Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

301–310 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#301
post #106
post #81

Earlier quoted context omitted.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

Well, either it shouldn't have stopped working, or it never should have worked in the first place. It's arguable that no signed software should run without the code signature being timestamped/signed by a trusted timestamp server. Otherwise, simple developer laziness causes 99% of software to stop running a couple years after being published. On the other hand, maybe this is really a lazy feature. It's probably a goo…

If the license that is presented to the user for acceptance doesn't include specific termination dates, or as is common in most consumer software specifically states the license is non-terminating, then any product that stops because a certificate expires is a flat out violation of the agreement and every single user should promptly sue the publisher for 100% of their money back plus any damages. And, in my opinion, this sort of thing is not accidental, so it should penetrate the corporate veil that protects individuals from liability.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#302
post #253

Earlier quoted context omitted.

Firefox and Chrome give me that warning page, but I just click on "Advanced" and it will let me continue to the website. At least for me, it's just a huge warning to be careful but I still have ultimate control.

Watch Google decide that the advanced option is a security problem, and remove it, and Mozilla gladly playing along because "security" and "users are dumb". The "owner" is no longer in control, and has not been ever since the web became "app-ified".

Browsers already do this with HSTS.

https://tools.ietf.org/html/rfc6797#section-12.1

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#304
post #274

Earlier quoted context omitted.

The "monitor you wear on your face" trope is simply inaccurate, and essentially a misunderstanding of the state of VR today. I say this not to either criticize you or excuse the mistake by Oculus (they really needed to countersign their cert with a timestamp server), but to educate. These are non-obvious issues to people that don't follow the VR sector. Monitors work without low-level drivers because their maturity (…

You said a cert is required, but the footnote quote says drivers must be signed. Being signed doesn't expire. Could you rectify the discrepancy and explain why an expiring cert is a requirement for VR, your analysis (though clearly highly informed) seems spurious to me.

Rereading your question, I realize I may have not actually answered an underlying topic: what is the difference between a certificate and a signature?

The short answer is:

- a "certificate" contains a number of things: a portion of an asymmetric key (either public or private), and a ton of metadata[1] to give information about that key: validity period, algorithms used, version, etc.

- a "signature" is the result of a crypto operation on data that proves the data (a) has not changed since the operation, and (b) the person doing the signing owns the private portion of that asymmetric key.

As I said in my other message, a signature doesn't expire, but it's related directly (and generated by) the certificate used to create it. So if that creation certificate expires (or is revoked) it calls into question the validity of the signature(s) created from that certificate.

Let me know if you're interested in more background on asymmetric cryptography and the relationship between public keys and crypto, private keys and signatures, and the role of certificate authorities vs. a PGP-oriented 'web of trust'.

[1] https://en.wikipedia.org/wiki/X.509#Sample_X.509_certificate...

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#305

Earlier quoted context omitted.

As a medical device, I would expect that this possibility would have been caught very early on in one of any number of Failure Analysis meetings and mitigated by the time the device made it to the (FDA) certification process.

Our product is a training aid for medical professionals and is not regulated as a medical device, in the same way that a flight simulator is not regulated as an aircraft.

Oh, I got that. I was replying to the person who was wondering what would happen if it was being used for actual surgery.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#306
post #274

Earlier quoted context omitted.

It's not like a cert is necessary for it to function. A VR headset is basically a monitor you wear on your face. This is their own poor design choice that just ensures they're going to lose business of anyone who needs reliability in their headset.

The "monitor you wear on your face" trope is simply inaccurate, and essentially a misunderstanding of the state of VR today. I say this not to either criticize you or excuse the mistake by Oculus (they really needed to countersign their cert with a timestamp server), but to educate. These are non-obvious issues to people that don't follow the VR sector. Monitors work without low-level drivers because their maturity (…

Well, I am sorry to have to disagree on this. This is no rocket science, and the software support isn't that different from any standard monitor/gamepad combo. That's for the architecture, at least. Of course, latency requirements are higher. But the differences stops here.

Face it, today's VR headsets simply are monitors that you wear on your face (Head Mounted Displays). Anyone thinking otherwise is simply lying to himself to make it sound more complicated than it is. Those include a few input peripherals as well, none of them which is particularly complex (valve's lighthouse system is probably as complex as it gets).

And lastly, none of these points should require a certificate. Every computation can be done locally, without the need of an internet connection.

To be a bit more specific, let's break down the arguments (I have nothing against you, I am just interested in those):

> Monitors work without low-level drivers because their maturity (and lack of innovation) allows the hard stuff to be embedded in the operating system. VR is not at that state; it is emergent, and the capability stacks require additional integration into the OS. Vendors frequently add unique features, and will continue to do so for some time, making standardization difficult.

This is true... Somewhat. For now, the only integration that has been done in the Linux kernel is DRM (direct rendering manager) leasing [1], which allows an application to borrow full control of the peripheral, to bypass compositing. That, and making sure that compositors don't detect HMDs as normal displays (so that they don't try to display your desktop on them). Please note that none of these are actually needed if the compositor is designed to support HMDs from the ground up. Those are just niceties, and the HMD is just considered like a regular device.

> Even at its simplest level, a VR headset with 6 degrees of freedom is two monitors that must remain in absolute synchronization while also returning positional information to the CPU. This alone is enough to go beyond "standard monitor driver" functionality.

Even if those monitors are physically separate, this is likely something handled by the HMD board itself. The monitors DON'T return positional information, they just display stuff (accelerometer, gyro, compass, etc. are just other peripherals that happen to sit on the same board).

> Oculus (and Steam, via SteamVR) engineers a plethora of low-level code to reduce latency and add features. It's not just a monitor, but a whole set of SDKs, APIs, devices, and drivers.

Just like every peripheral under the sun, isn't it?

> For the Rift, the hand controllers are wireless input devices refreshing at 1,000Hz; the sensors (to know where you are in the room) are USB devices with tight 60 fps synchronization to LEDs on the headset

Believe it or not, frequency and latency are probably not the most complicated thing with the lighthouse system; these specs are actually not uncommon for USB devices (I admit that I don't have a good example in mind, though).

> there is a custom audio stack with spacialized audio and ambisonic sound; video needs specialized warping to correct lens distortion, interpolate frames, and maintain a 90 fps image, etc.

We are NOT talking about HMDs anymore at this point, and these feats have been accomplished countless times already, in various systems. The first one already exists in multiple forms of HRTF a bit everywhere, including openAL, and would probably be a lot more common if Creative didn't try to sue everyone into the ground as soon as they try to do something interesting. The second thing (distortion correction) is not really complicated, and was done in Palmer Luckey's first proof of concept (or was it John Carmack who implemented it). Interpolation sounds a bit more complicated, I'll grant you that, but still pretty doable.

> Not to mention, the system creates a virtual monitor so you can see your 2D desktop while in VR. You can reach out and "grab" a window, rip it from the desktop and position it in your VR world. Pin it, and when you enter a game that window remains and is fully interactive with the Touch controllers emulating a mouse. Maybe you want to play Spotify in the background of a table tennis game, or be able to check a Discord screen while working through a puzzler, or watch YouTube videos while flying your ship in Elite:Dangerous. One guy set up a video feed from his baby monitor so he could watch his kid napping while in VR. This is obviously not a standard feature of the Windows compositor.

Again, this has nothing to do with HMDs. But, congratulation, you just wrote another compositor, and reinvented multitasking. This has been done countless times, and VR compositors have been made by multiple teams. Here is a nice open source one: [2].

> All this needs to work across AMD and Nvidia, in Unity, Unreal, or any custom game engine. It's not off-the-shelf driver stuff.

Well, so has: controller support, graphics API support (woops, actually the two only thing needed), but also language support, processor architecture support, sound system support, operating system support, etc. Everyone needs a bit of code to support new architectures. Supporting the display portion of a HMD is relatively straightforward, and actually uses off-the-shelf APIs. Well, you have to correct for distortion, but I would be surprised if some APIs didn't come out [3] to support small variations between devices.

--

To conclude, yes, it's an impressive technology stack, but you could literally pick any other device in your computer, and you would get comparable the same complexity. I am not trying to undermine the amount of work that went into HMDs and their stack, just pointing out that it's relatively common and straightforward.

And a HMD is by definition a monitor on your face :)

--

On the other hand, I just read the explanation (after writing this), and I agree that having your own kernel module makes sense for some of this (especially on Windows, on Linux you would just mainline support), if you want to make it happen faster. Yet, most of the above arguments do not serve the discussion ;)

I can get kernel drivers needing to be signed, but requiring the cert to remain valid after installation is a bit of a reach, isn't it?

Edit: thank you for the detailed explanation below.

[1] https://keithp.com/blogs/DRM-lease/

[2] https://github.com/SimulaVR/Simula

[3] https://github.com/ValveSoftware/openvr

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#307

Our VR surgical training startup has been working for the last few months towards a big medical conference this week where we're showing multiple training procedures for multiple customers on Oculus Rift, as well as having our own booth. The headsets all stopped working the morning of the conference. Fortunately one of our engineers figured out we could get our demo rigs working by setting the clock back a few days.…

Why are you basing medical appliance on such a walled-garden technology you aren't in control of, while there are more accessible alternatives? Oculus was already known for locking up fiascos, this really shouldn't be a surprise for you.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#308
post #257

Earlier quoted context omitted.

Well every comment thread on the Internet related to the Rift issue mentioned this as a solution so it probably wasn't his idea.

Yeah, but if he's the guy who Googled it, he should get the day off anyway if it wasn't really in his realm of responsibility. It seems ridiculous in this modern age, but there are a huge number of people who will never bother to look into their problems on their own before asking someone else. Then this other person does a simple Google search and becomes the hero expert. This all too often results in further depend…

Googling for computer problem solutions (or just generally) is a surprisingly nuanced skill. Sometimes one person finds in minutes what another fails to find in days, only because of slightly better search terms and faster (or more accurate) assessment of hit teasers.

Also, a lot of problems have their search engine results "poisoned" by solutions for lesser, but superficially similar problems that are worked to death by SEO content farms competing for attention.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#309
post #204

I've pointed out this consequence of "put TLS on everything" before, but people shrugged it off.

This has absolutely nothing to do with TLS.

You're right, TLS doesn't use certificates. What was I thinking?

https://en.wikipedia.org/wiki/Transport_Layer_Security#Digit...

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#310
post #75

Earlier quoted context omitted.

Steam VR/Vive has "AAA" non-exclusive titles.

It also has exclusives, Fallout VR for instance.

SteamVR (OpenVR) platform, which Fallout VR uses, supports Oculus Rift just fine, and so does OSVR. It's the other way around that needs hacky unofficial wrappers.
Post reply on HN