6 ms·

> Certificates aren't supposed to stop working just because they've expired! That’s exactly how they are supposed to work. In the public sector we rely heavily

> Certificates aren't supposed to stop working just because they've expired! That’s exactly how they are supposed to work. In the public sector we rely heavily on certificates for inter sector communication for instance, if certificates kept working despite being invalid it would put security at risk. You’re supposed to build your software with an enterprise certificate store in mind though, meaning you can auto renew and distribute certicates when needed. I really don’t see the point of adding a certificate to your television though, even if it is a tv that you wear on your head.

JohnTHaller 9y ago
Code signing certificates are different from website certificates. When you use a code signing certificate - when doing it right, anyway - you also loop in a timestamp server. That way, you're signing it with your currently valid certificate and a third party is proving it was signed at a time the certificate is valid. This is so that when your code signing certificate expires in a few months, the binary you signed while the certificate was valid can still be used. Without timestamp servers, you couldn't now go back and install an older version of Firefox, for instance, because the certificate it was signed with last year is now expired.
- nikanj 9y ago
  I guess they see that as a feature. Maybe the old version of Firefox wasn't as anal with DRM as the current version is.
- Angostura 9y ago
  What makes you think this was a code-signing certificate? The fact that the error involves the inability to reach a server suggests strongly that it was a TLS cert or somesuch
  - JohnTHaller 9y ago
    The parent of the comment I replied to was talking about a timestamp server. I was explaining what that meant and why it was using it. I don't know what the actual issue is with the Oculus' handling of certificates and whether it was a code signing certificate or not.
privateSFacct 9y ago
I've actually run into this issue with public sector documents such as PDF's. They don't timestamp (what a PDF calls long term validation). I had not idea this was by intent! What's weird is sometimes they still link or require these docs to be downloaded and completed. A bit worse, the constant password change requirements - thankfully the password helpdesks in public sector are so used to doing password resets that you can usually get a reset very easily just by giving a username if you are directly accessing a system (ie, internally so have access to helpdesk). The passwords can be crazy long though with 90 days expiration (senior folks write them down or give them to assistants). Some actually expire even without a login (they email you and say unless you login and change it will expire).

JohnTHaller 9y ago

Code signing certificates are different from website certificates. When you use a code signing certificate - when doing it right, anyway - you also loop in a timestamp server. That way, you're signing it with your currently valid certificate and a third party is proving it was signed at a time the certificate is valid. This is so that when your code signing certificate expires in a few months, the binary you signed while the certificate was valid can still be used. Without timestamp servers, you couldn't now go back and install an older version of Firefox, for instance, because the certificate it was signed with last year is now expired.

nikanj 9y ago
I guess they see that as a feature. Maybe the old version of Firefox wasn't as anal with DRM as the current version is.
Angostura 9y ago
What makes you think this was a code-signing certificate? The fact that the error involves the inability to reach a server suggests strongly that it was a TLS cert or somesuch
- JohnTHaller 9y ago
  The parent of the comment I replied to was talking about a timestamp server. I was explaining what that meant and why it was using it. I don't know what the actual issue is with the Oculus' handling of certificates and whether it was a code signing certificate or not.

privateSFacct 9y ago

I've actually run into this issue with public sector documents such as PDF's. They don't timestamp (what a PDF calls long term validation). I had not idea this was by intent! What's weird is sometimes they still link or require these docs to be downloaded and completed. A bit worse, the constant password change requirements - thankfully the password helpdesks in public sector are so used to doing password resets that you can usually get a reset very easily just by giving a username if you are directly accessing a system (ie, internally so have access to helpdesk). The passwords can be crazy long though with 90 days expiration (senior folks write them down or give them to assistants). Some actually expire even without a login (they email you and say unless you login and change it will expire).