All this assertion / denial stuff is getting tiresome. If this compromise was implemented at a significant scale, and people in-the-know have figured out how it functions, it shouldn't be too hard to get hold of one and provide a demo.
If you understand what this does, there's no such thing as an insignificant scale.
The point about scale, is that if this happened at the scale that is being claimed, it shouldn't be too hard to find a compromised unit.
The scale being claimed is a mere four factories, subcontractors of Supermicro's actual contractors, who were only used when demand exceeded those contractors' own capabilities.
absence of an example device is a strong strike against the Bloomberg article.
Would you assume the NSA would distribute it to newsrooms like flagrance samples? Particularly if the leak was unauthorized.
Really? If we assume everything reported was true, would the sources involved be in a position to hand over a server to the reporters?
No need to have somebody hand over a server. If the implant happened in two segments of the supply chain as the article claims, it shouldn't be very difficult to find one.
The burden of proof is on the accuser.
Well it should be anyway
The burden's on Bloomberg for accusing China of implanting the devices, or it's on the tech companies accusing Bloomberg of being full of --it, though? Looks like a standoff until we hear more
And now I'm angry at myself for not thinking of this. So much of this story was sitting like a grain of sand in my brain, but I couldn't put my finger on it