Unhelpful communication from Dolby about media block certificate extensions

[Leo Enticknap]

Woke up to panicky emails from three customers, who had just received this via Deluxe:

image.png

Firstly, as far as I'm aware, there was never a publicly released 3.5.21: 3.5.20 was followed by 3.21.7. In any case, Dolby have been stating for about the last year that 3.5.20 (not 21) is the earliest safe version for the IMS3000. So this bulletin induced a (metaphorical) heart attack in a customer that I'd left on 3.5.20, because 3.21.7 introduces aggressive and persistent nag banners if non-Dolby approved RAID drives are installed, and this customer had installed 4TB WD Red SSDs for extra space (which have now been running for almost three years without problem or issue). None of the critical issues fixed in 3.21.7 were relevant to this site, which I'd therefore left on 3.5.20. So the guy there saw 3.5.21 as being the earliest version that won't brick his IMS3000, and went straight to DefCon 5.

Secondly, what is "Dolby DSS servers are unaffected as their certificates don't begin expiring in 2031" supposed to mean? The only thing I can think of that it could mean is that this document wasn't properly proof read before being approved for release. I wouldn't be surprised to receive approaches from DSS operators asking if they need to take action now.

It's been tough enough negotiating the confusion and fear that built up within the customer base around this "update or brick" issue, and now we're going to have even more of it to contend with, including fielding inquiries from customers whose equipment is now safe. Grrr....

[Miguel Moreno]

I also received that letter.
I'm waiting for a response from Dolby to confirm if they released version 3.5.21.

[Randy Stankey]

That doesn't look like an official communication from Dolby. The logo doesn't look right. There are a few other formatting issues that look off kilter, too.

Are you sure that this is a legitimate message from Dolby?

[Marco Giustini]

- "Dolby have requested that we share" but there is a Dolby logo on the communication.
- SW version that doesn't exist

The "don't" might be grammatically correct - though not on a formal letter - though what do they mean with "certificates do not begin expiring in 2031"?

That's amazing though, it shouts "unprofessional".

[Randy Stankey]

That's the reason I suspect the letter's legitimacy.

Only three people have received this letter? If it was legit, wouldn't there be more people calling up in a panic?
I wonder whether it is a thinly disguised phishing attempt or something.

[Elia Orselli]

The communication from Deluxe is definitely legitimate. I received the same email from Deluxe, and it had a PDF attachment containing the same graphic sent to me directly by Dolby on November 5th. The text sent by Dolby contains the same sentence about DSS certificates and the same reference to version 3.5.21 (which I did not receive even among the various beta versions I happened to test).

[Leo Enticknap]

I'm sure it's legit, and suspect that whoever wrote this was as panicky as some of my customers. What I wrote at the top of this page may come across as a little judgmental - sorry. I'd made my usual 3a start to get to a 6a service call, and made my usual mistake of checking emails while the cats were having breakfast (we can't just leave food out for them to graze as and when they want to, because of ants and termites) before hitting the road. Before the first coffee had been absorbed, I saw the emails from customers (projectionists in arthouses and screening rooms, who had emailed me late evening, because that is their regular working hours) asking, basically, "WTF?!"

My guess is that the hard deadline for updating or losing pre-IMS3000 DolReMi equipment is now very close (November 30), Dolby is making one final big push to get the word out, and this bulletin got the OK for widespread distribution before a fresh pair of eyes took a deep breath and went through it carefully. The problem for me is that it's triggered panic among customers who aren't part of a big chain (and therefore don't have in-house techs to direct the panic at), that have already been taken care of, and who are now confused and anxious.

What would be very helpful from Dolby now is a clear-up statement along the lines of "If you have an IMS3000, this is how to check what version it's on. If it's on 3.5.20 or higher, you're OK: it's not going to break and be unfixable. If you're on 3.5.13 or lower, you need to fix this or get a tech to fix it before the end of December, because if you don't, you're cooked." The confusing prose followed by a table containing conflicting info in the bulletin that went out yesterday is scaring end users.

[Ryan Gallagher]

We got that one from Deluxe (a couple times now). Same copy text.

I agree it's not well crafted. We are DCP2K4 though, so our lines in the table were pretty clear, and we've been getting such notices or nags on the system for months prior to doing the patch in August.

[Scotty Wright]

We’ve received this same email from Deluxe/Dolby a few times.

[Carsten Kurz]

Quite a few stakeholders forwarded this message in recent weeks. Most of them, of course, had no specific knowledge about version numbers or actual relevance.

[Miguel Moreno]

the lates version for IMS3000 is 3.21.8

[Leo Enticknap]

Just received this, which is far more focused...

image.png

...and the contradictory statement about DSS servers has gone.

Many thanks to Dolby for putting out something clearer.

I'm kinda bracing for the morning of December 1. All of our service contract customers and those we've had contact with in the last year or so have been taken care of, but I'm sure that there will be some servers in use out there, the owners of which have slipped through the net. I'm hoping that it'll be no more than a handful.

[Armand Daiguillon]

Hi all, I did the cert extensions on my in service doremi's a few months ago - but with this deadline looming I decided I should update my 2 not in service units so that if they are needed in the future they can just be swapped in.
I remember being able to find everything I needed on the dolby ftp site last time with no problems ....using the files I saved from my previous upgrades I upgraded the software and security managers to the correct versions on these units, ... but I don't see anywhere on the ftp site where to find the actual cert extension file. I found directory containing certs by unit number ....but I don't see the extensions anywhere ?

The only folders I see on the ftp site are "Certificates" "Dolby_Encrypted_Content_Tester" "DSP100_UpgradeKeys" "DSS200_Upgradekeys"
None of these folders seem to even contain the upgrade packages I had previously gotten from the site, luckily I had saved those packages already.
I even watched Dolby's "help" videos .....which for some reason assume I already have all the files needed for the upgrade ....

Can someone tell me where the cert extension files are ? (Doremi/Showvault)

Thanks !

[Leo Enticknap]

This is where I found them just now:

image.png

[Armand Daiguillon]

This is where I found them just now:

image.png

None of those directories are there when i log in - it's weird. But luckily it seems I thought ahead a few months ago and had already gotten the cert extensions for these other units - I found them in a folder i had marked "cert extensions" .....I just forgot about them. lol

Thanks for the help !!