7 ms·

Apparently, they signed them incorrectly.

by sjburt 9y ago

wtallis 9y ago
That puts the blame on Oculus, but the blame really should rest on Microsoft for enabling and enforcing a signature mode that shouldn't exist at all.
- ryanlol 9y ago
  Does that really not sound ridiculous to you? Microsoft needs to be blamed for their certificate validation implementation because people might use it to make their software expire? Instead of just writing code that does so?
  - wtallis 9y ago
    Microsoft's driver signing model has a mode that is a giant footgun with no redeeming value. Oculus is a victim of Microsoft's bad design. They weren't trying to build in a self-destruct timer for their whole product stack, and if they were, they wouldn't have used the driver signing certificate as the lynchpin.
    - flamedoge 9y ago
      you can't guard against every imaginable stupidity. you try but users will inevitably find a hole.
      - loup-vaillant 9y ago
        That's not how APIs work. You don't eliminate stupidity by thinking of each and every way the user could screw up. You simplify your API so there aren't so many ways to use it in the first place.
    - jlgaddis 9y ago
      I find this reasoning ("footgun", Microsoft's fault) interesting when compared to the prevalent HN opinions when it comes to, for example, (unsecured) redis and memcached servers being used in DDoS attacks, or even AWS S3 buckets (with confidential or even highly classified files) being -- inadvertantly -- left wide open to the public. In those cases, "we" (as a "community", in general) often blame the people responsible for running those services instead of the developers (or Amazon) being blamed for choosing convenience/ease-of-use over security. That is, we're often quick to say that the people running those wide open memcached servers are at fault for not properly configuring and/or securing them -- and not blaming the developers for creating "a giant footgun". "You shouldn't be running servers on the Internet if you don't know how to properly configure them" (paraphrasing) is often stated. Yet, in this case, we're not blaming Oculus for their screwup and instead blaming Microsoft -- even though there's zero evidence (AFAIK) that Oculus even used any Microsoft tools to sign their application. (N.B.: I don't know the first thing about code signing on Windows so it may well be that using a Microsoft utility is required and, thus, just assumed by those of you who are familiar with the process. If that's the case, sorry.) I'm having trouble trying to reconcile these two seemingly opposing viewpoints. Why is Microsoft's utility "a giant footgun" but a (OOTB) completely insecure by default, wide open by default memcached server (for example) isn't?
      - girvo 9y ago
        > I'm having trouble trying to reconcile these two seemingly opposing viewpoints. I mean this with all respect... but why? You're talking about different opinions expressed by completely different people. HN isn't a monolith.
        jlgaddis 9y ago
        Sure, there are plenty of different opinions here on HN. If there wasn't, these discussion threads would be boring and useless. My point was: in most threads, there's a common opinion or viewpoint shared by most, along with a few "detractors". In general, though, the overwhelming "predominant" opinions (within/on a particular subject) are pretty consistent from one thread to the next. For example, the "it's the end user's fault, not the developers" thing I mentioned earlier. That seems to be, pretty consistently, the "belief of the majority". Here, though, it's the complete opposite. Instead of saying "the end user (Oculus) screwed up" (which, IMO, they certainly did, FWIW), it's "Microsoft made a footgun which caused this". That said, I have now made it through the rest of the comments in this thread and it seems that this viewpoint isn't as widespread as it first appeared. Perhaps I just jumped to a conclusion much too quickly; there's obviously plenty of fingers pointing at Oculus as well.
    - ryanlol 9y ago
      So instead of trying to conform to the x.509 spec MS should have just developed their own certificate validation scheme, because that would totally be less of a "footgun" than conforming to the spec. Am I getting this right? Why aren't we blaming the people behind RFC5280, after all it was them who came up with this awful idea that certificates should expire. >giant footgun oh dear god how are you generating your certificates? This is not a footgun unless you are doing something immeasurably stupid before even involving MS products. Besides, if you insist on going ahead and setting the Not After field, wouldn't it be a bigger footgun to ignore that?
      - lclarkmichalek 9y ago
        FWIW, there are basically no common implementations that fully conform to the x.509 spec. That thing is a bundle of unimplemented features.
        ryanlol 9y ago
        Hence "trying to" :) However, I'd argue that disregarding the Validity section would be an unusually big departure from the spec, not comparable to the typical silliness surrounding x.509.
  - gambler 9y ago
    How about we stop blaming people who accidentally pressed figurative "system self-destruct" button and start asking why there are so many of those buttons everywhere? Nowadays this is a recurring theme. Simple mistakes leading to catastrophic failures at grand scale. "Just be more careful" doesn't cut it anymore, because in the software world there are just too many things to be careful about.
    - Twisell 9y ago
      Because when you edit code basically every character you type have the potential to become a big red button. It’s not that developer add them for fun. And each time you develop a new functionality you have to figure out how to build a very solid glass box around the reds buttons you just created. The default being none. Alternatively you could propose no user configurable functionalities whatsoever and rarely and carefully upgrade any dependencies (including the os) and you will create a very robust program. But then don’t expect to end up with a wireless VR headset with an online game catalog and multiplayer capability. No but you can up with a very nice banking application developed in COBOL for sure.
    - ryanlol 9y ago
      You cant possibly make this argument in the context of driver development. Everything is a self destruct button.
- cyrix281 9y ago
  It needs to exist in an untrusted environment.. it verifies that the driver which has low level access to the computer hasn't been modified by a third party.. MS signed system binaries are the same way; it's a safeguard against malicious entities.
  - wtallis 9y ago
    I'm not arguing against the entire concept of driver signing, just one specific nuance of Microsoft's driver trust model. There is a place for driver signing and signature checking, but de-trusting a driver that you were perfectly happy to give kernel-level access yesterday doesn't make sense.
    - zaarn 9y ago
      It's still Oculus fault because they didn't use a timestamped signature. A timestamped signature on the binary would have it kept working and that's how MS intents it to work. You can leave it out if you have the desperate longing for having your software break suddenly without reason like Oculus just did.
      - gmueckl 9y ago
        And that's where MS is at fault: drivers without timestamped signatures should be treated as faulty. This would prevent these errors in the first place.
        tallanvor 9y ago
        I guess I can see reasons why some companies may want to be able to produce time-limited drivers: Maybe they want beta versions to stop working, forcing users to upgrade. For offline computers, it might be that some companies would see this as a way to enforce contract periods (customers would have to install an update to continue using the product when their contract is renewed). Of course, disabling driver signature verification is still a way to bypass that, but often times the companies that do things like this probably aren't thinking about that.

Apparently, they signed them incorrectly.

by sjburt 9y ago

Apparently, they signed them incorrectly.

That puts the blame on Oculus, but the blame really should rest on Microsoft for enabling and enforcing a signature mode that shouldn't exist at all.

ryanlol 9y ago
Does that really not sound ridiculous to you? Microsoft needs to be blamed for their certificate validation implementation because people might use it to make their software expire? Instead of just writing code that does so?
- wtallis 9y ago
  Microsoft's driver signing model has a mode that is a giant footgun with no redeeming value. Oculus is a victim of Microsoft's bad design. They weren't trying to build in a self-destruct timer for their whole product stack, and if they were, they wouldn't have used the driver signing certificate as the lynchpin.
  - flamedoge 9y ago
    you can't guard against every imaginable stupidity. you try but users will inevitably find a hole.
    - loup-vaillant 9y ago
      That's not how APIs work. You don't eliminate stupidity by thinking of each and every way the user could screw up. You simplify your API so there aren't so many ways to use it in the first place.
  - jlgaddis 9y ago
    I find this reasoning ("footgun", Microsoft's fault) interesting when compared to the prevalent HN opinions when it comes to, for example, (unsecured) redis and memcached servers being used in DDoS attacks, or even AWS S3 buckets (with confidential or even highly classified files) being -- inadvertantly -- left wide open to the public. In those cases, "we" (as a "community", in general) often blame the people responsible for running those services instead of the developers (or Amazon) being blamed for choosing convenience/ease-of-use over security. That is, we're often quick to say that the people running those wide open memcached servers are at fault for not properly configuring and/or securing them -- and not blaming the developers for creating "a giant footgun". "You shouldn't be running servers on the Internet if you don't know how to properly configure them" (paraphrasing) is often stated. Yet, in this case, we're not blaming Oculus for their screwup and instead blaming Microsoft -- even though there's zero evidence (AFAIK) that Oculus even used any Microsoft tools to sign their application. (N.B.: I don't know the first thing about code signing on Windows so it may well be that using a Microsoft utility is required and, thus, just assumed by those of you who are familiar with the process. If that's the case, sorry.) I'm having trouble trying to reconcile these two seemingly opposing viewpoints. Why is Microsoft's utility "a giant footgun" but a (OOTB) completely insecure by default, wide open by default memcached server (for example) isn't?
    - girvo 9y ago
      > I'm having trouble trying to reconcile these two seemingly opposing viewpoints. I mean this with all respect... but why? You're talking about different opinions expressed by completely different people. HN isn't a monolith.
      - jlgaddis 9y ago
        Sure, there are plenty of different opinions here on HN. If there wasn't, these discussion threads would be boring and useless. My point was: in most threads, there's a common opinion or viewpoint shared by most, along with a few "detractors". In general, though, the overwhelming "predominant" opinions (within/on a particular subject) are pretty consistent from one thread to the next. For example, the "it's the end user's fault, not the developers" thing I mentioned earlier. That seems to be, pretty consistently, the "belief of the majority". Here, though, it's the complete opposite. Instead of saying "the end user (Oculus) screwed up" (which, IMO, they certainly did, FWIW), it's "Microsoft made a footgun which caused this". That said, I have now made it through the rest of the comments in this thread and it seems that this viewpoint isn't as widespread as it first appeared. Perhaps I just jumped to a conclusion much too quickly; there's obviously plenty of fingers pointing at Oculus as well.
  - ryanlol 9y ago
    So instead of trying to conform to the x.509 spec MS should have just developed their own certificate validation scheme, because that would totally be less of a "footgun" than conforming to the spec. Am I getting this right? Why aren't we blaming the people behind RFC5280, after all it was them who came up with this awful idea that certificates should expire. >giant footgun oh dear god how are you generating your certificates? This is not a footgun unless you are doing something immeasurably stupid before even involving MS products. Besides, if you insist on going ahead and setting the Not After field, wouldn't it be a bigger footgun to ignore that?
    - lclarkmichalek 9y ago
      FWIW, there are basically no common implementations that fully conform to the x.509 spec. That thing is a bundle of unimplemented features.
      - ryanlol 9y ago
        Hence "trying to" :) However, I'd argue that disregarding the Validity section would be an unusually big departure from the spec, not comparable to the typical silliness surrounding x.509.
- gambler 9y ago
  How about we stop blaming people who accidentally pressed figurative "system self-destruct" button and start asking why there are so many of those buttons everywhere? Nowadays this is a recurring theme. Simple mistakes leading to catastrophic failures at grand scale. "Just be more careful" doesn't cut it anymore, because in the software world there are just too many things to be careful about.
  - Twisell 9y ago
    Because when you edit code basically every character you type have the potential to become a big red button. It’s not that developer add them for fun. And each time you develop a new functionality you have to figure out how to build a very solid glass box around the reds buttons you just created. The default being none. Alternatively you could propose no user configurable functionalities whatsoever and rarely and carefully upgrade any dependencies (including the os) and you will create a very robust program. But then don’t expect to end up with a wireless VR headset with an online game catalog and multiplayer capability. No but you can up with a very nice banking application developed in COBOL for sure.
  - ryanlol 9y ago
    You cant possibly make this argument in the context of driver development. Everything is a self destruct button.
cyrix281 9y ago
It needs to exist in an untrusted environment.. it verifies that the driver which has low level access to the computer hasn't been modified by a third party.. MS signed system binaries are the same way; it's a safeguard against malicious entities.
- wtallis 9y ago
  I'm not arguing against the entire concept of driver signing, just one specific nuance of Microsoft's driver trust model. There is a place for driver signing and signature checking, but de-trusting a driver that you were perfectly happy to give kernel-level access yesterday doesn't make sense.
  - zaarn 9y ago
    It's still Oculus fault because they didn't use a timestamped signature. A timestamped signature on the binary would have it kept working and that's how MS intents it to work. You can leave it out if you have the desperate longing for having your software break suddenly without reason like Oculus just did.
    - gmueckl 9y ago
      And that's where MS is at fault: drivers without timestamped signatures should be treated as faulty. This would prevent these errors in the first place.
      - tallanvor 9y ago
        I guess I can see reasons why some companies may want to be able to produce time-limited drivers: Maybe they want beta versions to stop working, forcing users to upgrade. For offline computers, it might be that some companies would see this as a way to enforce contract periods (customers would have to install an update to continue using the product when their contract is renewed). Of course, disabling driver signature verification is still a way to bypass that, but often times the companies that do things like this probably aren't thinking about that.