If it really didn't happen, how could a reputable news agency get a report so wrong? What exactly is going on here?
Money quote: "You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the journalist has absolutely no understanding of either the facts or the issues. Often, the article is so wrong it actually presents the story backward—reversing cause and effect. I call these the "wet streets cause rain" stories. Paper's full of them.
"In any case, you read with exasperation or amusement the multiple errors in a story, and then turn the page to national or international affairs, and read as if the rest of the newspaper was somehow more accurate about Palestine than the baloney you just read. You turn the page, and forget what you know."
[1]https://www.economist.com/briefing/2018/12/01/the-semiconduc...
Mind you, simplifying with a degree of accuracy is difficult and top writers like those with the Economist do it better than most. With tech stuff, I find more poor and incomplete explanations than I do outright errors. Mind you, back when I provided commentary for a lot of news stories, there were some reporters I always dreaded calls from because I knew steering them in the right direction was going to take an hour out of my life.
The writing is good and interesting, until to read for a year and realize that formula is pretty much the same, and you can predict the arc of the article after reading a paragraph.
The result of this audit does not inform about anything related to the allegations published by Bloomberg.
I think it's more about re-building confidence by showing that Supermicro products on sale now can be trusted.
The reporter may have emailed a few dozen security researchers to verify the story, but those who don't believe in the story are less likely to reply (and the reporter is more likely to ignore them), leading to a sampling bias.
It's easy to see how security researchers could go off on a tangent about the insecurities of IMPI and other out of band management systems. Which'd sound like an endorsement to the reporter.
Who knows what really happened.
"but that kind of attack has never been seen in the wild and is highly unlikely"
"but large tech companies have teams that vet the hardware they use on a unit by unit basis and would notice something like that"
But, yes, even reporters that you know want to write a story that will be interesting to readers. As a source, feel free to provide educational background but be really careful about speculating about things if you don’t want that speculation in print.
An on the record conversation isn’t the same as an informal background chat with the same person over drinks. And I’m a bit careful even then.
I got into a brief argument in comments here not too long ago about the saying "you can't prove a negative" which got bogged down in (what I considered to be) pedantic semantics; what we mean in practice is this kind of "negative." Instead of the conspiracy-minded folks providing proof that powerful, shadowy forces have come out in force against Bloomberg to discredit and suppress their reporting on an actual national security incident, they're demanding that skeptics prove that they haven't. And how can we do this? The complete lack of evidence for this happening might just mean that the shadowy, powerful forces are really good at hiding their tracks. We can posit that if they were really that powerful, they'd have suppressed the original reporting, but we can't prove that Bloomberg didn't just get lucky, or that their diligent, plucky reporters didn't somehow catch the Deep State off-guard for just a moment. We can point out that generally when we see this kind of story, other reporters in other organizations would have corroborated and even expanded the story by now, and that other reporters have said that they've tried and failed to do so. But that might mean the conspiracy is covering their tracks. That they've got to them. That the rest of the journalistic world is IN ON THE CONSPIRACY, MAN.
But it's also possible that the reason it increasingly looks like Bloomberg got played is that, well, Bloomberg got played. Like a cigar, sometimes a bad article is just a bad article.
Bloomberg here will blame its source and take no responsibility.
All business are "in the business of making money", that's what being a business is. What sets them apart is how they make it. In the case of media companies is, precisely, by getting the story right. A publisher that doesn't is more likely to lose influence and readership as time goes by. For a publication like Bloomberg, more so.
So yeah, they do care. That doesn't mean they don't fall for scams or bad reporting. They do, but it's in their best interest not to do so. In this case, I'm sure Bloomberg is already frantically calling all the reporter sources. They should have done it before the piece was published, sure, and they'll sure blame the reporter and the sources, but I think it's disingenuous to think they just shrug these things off.
Ideally yes, but nowdays it seems to be rather; by getting the story framed exactly as their corporate owner wants them to frame it.
Yes, they'll slowly loose credibility and in fact that is happening, but the process takes decades and is not likely to affect current reporters, if they lied in service of the status quo.
Strongly disagree. Media companies make money by publishing stories that people want to hear about.
Almost any article about Russia is a counter example to this.
Overall Bloomberg as a company does not sustain itself on news revenue.
We don't really know anything about Bloomberg's sources we do know the nature of all the parties denying any of this is true.
I think this might just be another case of unintentional consequences from incentives.
[1]: https://www.businessinsider.com/bloomberg-reporters-compensa...
In my experience, there are two types of firms you can almost always find "friendly" auditors: law firms and small specialized "boutique" firms (accounting, consulting, etc). Who conducted this review? A boutique law firm.
I'm not saying that it's not possible for the situation you described to have happened, just that it would be an extreme outlier.
Given all this attention, don't you think that Bloomberg would have issued a retraction by now if it was simply the case of an overzealous reporter?
It's also possibly permanently going to be unclear whether this is factually accurate unless someone discovers a compromised system or the sources for the reporters provide enough information on why they believe what they do to actually investigate.
I'd believe more that Super Micro is trying to save it's stock value, more than I'd believe government intervention. Of course, it could also just be faulty intelligence. Guess we'll have to wait and see what Bloomberg does with respect to whether they can get their sources on the record.
Because no matter what the audits say, this article caused a widespread feeling of mistrust towards Chinese-manufactured electronics.
Absolutely possible, even somewhat plausible but unlikely. Conspiracies are hard to maintain "2 can keep a secret if 1 of them is dead".
You could outright threaten someone with any number of means to get them to comply with your wishes, this is how espionage often works at a state level "ho ho, you like underage boys Mr. Smith, we have these photos of you, you will help us spy on your government!" or "You owe us much monies from your gambling, you can give us information or we make your life very difficult", simply using sex to ease someone into complying (sexpionage both as blackmail and as reward/entrapment. A possible famous case of the blackmail route was with the NSA in 1960, see: https://en.wikipedia.org/wiki/Martin_and_Mitchell_defection ), finding actual irregularities in someone's finances and threatening to go after them for it etc.
Again, possible and somewhat plausible but probably just a journalist fabricating a source or being misled by one. Yellow Journalism is a thing after all https://en.wikipedia.org/wiki/Yellow_journalism and if you look at papers in the 19th century you see all sorts of outright fabrications just to sell papers, like the Great Moon Hoax https://en.wikipedia.org/wiki/Great_Moon_Hoax
An oft repeated trope that holds no place in the repertoire of someone that's read history.
Look as recently as the Manhattan Project for an example starkly to the contrary of your assertion.
Large groups of people can conspire. It does happen, more than we can ever know.
It didn't stay too secret, Soviet atomic spies penetrated the program.
Emil Julius Klaus Fuchs for example was convicted of supplying information from the American, British, and Canadian Manhattan Project to the Soviet Union during and shortly after the Second World War https://www.wikiwand.com/en/Klaus_Fuchs
https://www.wikiwand.com/en/Atomic_spies has other info about the spying attempts during the time.
I would've liked to hear this directly from the company doing the audit, without Super Micro's own "interpretation".
The second thing that bothers me about this story is that it was Supermicro that paid for the audit. Maybe there was no one else going to do it, or maybe they just thought to get ahead of anyone else trying to review their chips. I don't know, but it doesn't sit well with me.
Only recently we saw at least two major tech companies skirt FCC's privacy monitoring by paying themselves for the audits: Google and Facebook. Both had multiple major privacy scandals in the past couple of years, but somehow all of these privacy issues were completely missed by the companies auditing them.
So I guess yes you can bypass Super Micro if you're a customer.
I seem to remember a very hostile and skeptical attitude from HN against Binance doing exactly this sort of thing when they announced the results of their paid-for "audit" of Tether financials. Why aren't we treating Super Micro's report of the audit the same way?
It's just crazy conspiracies all the way down.
Or possibly the leaker made a horrible mistake regarding facts?
Or possibly there is indeed a conspiracy to cover up a hardware backdoor?
These are tough times my friend.