Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

211–220 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#211

Post by imtringued »

tritium wrote: post #20

Beside the fact that you should be concerned about whether the controlling company goes out of business, or sells your data, here stands yet another reason to never trust devices that require an internet connection to activate in the first place, or phone home periodically to remain active. This includes phones, cars, self-driving cars, watches, farm equipment, computing devices and anything marketed as an IoT applia…

The problem here is that kernel drivers have to be signed and drivers will stop working if the signature expires because the vendor didn't use a time stamp server during the signing process. The drivers were clearly indended to keep working so I assume this happened by accident.

The big question is why on earth can drivers that have been verified and are already installed in your system can suddenly stop working? If this mechanism is intended to protect against malware disguised as drivers then it's already too late. The malware had several years to exploit your system.

Expiration after installation simply doesn't make sense for code signing. The signed executable won't change unlike a website. The driver is always going to have the same file hash, forever.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#212

Post by whywhywhywhy »

p1necone wrote: post #43
legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

I see the exclusives as a negative. I don't want to support their efforts to build a closed ecosystem around what should be an open API that any headmounted display + tracking can expose.

> I see the exclusives as a negative

Would anyone with a straight face say the same about Nintendo's exclusives?

I don't see anyone else in the market funding great things like Medium, Quil, Lone Echo, Robo Recall. Feels it's just cutting off your nose to spite your face to complain about this.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#213

Post by whywhywhywhy »

moloch wrote: post #75
rock_hard wrote: post #54

Earlier quoted context omitted.

You realize that this is the only way to fund triple AAA content for the time being though, right? Oculus is producing these at a loss given the current size of the market hoping it will pay out in the long term by growing a healthy ecosystem...it’s the only way

Steam VR/Vive has "AAA" non-exclusive titles.

It also has exclusives, Fallout VR for instance.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#214

Post by CookieMon »

tallanvor wrote: post #207
CookieMon wrote: post #156

Earlier quoted context omitted.

I imagine someone went to a site like this: https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... read the command for signing their code, and signed their code as instructed. Today, the certificate they signed a driver with expired, and because the signature wasn't timestamped it means Windows can't know if the driver was signed with the certificate after it expired, so the signature is now treated as expi…

Your same link also explains how to sign a file with a timestamp as well, and contains a link on how to add a timestamp after the fact. It doesn't pretend to know what the best practice is for your specific use case of the signing tool is. But you can also find places where Microsoft does talk about when you should be timestamping: https://blogs.msdn.microsoft.com/ieinternals/2011/03/22/ever...

> Your same link also explains how to sign a file with a timestamp as well

Sure, further down it explains how to use signtool to timestamp something, but why would someone trying to get an app signed care about using the tool for timestamping?

> where Microsoft does talk about when you should be timestamping

If someone finds that article first, and reads to the bottom of it, it explains that timestamping is related and important and says the times you should be timestamping are "you should definitely do this", so perhaps a design that isn't a foot-gun would have "do this" as the default, with a --force option and alarmist warnings for anybody who has a reason to have their signed executables expire one day.

Design oversights and user mistakes like these will happen, but it doesn't mean influences and causes can't be identified and improved.

(most of the builds at the company I work for had not been timestamped either)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#215

Post by lclarkmichalek »

ryanlol wrote: post #209
wtallis wrote: post #127

Earlier quoted context omitted.

Microsoft's driver signing model has a mode that is a giant footgun with no redeeming value. Oculus is a victim of Microsoft's bad design. They weren't trying to build in a self-destruct timer for their whole product stack, and if they were, they wouldn't have used the driver signing certificate as the lynchpin.

So instead of trying to conform to the x.509 spec MS should have just developed their own certificate validation scheme, because that would totally be less of a "footgun" than conforming to the spec. Am I getting this right? Why aren't we blaming the people behind RFC5280, after all it was them who came up with this awful idea that certificates should expire. >giant footgun oh dear god how are you generating your cer…

FWIW, there are basically no common implementations that fully conform to the x.509 spec. That thing is a bundle of unimplemented features.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#216

Post by mathieubordere »

tallanvor wrote: post #205
gmueckl wrote: post #189

Earlier quoted context omitted.

And that's where MS is at fault: drivers without timestamped signatures should be treated as faulty. This would prevent these errors in the first place.

I guess I can see reasons why some companies may want to be able to produce time-limited drivers: Maybe they want beta versions to stop working, forcing users to upgrade. For offline computers, it might be that some companies would see this as a way to enforce contract periods (customers would have to install an update to continue using the product when their contract is renewed). Of course, disabling driver signatur…

Maybe the API should then explicitly ask for a 'timestamp-none' in case the driver needs to be time-limited, forcing the developer to at least think about it.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#217

Post by majewsky »

maxander wrote: post #48

One wonders if we've made technology unnecessarily complicated. In order to build something like the Oculus Rift, they obviously needed expertise in hardware design, optics, display technology, manufacturing, user interface design, etc etc. Also, they apparently needed expertise in managing the ins-and-outs of the Windows driver security system. Adding one more subject to their already crowded curriculum wasn't very…

> One wonders if we've made technology unnecessarily complicated.

I think we're waaaay past the "wondering" part.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#218

Post by ericflo »

whywhywhywhy wrote: post #212
p1necone wrote: post #43

Earlier quoted context omitted.

I see the exclusives as a negative. I don't want to support their efforts to build a closed ecosystem around what should be an open API that any headmounted display + tracking can expose.

> I see the exclusives as a negative Would anyone with a straight face say the same about Nintendo's exclusives? I don't see anyone else in the market funding great things like Medium, Quil, Lone Echo, Robo Recall. Feels it's just cutting off your nose to spite your face to complain about this.

Google has funded Tiltbrush and Blocks and released it for every VR platform. We need to grow the industry. But this isn't their biggest problem - that would be their extremely walled-off app store. Oculus must still see their platform as a kind of gaming console and not the future of computing? What a shame.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#219

Post by johnchristopher »

babuskov wrote: post #199
Piskvorrr wrote: post #188

Earlier quoted context omitted.

Those things aren't cheap for simulators, either - not to mention knock-on costs. "What do you mean - I got the doctors in, which alone took a month of herding cats, and now it won't work, just because?" How low has the SW development bar gone, if "it's okay" now means "at least it's not directly killing people"?

> How low has the SW development bar gone, if "it's okay" now means "at least it's not directly killing people"? I though that was the way ever since OS/2 failed. Getting stuff out to customers has priority over quality control.

Disrupt, innovate, first-mover advantage, growth marketing, yadaa-yadaa.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#220

Post by Agnosco »

moccachino wrote: post #193
tudorw wrote: post #192

Earlier quoted context omitted.

Give the engineer the day off, that's classic side think :)

The engineer went on to figuring out that if he set management's clocks back a few days he could take them off, since management clearly remembered him being on premises for those days.

Simple and elegant.
Post reply on HN