Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

221–230 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#221

Post by ryanlol »

lclarkmichalek wrote: post #215
ryanlol wrote: post #209

Earlier quoted context omitted.

So instead of trying to conform to the x.509 spec MS should have just developed their own certificate validation scheme, because that would totally be less of a "footgun" than conforming to the spec. Am I getting this right? Why aren't we blaming the people behind RFC5280, after all it was them who came up with this awful idea that certificates should expire. >giant footgun oh dear god how are you generating your cer…

FWIW, there are basically no common implementations that fully conform to the x.509 spec. That thing is a bundle of unimplemented features.

Hence "trying to" :)

However, I'd argue that disregarding the Validity section would be an unusually big departure from the spec, not comparable to the typical silliness surrounding x.509.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#222

Post by marcosdumay »

tallanvor wrote: post #205
gmueckl wrote: post #189

Earlier quoted context omitted.

And that's where MS is at fault: drivers without timestamped signatures should be treated as faulty. This would prevent these errors in the first place.

I guess I can see reasons why some companies may want to be able to produce time-limited drivers: Maybe they want beta versions to stop working, forcing users to upgrade. For offline computers, it might be that some companies would see this as a way to enforce contract periods (customers would have to install an update to continue using the product when their contract is renewed). Of course, disabling driver signatur…

Do you have any reason that is good from the point of view of the computer owner? (You know, the one sending money to Microsoft.)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#223

Post by ams6110 »

konschubert wrote: post #187
fijal wrote: post #185

Earlier quoted context omitted.

Imagine how terrible it would be for your customers once that happened in the production....

He said it's a surgical training startup so I think it would have been fairly okay.

Yes, but it's an interesting question to ponder. The last decade or two government and Military procurement has been leaning more heavily towards COTS (commercial off-the-shelf ) hardware and software. The thought was it's cheaper and possibly more reliable than the bespoke solutions that vendors were delivering in the past. Now we see that it isn't a guarantee of anything. Though still probably cheaper, at least initially.

Something like this probably will happen with computer assisted surgery or medical procedures, or an aircraft in flight. Just a matter of time.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#224

Post by ryanlol »

josteink wrote: post #210
IncRnd wrote: post #119

Earlier quoted context omitted.

It's not an expiration on the signed executable but an expiration on the ability of the certificate to sign an executable.

This is the exact right answer. And for this to work at all, the signature needs a timestamp so that the OS can know that the certificate was valid at the time of signing. But for some reason (signtool.exe, etc) makes it really hard to get this done properly. This is especially true in a CI-setting, where this is one of those areas where signing and timestamping essentially makes a reliably and deterministic process…

>This is especially true in a CI-setting, where this is one of those areas where signing and timestamping essentially makes a reliably and deterministic process (compiling code) into a unreliable and non-deterministic process, because builds can now fail randomly based on the state of a online timestamping service.

Why are you signing your drivers during development? If not, how is the "unreliability" of timestamping services an issue? You probably can't push your stuff to prod without timestamps anyway.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#226

Post by Grollicus »

retromario wrote: post #198

For those affected, Oculus now has a patch to fix the issue: https://support.oculus.com/217157135500529/

> If Windows Defender prompts "Windows protected your PC", click More info and then click Run anyway.

> If your antivirus software restricts the file from opening, temporarily disable your AV and continue.

Good Patch Procedure, 2018.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#228

Post by Angostura »

JohnTHaller wrote: post #171
eksemplar wrote: post #159

Earlier quoted context omitted.

> Certificates aren't supposed to stop working just because they've expired! That’s exactly how they are supposed to work. In the public sector we rely heavily on certificates for inter sector communication for instance, if certificates kept working despite being invalid it would put security at risk. You’re supposed to build your software with an enterprise certificate store in mind though, meaning you can auto rene…

Code signing certificates are different from website certificates. When you use a code signing certificate - when doing it right, anyway - you also loop in a timestamp server. That way, you're signing it with your currently valid certificate and a third party is proving it was signed at a time the certificate is valid. This is so that when your code signing certificate expires in a few months, the binary you signed w…

What makes you think this was a code-signing certificate? The fact that the error involves the inability to reach a server suggests strongly that it was a TLS cert or somesuch

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#229

Post by boobsbr »

Angostura wrote: post #225

Note for company communication guys. Please, please don't say: "Our teams apologize for any inconvenience this may be causing you" instead opt for "Our teams apologize for any inconvenience this caused you"

Why?

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#230

Post by nottorp »

So you're saying Rifts and Windows 10 drivers do not work offline? That basically Windows 10 will be functional only while Microsoft keeps the update servers on?

Edit: I don't follow Windows, I'm really curious what the consequences for stuff like this can be generally.

Post reply on HN