Logitech macOS mouse mayhem traced to expired dev certificate

Logitech says an expired developer certificate is to blame after swaths of customers were left infuriated when their mice malfunctioned. Various users took to social media complaining about a range of issues, from Logitech mice scroll directions changing, to mapped buttons not working as previously configured. Some complaints …

[Mishak]

Luckily for me...

I removed Logi Options+ from my Mac some time ago as it sucked the life out of the battery when I was travelling and didn't have the mouse with me.

Does "downgrade" it to a "normal" mouse, but that's all I wanted anyway.

[Anonymous Coward]

Re: Luckily for me...

I've an M720 on Win/Linux but simialrly never installed any of the bundled software.

I lived through too many years where the 'value add' software that came with peripherals was usually closer to malware than anything useful

[Neil Barnes]

Re: Luckily for me...

I'm of the vintage that remembers the INT33H calls for mouse movements... these days, two buttons and a scroll wheel suffices for my needs, and don't require any drivers adding.

Mine's a M150 with an associated K220 keyboard; it just works. I can hear the purists gnashing their teeth already :)

[Anonymous Coward]

Re: Luckily for me...

> I'm of the vintage that remembers the INT33H calls for mouse movements

I was explained how to use those in C during a call to Microsoft support back in 89/90. The same guy that picked up the phone¹ gave me the answer, right off the top of his head.

¹ Dring! Dring! "Hello, Microsoft support here, good afternoon" Why can't life still be that simple?

[Philo T Farnsworth]

Re: Luckily for me...

Somewhere back in the early 1980s I had some issue or another with their FORTRAN compiler and ended up talking for about 45 minutes with the developer. No, not on hold for 45 minutes, actually talking to a human who actually knew the product inside and out.

Those were the days, apparently.

BTW, on another thread¹ I was extolling the virtues of the Sun Crossbow USB mouse.

I rest my case.

_________________

¹ GNOME dev gives fans of Linux's middle-click paste the middle finger

[dinsdale54]

Re: Luckily for me...

I'm on my 5th M720. I really like the feel but they last about 2-3 years. The keyboards last about twice as long.

Recently I installed Logi options s/w for the first time as I needed to re-pair the universal receiver to the keyboard/mouse. Yes, it's possible to break the default pairing if you try hard enough.

This article is a timely reminder to remove the Logi software. A mouse is very high on the list of things that doesn't need to be internet connected.

[BartyFartsLast]

Re: Luckily for me...

Later versions can use Bluetooth and don't even need the dongle, but I have a vanilla, non internet connected windows machine in the office with the unifying software on it to pair dongles and input devices for when numpties have lost something or are wandering around with a dongle for the mouse and a second for the keyboard.

[graemep]

Re: Luckily for me...

I do not know about Windows and MacOS but on Linux this is done by the OS, with GUI config provided by the DE so the software is not necessary.

I think it creates an illusion of added value and some branding more than functionality.

[Anonymous Coward]

Re: Luckily for me...

Logi Options+ is basically malware

[a_foley]

Coupling

Why should a controller application be so tightly coupled to the hardware of a mouse that it stops working when the software gets borked? You'd expect better from a well known company like Logitech, unless I misread the article.

[PCScreenOnly]

Re: Coupling

I only ever install and run thier software when I need to sync a new device to an existing unifying adaptor. Once done, remove. It is pointless for my usage. Wonder if Windows has the same issue or if it is just Macs

[Mishak]

Re: Coupling

From my reading of the article, it sounds like there are a number of software modules running and the cert is used to secure the communications between them (could be as simple as SSL). It makes sense to secure this, but I'm not sure a cert that expires is a good idea (it effectively means the device will be rendered inoperative some time ofter it "goes out of support"*).

* I do hope this is not a deliberate "feature" to force users to replace otherwise functional devices.

[Anonymous Coward]

Re: Coupling

> I do hope this is not a deliberate "feature" to force users to replace otherwise functional devices.

No, no, of course it isn't. The Easter Bunny and Father Christmas work tirelessly to stop anyone doing things like that.

[Anonymous Coward]

Re: Coupling

Develeopment? Bring 'em in cheap and chuck it out fast.

Once we'd have called it half-arse, sloppy or just shit but now it's 'Agile*' or 'disruptive**'.

*I know Agile develoment can work well if done properly, I've just never seen it done properly, ever.

** I always thought disruption was something to avoid, a negative word.

[Bebu sa Ware]

Re: Coupling

I know Agile develoment can work well if done properly, I've just never seen it done properly, ever.

Like magick then ? Just more toads.

[tekHedd]

"You'd expect better.."

Yes, you WOULD expect better from a big company like Logitech... unless you'd used any of their included software apps in the last 25 years. Which is sort of sad. They make arguably some of the best hardware in the world, and it's supported by some of the worst apps.

I remember their keyboard mapping app written in .NET, that used a bunch of ram, so it would swap out of memory while you were playing a game and cause lag. The mouse apps that would... oh never mind you get the idea. It's just that Logitech being pants at app development is nothing new.

[Lazlo Woodbine]

I once found a very old mouse at work and thought I'd test it.

After digging out an RS232 - PS/2 and a PS/2 to USB connector, the mouse worked fine.

Absolutely no idea why my Logitech mouse needs 200mb of RAM to do the same job...

[John Brown (no body)]

At one time, the biggest worry was to use devicehigh or loadhigh to load drivers in just the right order so they were allocated the "correct" sized slot in UMB, back when the drivers were only a few KB in size and we wanted every possible free byte in the base 640KB :-)

[brainwrong]

ms-dos never allocated drivers to the correct sized UMB slot. They allocated to the largest sized one available, which was plain stupid. They should have allocated to the smallest one it would fit in. It was possible to direct it manually to a specific available slot, although sometimes there may be another reason why it wouldn't work. It wasn't difficult to look at the memory map and figure out a better way of arranging things to fit more into the UMB. Mem-maker (whatever it was called) that shipped with dos6 tried to do this, but was crap at it.

[bartsmit]

In *this* economy?!?

200 MB will soon cost a tenner if RAM pricing continues on its current trajectory. How long before it costs more than a mouse?

[Yet Another Anonymous coward]

Re: In *this* economy?!?

You soon won't be able to buy ram, you'll have to rent it - in the cloud

[Roland6]

>” After digging out an RS232 - PS/2 and a PS/2 to USB connector, the mouse worked fine.”

And I expect not a software certificate insight.

Basically, this type of certificate expiry (from memory ElReg has reported similar certificate expiry issues) demonstrates how fragile our IT systems have become and that we really need to rethink security, so that we can run systems for decades without them failing due to lack of communications with activation, licensing, certificate and update servers.

[Yet Another Anonymous coward]

Great that inter-process communication is so well secured. But, it's a mouse, why do we need secured inter-process communication ?

[Anonymous Coward]

So that they can play DRM-secured music on the mouse, obviously...

[David 132]

Bagpuss' Mouse Organ updated for the cloud-first, AI-enhanced, blockchain-enabled SaaS modern era?

[JulieM]

The security of the inter-process communication is not for your benefit! It's for the hardware supplier's benefit, to ensure you have to buy stuff from them and they don't get upstaged by some third party figuring out the communication protocols and creating a better alternative.

[Anonymous John]

"Company says it dropped the ball

I thought that mouse balls were a thing of the past.

[NewModelArmy]

Not if they want to procreate....

[Phil O'Sophical]

I have enough mice in my junk box, I certainly don't want to find more everytime I open it. Besides, who knows what they might mutate into.

[Roland6]

Depending on the population density in your junk box, you might find they have all become “beautiful” mice. (Reference to John B. Calhoun‘s research project “Universe 25”.]

[John Brown (no body)]

Why is prof relying on a dev cert?

Is it really a short term expiring dev cert being used in production? Or is this journalistic hyperbole? The only mention of "developer certificate" is in the opening El Reg paragraph, no mention in any of the quotes.

[Anonymous Coward]

Re: Why is prof relying on a dev cert?

Shows you just how short term that certificate was..

:)

[Henry 8]

Re: Why is prof relying on a dev cert?

https://www.reddit.com/r/logitech/comments/1q66q1l/comment/nyeck29/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button

"There is some misunderstanding of what the certificate is. It has no online connection dependency. It is a developer certification that is extremely common on macOS apps"

That makes it sound like it's just a code signing certificate. Note "Developer certification", not "certificate from a development environment"

[Lon24]

Incompatibility can be good

I held off getting Logitech keyboards and mice because their supporting software was Win/Mac only and I run Debian.

But a good deal broke my resolve. No problem with drivers, it just worked (tm). In place of Options+ I installed Solaar for the extra options. Hence nothing goes back to the Logitech mothership (or v.v.). Solaar is open source unlike Options+ so naughtiness or breakages are a little harder to accomplish.

[Rich 2]

‘tis a symptom of the times

This is just one very small example of software getting increasingly and ludicrously complicated for no discernible reason. And with that complexity comes lots of fragility. It’s the same reason web sites break all the time. This is a classic case of “stuff just not working” when it worked fine an hour ago.

Modern software is crap (and yes, I work on it all the time)

[Johnb89]

Re: ‘tis a symptom of the times

Software's always been crap, with a very few exceptions, and has always been a house of cards, teetering on the very edge of chaos ... IMHO because tidying and improving stability and reliability is BORING for devs and doesn't impact this quarter's revenue directly.

Now, software has become more complicated, as you say, so there are newer and more interesting ways to be crap.

[Anonymous Coward]

That's why I stick to selling keyboards not mice

We only accept written complaints.

[Anonymous Coward]

WTF?

Why does a simple device like a mouse need all this Certificate Crap? Does it need to send every movement back to the Logitech mothership and check the certs at the same time?

Sometimes... (this is my inner Grumpy Old Man speaking) things have gotten far to complex for their own good.

As for needing 200Mb of RAM? That is a big... no make that a major bigly failure.

Are there huge warnings on the box saying that 'Not Suitable for Air Gapped or Isolated Systems?' probably not.

Time to add Logitech to my list of companies 'NOT TO BUY FROM'.

Back in the day, we bought a batch of 50 Samsung 1TB 5.25 SATA HDD's. One by one they died. Could we get them replaced under warranty? Is the Pope a Catholic? We never bought a thing from them again. Their TV's that must connect to the mothership is another bad sign of the times.

[Anonymous Coward]

Re: WTF?

> As for needing 200Mb of RAM? That is a big... no make that a major bigly failure.

Quite. Back in the day, I used to run entire systems with less than 200MB RAM.

For that matter, even further back, I can remember having systems with less storage than that. But then, they had no mouse, so that was obviously the reason. :-\

[kmorwath]

Error management @Logitech

Logitech software developers should manage errors better. Last year I got a MX Creative Console that had issues with my old nVidia card - OK, fine - but the problem was no proper error was shown, and because of the error LogiOptions+ eat one core processing time.

I understand they can't test with every hardware combination, but not processing errors properly and displaying users something useful leads to these situations.

[rgjnk]

Lot of it going about

It's not that long ago that people really started to become keen on securing everything with signing and certificates, and plenty of stuff just chucked in certificates with 10 or 15 or whatever years of expiry because that was way off in the future.

Just a shame when the future actually arrives and the certificate expires and stuff breaks.

Some things don't care about expiry but more than enough do.

[hedgie]

Got biten by this

I'll have to try patching the configuration software, which just hangs when I've tried to run it.

While my mouse still works (some 9 button gaming mouse) with all the settings intact, it is currently locked into a single profile/programmed set and I cannot change any of the settings. At least it isn't behaving *differently*, but the problem is there are some applications where I would quite like it too.

[Emma Chisit]

Carol Beer

Users reported frustrating experiences with customer service...

Is there any other kind?

[RM Myers]

Re: Carol Beer

Actually, yes there is. I have had several good experiences in the last month - real people answering the phone quickly and politely, getting the problems solved almost immediately, and following up to make sure everything was okay. Admittedly these were not directly IT related issues, and the companies were small, local businesses, but it still brought a much needed smile to my face. And yes, I would frequent these business again, even if their prices were higher.

Why our tech overlords can't do the same, I'll leave for others to debate.

[David 132]

Re: Carol Beer

I had occasion to call the Customer Support number for Kreg recently, after I bought a woodworking jig that had a piece missing.

The phone was answered quickly and courteously, by someone who spoke impeccable English, knew the product, and who explained that the SKU I'd bought didn't actually come with the part in question - but then offered to pop one in a Jiffy bag and post it to me free of charge anyway.

Can anyone imagine a similar experience with Microsoft? "ring ring Hi, Microsoft Support. Oh, no, you can't find the Group Policy Editor because you only have the Home version of Windows. Tell you what, give me your address, I'll mail you a Pro license key..."

That is how Customer Support should be done. I'm a Kreg customer for life now.

[ecofeco]

I'm done with Logitech

My mouse was acting up a few weeks ago, so thinking a firmware update might fix it, I go to the LT website to look for the latest drivers.

Only to find it's ALL some flavor or weird, bloated bundle-ware. Over a dozen in fact. But no discreet drivers. https://www.logitech.com/en-us/software

Scroll to the bottom. Yes, the bottom of the page (how handy!) and look at the options. WTF is even all that shite?!

Irony of ironies, it turns out it was an M$ effing problem with their latest update. Of course it was. A few more M$ updates and it resolved itself.

My next mouse will be ANYTHING BUT a Logitech. The cherry on top is that my mouse is no longer supported. Yet the current model looks and functions exactly the same. Oh, and the button contacts are cheap. I've had to take mine apart and jigger it a little and a thorough cleaning to keep it working, but upon seeing the cheap components, I know it won't last.

And the Universal wireless adapter? Yeah, it's not so universal.

[frankyunderwood123]

Re: I'm done with Logitech

are you done with windows yet?

[Anonymous Coward]

no subscription ?

Since when are mice and keyboards not subscription based anymore ? just login logitech.com first to enable your mouse and keyboard ( on a mobile with mandatory 2FA with confirmation using two email addresses and Android pay) but ooops , the certificate of the authentication server expired.