Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

51–60 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#51

Post by Gargoyle »

legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

Sure.

But meanwhile my 10 year old nephew is having life shaping experiences with the Rift I set up for him.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#52

Post by jsmthrowaway »

kbenson wrote: post #37
hesdeadjim wrote: post #32

Earlier quoted context omitted.

Perhaps as a malware defense?

I think that's better handled through a Certificate Revocation List (CRL), especially in this case where's it's fairly easy to enforce and keep up to date.

CRLs are pretty difficult to scale resiliently, though, for a number of applications. Same problem that led to OCSP stapling after OCSP became a thing. With CRLs you can at least take advantage of a CDN of some kind, but there are tradeoffs with your ability to operate a CRL securely doing that, too.

CRL in the driver install flow implies being online (at some point) to install drivers too. As we move into the future it’s hard to imagine not having Internet access, but we also don’t design Windows. It’s definitely a case they’ve considered, though I did see mention of a timestamp server in this thread (I don’t know much about Windows signing, just X.509 PKI in general).

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#53

Post by Retric »

ScottEvtuch wrote: post #50
phkahler wrote: post #46

Earlier quoted context omitted.

That seems silly. Presumably a cert has an expiration date after which we might assume its been compromised. If it has been compromised then it could have been used to backdate a driver signed with it. In other words, if you don't trust the cert you should not trust anything signed by it. Or is there another layer in this somewhere?

The timestamp server is a separate trusted entity that signs the signature asserting the date and time. It's not just metadata, it's effectively a separate signature.

Which just means the expiration date is meaningless.

If the driver was valid when it was signed, then revoking it will break the system. Not installing it is another story.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#54

Post by rock_hard »

p1necone wrote: post #43
legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

I see the exclusives as a negative. I don't want to support their efforts to build a closed ecosystem around what should be an open API that any headmounted display + tracking can expose.

You realize that this is the only way to fund triple AAA content for the time being though, right?

Oculus is producing these at a loss given the current size of the market hoping it will pay out in the long term by growing a healthy ecosystem...it’s the only way

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#55

Post by stryk »

legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

Call me when it's a wireless & self-contained unit. Until then, I just cannot honestly see it taking off in the commercial space. Industrial & enterprise-ish use maybe, but to regular consumers hell no. It's still a mess of wires and sensor installation, not to mention you still need that high-end gaming PC (and with the prices of GPUs being what they are it's a no-go for the vast majority of people).

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#56

Post by [deleted] »

jimrandomh wrote: post #36
StavrosK wrote: post #15

Why is it possible for a device that is basically a display to stop working because a certificate expired? This future worries me.

It's more complex than a display; it's a display plus a collection of USB sensors and some low-level hooks into display management. This requires kernel-mode drivers, for good technical reasons, where a normal monitor wouldn't.

[deleted]

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#58

Post by gruez »

Retric wrote: post #53
ScottEvtuch wrote: post #50

Earlier quoted context omitted.

The timestamp server is a separate trusted entity that signs the signature asserting the date and time. It's not just metadata, it's effectively a separate signature.

Which just means the expiration date is meaningless. If the driver was valid when it was signed, then revoking it will break the system. Not installing it is another story.

>Which just means the expiration date is meaningless.

how so? it merely limits which dates you can sign code, after which the code you signed remain valid, but you can't sign any more code.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#59

Post by gruez »

hesdeadjim wrote: post #32
wtallis wrote: post #30

Earlier quoted context omitted.

The problem isn't that Windows requires drivers to be signed. The problem is that Windows allows drivers to have an expiration date. If Windows verifies a driver's signature at the time the driver is installed, the driver should be considered trustworthy for as long as it remains installed on that system. There's no reason to re-verify the signature every time the driver is used .

Perhaps as a malware defense?

if you by "malware defense" mean preventing stolen expired certificates from being used to sign code, then yes. if you mean by only allowing code to be "signed" for the duration of the certificate, then no.
Post reply on HN