So it's impossible to use Oculus headset locally without runtime calling home and checking something?
It's a Facebook product... Did you expect any different?
All of Oculus’s Rift headsets have stopped working due to an expired certificate
21–30 of 390 posts
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#22Why is it possible for a device that is basically a display to stop working because a certificate expired? This future worries me.
Because it was the certificate for the Windows driver, and Windows requires signed drivers.
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#23This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can prove that the certificate was valid at the time of signing. It would appear that Oculus signed their binaries without using a timestamp server, so without a way to verify when signing happened they become invalid as soon as the cert expires.
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#24Has anyone got a good way of managing certificates in the wild? With no real management and staff turnover I've seen a bunch of expired certificate problems. EDIT: presumably you need your client apps/libraries in the field write back when they use a cert that is <X months away from expiry.
I'd say someone very high up and "tied to the company", probably the CTO, should make sure a signing certificate is renewed when needed and make sure it's rotated every time it's about to hit expiration. For a company as big as oculus with the backing of Facebook, this is a pretty big issue.
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#25Has anyone got a good way of managing certificates in the wild? With no real management and staff turnover I've seen a bunch of expired certificate problems. EDIT: presumably you need your client apps/libraries in the field write back when they use a cert that is <X months away from expiry.
Monitors
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#26So it's impossible to use Oculus headset locally without runtime calling home and checking something?
It's not phoning home (or at least if it is that's not the issue here). The cert used to sign the actual binaries expired, and Oculus signed the binaries in a half-assed fashion that tells windows not to run the code with an expired cert-- what they should have done is timestamped[0] when the signature was created. Since the binaries were signed before the cert expired, nothing should've broken. This is one of those cases that required a perfect storm of multiple mistakes/oversights.
[0] https://msdn.microsoft.com/en-us/library/windows/desktop/bb9...
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#27Has anyone got a good way of managing certificates in the wild? With no real management and staff turnover I've seen a bunch of expired certificate problems. EDIT: presumably you need your client apps/libraries in the field write back when they use a cert that is <X months away from expiry.
You can use secret management systems like Azure Key Vault to auto-roll/renew secrets, but your applications have to be built to use such systems.
(disclaimer: work for Azure, but not on Key Vault)
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#28Saw this, opened Oculus Home, there's a message in the Updates tab saying "An update may not have installed correctly", and indeed, VR apps didn't work.
Nate Mitchell of Oculus posted on Reddit saying "We're working on resolving this issue right now. We'll keep everyone posted on progress here." https://www.reddit.com/r/oculus/comments/82nuzi/cant_reach_o... . Top-level of that thread has a workaround involving setting the clock back or using a utility called RunAsDate to fake the clock for a single application.
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#29Has anyone got a good way of managing certificates in the wild? With no real management and staff turnover I've seen a bunch of expired certificate problems. EDIT: presumably you need your client apps/libraries in the field write back when they use a cert that is <X months away from expiry.
I'd say someone very high up and "tied to the company", probably the CTO, should make sure a signing certificate is renewed when needed and make sure it's rotated every time it's about to hit expiration. For a company as big as oculus with the backing of Facebook, this is a pretty big issue.
I’d expect at Facebook’s scale, they’d have a PKI management team, and this would’ve gone through their certificate lifecycle management process.
Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate
#30Why is it possible for a device that is basically a display to stop working because a certificate expired? This future worries me.
Because it was the certificate for the Windows driver, and Windows requires signed drivers.
The problem isn't that Windows requires drivers to be signed. The problem is that Windows allows drivers to have an expiration date. If Windows verifies a driver's signature at the time the driver is installed, the driver should be considered trustworthy for as long as it remains installed on that system. There's no reason to re-verify the signature every time the driver is used.