Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

81–90 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#81

Post by lopmotr »

r1ch wrote: post #23

This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can prove that the certificate was valid at the time of signing. It would appear that Oculus signed their binaries without using a timestamp server, so without a way to verify when signing happened they become invalid as soon as the cert expires.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years.

This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#82

Post by andrewstuart2 »

Retric wrote: post #53
ScottEvtuch wrote: post #50

Earlier quoted context omitted.

The timestamp server is a separate trusted entity that signs the signature asserting the date and time. It's not just metadata, it's effectively a separate signature.

Which just means the expiration date is meaningless. If the driver was valid when it was signed, then revoking it will break the system. Not installing it is another story.

The expiration date is the fallback if you don't have confirmation from the timestamp server that it was signed prior to expiration.

Ideally it's not used except by the timestamp service, but it seems like a fairly reasonable fallback.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#83

Post by chrisseaton »

yardie wrote: post #63
mikeash wrote: post #35

This seems to be a somewhat common type of problem. I wonder if companies should routinely test on machines with the clock set one year into the future to catch them before they hit customers.

It’s not even necessary to test. Once you’ve done it a few times codesigning is a piece of cake. But there a few flags you absolutely pay attention to or else it’s going to bite you in the ass way down the line.

> It’s not even necessary to test. Once you’ve done it a few times codesigning is a piece of cake.

Presumably this is what Oculus thought and so how they got in this mess.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#84

Post by taberiand »

sdrothrock wrote: post #79
scrollaway wrote: post #76

This, and many incidents like it, makes me think that running tests 1/10/100 years in the future should be a standard feature of test runners and CI systems. (on by default)

I work with time a lot and have always advocated running practical simulations, especially over year changes, leap year changes, leap year days, etc. with the junior engineer I mentor as well as the hardware company that partners with us -- it's only recently after we got bitten by a time-based bug that people have started listening.

Of course, if they had listened and therefore never been bitten, they would have seen the work as a waste of time.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#85

Post by [deleted] »

jimrandomh wrote: post #28

Saw this, opened Oculus Home, there's a message in the Updates tab saying "An update may not have installed correctly", and indeed, VR apps didn't work. Nate Mitchell of Oculus posted on Reddit saying "We're working on resolving this issue right now. We'll keep everyone posted on progress here." https://www.reddit.com/r/oculus/comments/82nuzi/cant_reach_o... . Top-level of that thread has a workaround involving setti…

[deleted]

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#86

Post by technofiend »

lopmotr wrote: post #81
r1ch wrote: post #23

This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can prove that the certificate was valid at the time of signing. It would appear that Oculus signed their binaries without using a timestamp server, so without a way to verify when signing happened they become invalid as soon as the cert expires.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

>Just the fact that the device apparently can't function at all without the internet is a problem too.

Isn't Oculus owned by Facebook? Of course it has internet-based mandatory data collection, er uh excuse me, license something something.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#87

Post by sohkamyung »

bo1024 wrote: post #70
booleandilemma wrote: post #40

Earlier quoted context omitted.

This is why I’m reluctant to shift completely to ebooks.

Not all e-books (or readers) have DRM. I understand and share your concern, but you can shift to only DRM-free e-books with your own backups and under your own control.

That's the only kind of ebooks (non-DRM) ones that I buy. Some publishers (like O'Reilly or Tor dot com) exclusively publish non-DRM books.

I politely ask authors or publishers to release non-DRM ebooks when I can. Apart from best-sellers (or time sensitive books), I believe most books are stuck in the long tail of obscurity and releasing them as non-DRM won't affect their sales.

This also means I don't visit pirate websites that claim to have ebooks. It takes two to tango. :-)

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#88

Post by sdrothrock »

taberiand wrote: post #84
sdrothrock wrote: post #79

Earlier quoted context omitted.

I work with time a lot and have always advocated running practical simulations, especially over year changes, leap year changes, leap year days, etc. with the junior engineer I mentor as well as the hardware company that partners with us -- it's only recently after we got bitten by a time-based bug that people have started listening.

Of course, if they had listened and therefore never been bitten, they would have seen the work as a waste of time.

That's the nature of the beast. I have to be the noisy guy about testing and also be the guy who doesn't say "I told you so," but instead continues pushing testing.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#89

Post by mulmen »

Natsu wrote: post #80
khazhoux wrote: post #42

In 2091, an overworked developer will accidentally let the certificate expire for the Planetary Shield Defense Matrix, and the Zylorts will finally conquer Earth.

It's okay, some hacker will save earth in the end by typing commands into a graphical, 3-D version of OpenSSL 1.2.

Is type the right verb? Maybe glance or stare.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#90

Post by ben_jones »

Natsu wrote: post #80
khazhoux wrote: post #42

In 2091, an overworked developer will accidentally let the certificate expire for the Planetary Shield Defense Matrix, and the Zylorts will finally conquer Earth.

It's okay, some hacker will save earth in the end by typing commands into a graphical, 3-D version of OpenSSL 1.2.

It's overly optimistic that the US gov would have upgraded to that version by then.
Post reply on HN