Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All of Oculus’s Rift headsets have stopped working due to an expired certificate

techcrunch.com

Post reply on HN
Print view View original

91–100 of 390 posts

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#91

Post by mulmen »

wtallis wrote: post #30
ThatPlayer wrote: post #22

Earlier quoted context omitted.

Because it was the certificate for the Windows driver, and Windows requires signed drivers.

The problem isn't that Windows requires drivers to be signed. The problem is that Windows allows drivers to have an expiration date. If Windows verifies a driver's signature at the time the driver is installed, the driver should be considered trustworthy for as long as it remains installed on that system. There's no reason to re-verify the signature every time the driver is used .

Is that true though? Could a malicious driver be signed with a compromised key and distributed? Seems like a useful feature to be able to mark drivers as compromised.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#92

Post by wtallis »

jimrandomh wrote: post #36
StavrosK wrote: post #15

Why is it possible for a device that is basically a display to stop working because a certificate expired? This future worries me.

It's more complex than a display; it's a display plus a collection of USB sensors and some low-level hooks into display management. This requires kernel-mode drivers, for good technical reasons, where a normal monitor wouldn't.

That's a reasonable answer to why the drivers need to be signed in order to be installed. That's not the question. The question is why should the already-installed drivers that you've been trusting all along suddenly stop working.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#93

Post by mancerayder »

khazhoux wrote: post #42

In 2091, an overworked developer will accidentally let the certificate expire for the Planetary Shield Defense Matrix, and the Zylorts will finally conquer Earth.

He couldn't afford the renewal fees! Can you imagine?

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#94

Post by wtallis »

mulmen wrote: post #91
wtallis wrote: post #30

Earlier quoted context omitted.

The problem isn't that Windows requires drivers to be signed. The problem is that Windows allows drivers to have an expiration date. If Windows verifies a driver's signature at the time the driver is installed, the driver should be considered trustworthy for as long as it remains installed on that system. There's no reason to re-verify the signature every time the driver is used .

Is that true though? Could a malicious driver be signed with a compromised key and distributed? Seems like a useful feature to be able to mark drivers as compromised.

> Seems like a useful feature to be able to mark drivers as compromised.

Putting expiration dates on non-malicious drivers is not a particularly effective way to protect against malicious drivers.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#95

Post by wtallis »

gruez wrote: post #58
Retric wrote: post #53

Earlier quoted context omitted.

Which just means the expiration date is meaningless. If the driver was valid when it was signed, then revoking it will break the system. Not installing it is another story.

>Which just means the expiration date is meaningless. how so? it merely limits which dates you can sign code, after which the code you signed remain valid, but you can't sign any more code.

> it merely limits which dates you can sign code, after which the code you signed remain valid,

The whole problem here is that the code that was signed is not being treated as valid code beyond the expiration date.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#96

Post by andrewmcwatters »

maxander wrote: post #48

One wonders if we've made technology unnecessarily complicated. In order to build something like the Oculus Rift, they obviously needed expertise in hardware design, optics, display technology, manufacturing, user interface design, etc etc. Also, they apparently needed expertise in managing the ins-and-outs of the Windows driver security system. Adding one more subject to their already crowded curriculum wasn't very…

I was just reading something here about Cairo and how it's easy to fall into slow code paths with it, and if you happened across falling into a slow code path, somewhere along the line, "you fucked up."

When I read the comment I was immediately flabbergasted: no, someone else fucked up. It's not my fault someone wrote software that sets up undocumented traps for me to fall into. Or provided three ways to do something and two of them are not recommended OOTB. Or is primarily documented by third parties.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#97

Post by esturk »

Gargoyle wrote: post #51
legitster wrote: post #6

They let their certificate expire, essentially bricking all of their devices. And now the app running it won't start, so they can't push an update. Just recently picked up a Rift. I love the hardware and their exclusives are top notch, but this confirms my suspicions that their backend is super goofy. They sell Rifts at Best Buy and want to pretend that it's a consumer-ready product, but here's why I am recommending…

Sure. But meanwhile my 10 year old nephew is having life shaping experiences with the Rift I set up for him.

Or he, the nephew, can have the same life altering experience on a Vive without all the drawback your parent post listed.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#98

Post by wtallis »

andrewstuart2 wrote: post #82
Retric wrote: post #53

Earlier quoted context omitted.

Which just means the expiration date is meaningless. If the driver was valid when it was signed, then revoking it will break the system. Not installing it is another story.

The expiration date is the fallback if you don't have confirmation from the timestamp server that it was signed prior to expiration. Ideally it's not used except by the timestamp service, but it seems like a fairly reasonable fallback.

> The expiration date is the fallback if you don't have confirmation from the timestamp server that it was signed prior to expiration.

The fact that the driver was installed locally before the expiration should be taken as proof that the driver was signed before expiration.

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#99

Post by makmanalp »

lopmotr wrote: post #81
r1ch wrote: post #23

This is not how Windows code signing is supposed to work. Normally you'd get a countersignature from a timestamp server so that the verification process can prove that the certificate was valid at the time of signing. It would appear that Oculus signed their binaries without using a timestamp server, so without a way to verify when signing happened they become invalid as soon as the cert expires.

Something like that. Certificates aren't supposed to stop working just because they've expired! That would destroy all abandoned or poorly maintained software within a couple of years. This problem is deeper than forgetting to update it. It should never have caused a failure in the first place. Just the fact that the device apparently can't function at all without the internet is a problem too.

For the ignorant among us, what would expiration do then?

Re: All of Oculus’s Rift headsets have stopped working due to an expired certificate

#100

Post by s2g »

rock_hard wrote: post #54
p1necone wrote: post #43

Earlier quoted context omitted.

I see the exclusives as a negative. I don't want to support their efforts to build a closed ecosystem around what should be an open API that any headmounted display + tracking can expose.

You realize that this is the only way to fund triple AAA content for the time being though, right? Oculus is producing these at a loss given the current size of the market hoping it will pay out in the long term by growing a healthy ecosystem...it’s the only way

Bullshit. Fallout 4 and Doom aren't exclusives.
Post reply on HN