Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Micro says review found no malicious chips in motherboards

reuters.com

Post reply on HN
Print view View original

121–130 of 355 posts

Re: Super Micro says review found no malicious chips in motherboards

#121

Post by ghaff »

joshstrange wrote: post #32
majia wrote: post #25

Earlier quoted context omitted.

It's rather easy for someone to mislead a BP reporter who understands little about the technical details but is very eager to publish something shocking. The reporter may have emailed a few dozen security researchers to verify the story, but those who don't believe in the story are less likely to reply (and the reporter is more likely to ignore them), leading to a sampling bias.

And/or the people who did reply gave a response of something along the lines of “Its technically possibly but...” and the author ignored everything after the but.

TBH if you’re talking to a reporter, thats a bad way to answer a question. “It’s technically possible” is the sort of sound bite someone will grab while ignoring the 5 minute spiel on IPMI and bus interfaces etc. that follows. Be very careful about giving short quotable statements in plain English that you don’t want to see in print.

Re: Super Micro says review found no malicious chips in motherboards

#122

Post by MagnumOpus »

finnthehuman wrote: post #54
neya wrote: post #28

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's…

>What are the consequences for Bloomberg for this incompetence? You, not the general concept of the reader, but you personally neya. You stop trusting Bloomberg's reporting. That's the consequence. Their reputation suffers. Why do threads like this on HN always have such a desire for retribution?

Hundreds of locked-in AAPL shareholders who react with venom to anyone perceived to be hurting their financial performance, irrespective of truth or morality. (Same is true for FB and GOOG.)

Re: Super Micro says review found no malicious chips in motherboards

#123

Post by piva00 »

admax88q wrote: post #97
bob_theslob646 wrote: post #55

Earlier quoted context omitted.

Their reporters are compensated based off of whether or not they move markets. Did you know that? ( https://www.businessinsider.com/bloomberg-reporters-compensa... )

That doesn't seem like a bad goal. It incentivizes stories that are important to their target market, and provides an easy way to measure that.

Or you can apply Goodhart's Law[0] and try to picture how wrong that can also go.

[0] https://en.wikipedia.org/wiki/Goodhart%27s_law

Re: Super Micro says review found no malicious chips in motherboards

#124

Post by crispyambulance »

admax88q wrote: post #94
stupidbird wrote: post #77

There has to be more to this story that we don't know. Bloomberg has a lot to lose by publishing such a harsh claim that's not extremely fact-checked. Reliable newspapers generally don't throw around anonymous government sources without doing background checks on these people. I have little doubt that they got the information from who they say they did. At this point I wonder if they should stop protecting their sour…

> At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth. That would be a mistake. Don't just throw your sources to the wolves if you couldn't prove their story. They should press their sources for proof, or stronger evidence. If they can't find any then they should issue a retraction.

The "should have" pressed the sources for hard proof, or found examples in the wild of adulterated servers before publishing the story. That ship has sailed, of course.

But if what was reported was actually true the best thing that can happen now, for Bloomberg and the public, is for their sources to step forward voluntarily with proof.

Admittedly, that will take a lot of courage in today's political climate, but if it's not all just bullshit, highly principled people may do it.

What I would like to know is what the Bloomberg reporters expected would happen as a result of this story?? Did they think Supermicro and Apple would just admit it? Then what?

Re: Super Micro says review found no malicious chips in motherboards

#125

Post by sosborn »

admax88q wrote: post #97
bob_theslob646 wrote: post #55

Earlier quoted context omitted.

Their reporters are compensated based off of whether or not they move markets. Did you know that? ( https://www.businessinsider.com/bloomberg-reporters-compensa... )

That doesn't seem like a bad goal. It incentivizes stories that are important to their target market, and provides an easy way to measure that.

> That doesn't seem like a bad goal.

Like most sales goals, it seems reasonable. And then you remember that when it comes to pay, some people will do anything.

Re: Super Micro says review found no malicious chips in motherboards

#126

Post by joshstrange »

hopler wrote: post #110
joshstrange wrote: post #32

Earlier quoted context omitted.

And/or the people who did reply gave a response of something along the lines of “Its technically possibly but...” and the author ignored everything after the but.

What would go after the but? Third parties don't know whether a board was exploited.

"but unless I was able to inspect the board I wouldn't believe it's happening"

"but that kind of attack has never been seen in the wild and is highly unlikely"

"but large tech companies have teams that vet the hardware they use on a unit by unit basis and would notice something like that"

Re: Super Micro says review found no malicious chips in motherboards

#127

Post by creeble »

ryanmercer wrote: post #22

People worry about malicious chips in instances like this and I mean it's a valid concern but one method of attack I've always thought would be effective and extremely dangerous is strategic placing a component in a circuit that, if it fails, disables the entire device then you simply need a way to activate it. Radio. Design a circuit, or better something that appears to be a capacitor and functions as a capacitor bu…

Dude I think you need to understand more about radio before writing about it.

Re: Super Micro says review found no malicious chips in motherboards

#128

Post by Karunamon »

albedoa wrote: post #86
Symmetry wrote: post #58

Earlier quoted context omitted.

It apparently wasn't the first time these reporters had gone off the rails.[1] [1] https://twitter.com/RobertMLee/status/1049617855396933632

One was also the author of the fake NSA Heartbleed exploit story, which Bloomberg stood by: https://twitter.com/nicoleperlroth/status/104901890298483507...

So why are we giving these reporters the time of day, then? They've demonstrably published crap and not retracted it. That reduces their credibility to nil in my mind.

Re: Super Micro says review found no malicious chips in motherboards

#129

Post by joshstrange »

ghaff wrote: post #121
joshstrange wrote: post #32

Earlier quoted context omitted.

And/or the people who did reply gave a response of something along the lines of “Its technically possibly but...” and the author ignored everything after the but.

TBH if you’re talking to a reporter, thats a bad way to answer a question. “It’s technically possible” is the sort of sound bite someone will grab while ignoring the 5 minute spiel on IPMI and bus interfaces etc. that follows. Be very careful about giving short quotable statements in plain English that you don’t want to see in print.

That's fair, I think it's also fair to point out that the people with the technical know-how about these things aren't often talked to by the press. I mean how many stories do you see about hardware tampering like this? They might not be very well versed in how to communicate with them. Also I know that I have a tendency to enjoy talking through possibilities and scenarios and so could see myself (I'm not a hardware or security expert at all but the points stands) discussing at length how such a thing COULD work and just being excited to talk about a field I am well versed in. A reporter could then take that as my signing off on that it DID happen.

Re: Super Micro says review found no malicious chips in motherboards

#130

Post by hannasanarion »

scarhill wrote: post #49
assblaster wrote: post #2

The question I have is: is it possible that there was such an incredible threat to national security that even an auditor could be convinced by a federal agency to give a false report? If it really didn't happen, how could a reputable news agency get a report so wrong? What exactly is going on here?

WRT the how could they get it so wrong question, I guess it's time for the obligatory link to Michael Crichton's essay "Why Speculate?" and his discussion of the "Murray Gell-Mann Amnesia Effect" [1] Money quote: "You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the journalist has absolutely no understanding of either t…

Not that Michael Crichton should be treated as an authority on truth in reporting. He believed there was a vast worldwide conspiracy to defraud poor innocent oil companies by manufacturing evidence of global warming.
Post reply on HN