Hacker News Reader

judge2020

I'd say someone very high up and "tied to the company", probably the CTO, should make sure a signing certificate is renewed when needed and make sure it's rotated every time it's about to hit expiration. For a company as big as oculus with the backing of Facebook, this is a pretty big issue.

View on HN

I think the CTOs role here would probably be to make sure a process or team is in place to do this but not actually do it themselves? (For a company the size of oculus)

I’d expect at Facebook’s scale, they’d have a PKI management team, and this would’ve gone through their certificate lifecycle management process.

Reply on news.ycombinator.com