Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

291–300 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#291

Post by pbhjpbhj »

52-6F-62 wrote: post #74
aresant wrote: post #66

Earlier quoted context omitted.

I'd love to hear you expand on that comment. I've been surprised how many investors / technologists view VR as a niche market for enterprise / porn / limited gaming appeal.

Not the above commenter, but Google Earth VR is like something out of a sci-fi film from 20 years ago. I was sincerely impressed and enthralled. Of course, the more street views they can capture, the better it will get. There are other education experiences like BBC Home which is one of my favourites. Another, Mission:ISS allows you to explore the ISS and control the Canadarm to dock a module. Highly recommend them.…

Never heard of BBC Home before - http://www.bbc.co.uk/mediacentre/latestnews/2017/vr-spacewal....

I trust the developers aren't using license fee money but instead are paying for using the BBC name ...?

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#292

Post by WillPostForFood »

Eire_Banshee wrote: post #286
agar wrote: post #274

Earlier quoted context omitted.

The "monitor you wear on your face" trope is simply inaccurate, and essentially a misunderstanding of the state of VR today. I say this not to either criticize you or excuse the mistake by Oculus (they really needed to countersign their cert with a timestamp server), but to educate. These are non-obvious issues to people that don't follow the VR sector. Monitors work without low-level drivers because their maturity (…

Yeah but, certs are not necessary for the oculus rift to function.

Drivers are necessary for the rift to function, and certs are necessary for drivers to function.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#293

Post by ChristianGeek »

whywhywhywhy wrote: post #8
legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

> essentially bricking It's not bricked, bricking means it's as useful as a brick as in the actual firmware is corrupted beyond repair.

It’s virtually bricked.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#294

Post by digi_owl »

djpr wrote: post #253
nikanj wrote: post #194

Earlier quoted context omitted.

My browser refuses to connect to a large number of websites, because they're still following the SSL best practices from last week. Apparently this is the reality we've decided to live in.

Firefox and Chrome give me that warning page, but I just click on "Advanced" and it will let me continue to the website. At least for me, it's just a huge warning to be careful but I still have ultimate control.

Watch Google decide that the advanced option is a security problem, and remove it, and Mozilla gladly playing along because "security" and "users are dumb".

The "owner" is no longer in control, and has not been ever since the web became "app-ified".

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#295

Post by pbhjpbhj »

driverdan wrote: post #108
legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

You forgot - Owned by Facebook, who will use it to gather as much data about you as they can.

Cool, I wonder if they can gather movement data and recognise you in camera footage even when they can't see your face. I'm sure it will come, if it's not possible yet.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#296

Post by vetinari »

WillPostForFood wrote: post #292
Eire_Banshee wrote: post #286

Earlier quoted context omitted.

Yeah but, certs are not necessary for the oculus rift to function.

Drivers are necessary for the rift to function, and certs are necessary for drivers to function.

The signature of the driver doesn't expire when the certificate used does.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#297

Post by agar »

pbhjpbhj wrote: post #289
agar wrote: post #274

Earlier quoted context omitted.

The "monitor you wear on your face" trope is simply inaccurate, and essentially a misunderstanding of the state of VR today. I say this not to either criticize you or excuse the mistake by Oculus (they really needed to countersign their cert with a timestamp server), but to educate. These are non-obvious issues to people that don't follow the VR sector. Monitors work without low-level drivers because their maturity (…

You said a cert is required, but the footnote quote says drivers must be signed. Being signed doesn't expire. Could you rectify the discrepancy and explain why an expiring cert is a requirement for VR, your analysis (though clearly highly informed) seems spurious to me.

Good question. An expiring cert is not required for VR. It was a massive screw-up by Oculus.

Most (I won't say all) certificates expire. However, there's a huge difference between an expired certificate and one which is renders a driver invalid - and this is one of the two places Oculus erred.

When you sign a driver, you want it countersigned by a timeserver. This cryptographically assures that the cert used was valid at the time of signing, so the signature on the driver remains valid even if the signing cert expires (the crypto ensures a hacker can't just change the metadata with a hex editor). It allows the OS to confirm that the code was signed by a cert that was valid at the time of signature (even though now expired). Without it, the OS can only assume that the code was signed the same day as the validity check. Two days ago that was fine, but yesterday the signing cert expired and everything broke.

This was screw-up number one. Apparently, during the build process from Oculus's v.1.22 to 1.23 release, the timeserver countersignature was removed. This is obviously a mistake, because that took place about 30 days ago. No sane person would assume that they intentionally did something that would bring down their user base in a month.[1]

Obviously the second mistake was letting their certificate lapse. This was compounded by the fact that their update app was signed by the same cert, so they couldn't just push a quick fix (because the updater didn't work).

So in short, signatures don't expire, but the certificate used to do the signature does. With a timeserver countersignature the code would have kept running but no new code could be signed from the old (expired) cert.

Oculus missed some pretty big devops gaps, and suffered a big black eye for it.

But it had nothing to do with DRM, planned obsolescence, needing to connect to the internet, or Facebook data capture.

[1] Other commenters have mentioned that if a timeserver is down at the time of a build, it can fail to add the countersignature. Maybe that's what happened?

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#298

Post by agar »

vetinari wrote: post #296
WillPostForFood wrote: post #292

Earlier quoted context omitted.

Drivers are necessary for the rift to function, and certs are necessary for drivers to function.

The signature of the driver doesn't expire when the certificate used does.

See my other comment replying to someone in parallel to this one.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#299

Post by solatic »

wtallis wrote: post #175
jlgaddis wrote: post #165

Earlier quoted context omitted.

I find this reasoning ("footgun", Microsoft's fault) interesting when compared to the prevalent HN opinions when it comes to, for example, (unsecured) redis and memcached servers being used in DDoS attacks, or even AWS S3 buckets (with confidential or even highly classified files) being -- inadvertantly -- left wide open to the public. In those cases, "we" (as a "community", in general) often blame the people respons…

There's a use case for redis and memcached being open to the network, and a failure mode if you don't properly separate your internal network from the public Internet. There's a use case for S3 buckets that are publicly readable, if they don't contain sensitive/private information. Those features have reason to exist, even though there's potential for misuse. Secure defaults would be nice, but can't eliminate these r…

> There's no reason for drivers to have an expiration date

If you can license software with a definite expiration date, why can't you license hardware with a definite expiration date? And have your license enforced by the operating system? Imagine that I'm a company with a hardware product, and instead of selling that hardware at large expense, I rent it out, and provide drivers with an expiration date to enforce the terms of the hardware lease. If the lease is renewed, I'll provide new drivers with a new lease expiration.

Not that I'm arguing for hardware licensing, or arguing that it was what Oculus was trying to achieve and screwed up somehow. But there's a difference between "Microsoft built a feature some of their customers didn't know how to use" and "Microsoft built an anti-feature".

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#300

Post by mattnewport »

HeyLaughingBoy wrote: post #277
barkingcat wrote: post #262

Earlier quoted context omitted.

This does not bode well for real VR surgery. Imagine if this were surgery day for someone, and because of an expiring certificate the rift shuts down ...

As a medical device, I would expect that this possibility would have been caught very early on in one of any number of Failure Analysis meetings and mitigated by the time the device made it to the (FDA) certification process.

Our product is a training aid for medical professionals and is not regulated as a medical device, in the same way that a flight simulator is not regulated as an aircraft.
Post reply on HN