give the engineer the day off, that's classic side think :)

The engineer went on to figuring out that if he set management's clocks back a few days he could take them off, since management clearly remembered him being on premises for those days.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#194

Post by nikanj »

Piskvorrr wrote: post #191
KMag wrote: post #106

Earlier quoted context omitted.

Well, either it shouldn't have stopped working, or it never should have worked in the first place. It's arguable that no signed software should run without the code signature being timestamped/signed by a trusted timestamp server. Otherwise, simple developer laziness causes 99% of software to stop running a couple years after being published. On the other hand, maybe this is really a lazy feature. It's probably a goo…

Wonderful, let's just autokill all abandoned software out of laziness. I can think of multiple programs that I use which haven't been updated in years, sometimes because there is nobody to develop them (project was cancelled/company ceased to exist/sole developer got fed up and quit/whatever). What are my options? Get a crappier but new alternative, or nothing - just because someone thinks "old == bad" (Meanwhile, ne…

My browser refuses to connect to a large number of websites, because they're still following the SSL best practices from last week. Apparently this is the reality we've decided to live in.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#195

Post by nikanj »

JohnTHaller wrote: post #171
eksemplar wrote: post #159

Earlier quoted context omitted.

> Certificates aren't supposed to stop working just because they've expired! That’s exactly how they are supposed to work. In the public sector we rely heavily on certificates for inter sector communication for instance, if certificates kept working despite being invalid it would put security at risk. You’re supposed to build your software with an enterprise certificate store in mind though, meaning you can auto rene…

Code signing certificates are different from website certificates. When you use a code signing certificate - when doing it right, anyway - you also loop in a timestamp server. That way, you're signing it with your currently valid certificate and a third party is proving it was signed at a time the certificate is valid. This is so that when your code signing certificate expires in a few months, the binary you signed w…

I guess they see that as a feature. Maybe the old version of Firefox wasn't as anal with DRM as the current version is.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#196

Post by ksrm »

nbsd4lyfe wrote: post #186
andrewmcwatters wrote: post #96

Earlier quoted context omitted.

I was just reading something here about Cairo and how it's easy to fall into slow code paths with it, and if you happened across falling into a slow code path, somewhere along the line, "you fucked up." When I read the comment I was immediately flabbergasted: no, someone else fucked up. It's not my fault someone wrote software that sets up undocumented traps for me to fall into. Or provided three ways to do something…

Cairo is currently desperately asking for development help, so uhh... https://people.gnome.org/~federico/blog/helping-cairo.html

"so uhh..."?

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#197

Post by Piskvorrr »

jlgaddis wrote: post #165
wtallis wrote: post #127

Earlier quoted context omitted.

Microsoft's driver signing model has a mode that is a giant footgun with no redeeming value. Oculus is a victim of Microsoft's bad design. They weren't trying to build in a self-destruct timer for their whole product stack, and if they were, they wouldn't have used the driver signing certificate as the lynchpin.

I find this reasoning ("footgun", Microsoft's fault) interesting when compared to the prevalent HN opinions when it comes to, for example, (unsecured) redis and memcached servers being used in DDoS attacks, or even AWS S3 buckets (with confidential or even highly classified files) being -- inadvertantly -- left wide open to the public. In those cases, "we" (as a "community", in general) often blame the people respons…

Interesting. I would think that opening unsecured services on to the Internet at large is a big no-no; and that whoever sets the default-allow is the one who's setting the trap here. Yes, the admin should inspect any installation for traps, but that's, as you note, secondary to "don't ship software which has a highly convenient trap set up". Most software traditionally exposed to the Internet did manage to do that, back in the early 2000s (by shipping default config `interfaces=lo` or somesuch), nobody should get a free pass on that, MS or not.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#199

Post by babuskov »

Piskvorrr wrote: post #188
konschubert wrote: post #187

Earlier quoted context omitted.

He said it's a surgical training startup so I think it would have been fairly okay.

Those things aren't cheap for simulators, either - not to mention knock-on costs. "What do you mean - I got the doctors in, which alone took a month of herding cats, and now it won't work, just because?" How low has the SW development bar gone, if "it's okay" now means "at least it's not directly killing people"?

> How low has the SW development bar gone, if "it's okay" now means "at least it's not directly killing people"?

I though that was the way ever since OS/2 failed. Getting stuff out to customers has priority over quality control.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#200

Post by Piskvorrr »

jlgaddis wrote: post #170
megaman22 wrote: post #149

Earlier quoted context omitted.

It's a mess. At one point we had a backup domain controller that had gotten incorrectly setup as a time server, and was out of sync with the rest of the world, with a slight amount of drift. Randomly, our test servers would end up syncing time from that server at times, and wind up slightly off. When the time got slightly more than around five or ten minutes off, connections (over TLS encryption) from those boxes to…

In the world of Active Directory (Kerberos), issues will start appearing when time is off by as little as five minutes.

As they should. Five minutes off is not a big deal for a grandfather clock, but it is for most crypto.
Post reply on HN