Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Micro says review found no malicious chips in motherboards

reuters.com

Post reply on HN
Print view View original

231–240 of 355 posts

Re: Super Micro says review found no malicious chips in motherboards

#231

Post by User9991 »

ekianjo wrote: post #151
finnthehuman wrote: post #54

Earlier quoted context omitted.

>What are the consequences for Bloomberg for this incompetence? You, not the general concept of the reader, but you personally neya. You stop trusting Bloomberg's reporting. That's the consequence. Their reputation suffers. Why do threads like this on HN always have such a desire for retribution?

> Why do threads like this on HN always have such a desire for retribution? Let's say the Bloomberg article incurred 50% loss of revenues after it was published for Super Micro. (just making up numbers for the sake of the argument). Following this, Super Micro would have to scale down their operations and potentially fire people. That's just the same thing as sending a DMCA request on Youtube for something that is so…

>Let's say the Bloomberg article incurred 50% loss of revenues after it was published for Super Micro.

Except none of this happened, so it's a straw man.

And if it did, and SM were damaged, they would sue. That's how the justice system works.

Re: Super Micro says review found no malicious chips in motherboards

#232

Post by duxup »

neya wrote: post #28

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's…

I think it is possible to have enough information to run a story, but still be wrong, and a "my bad" can suffice.

Now how that plays out and where that line is, have at that debate until the end of time.

Re: Super Micro says review found no malicious chips in motherboards

#233

Post by exoesquitur »

From a technical perspective I found this story compelling, so I tried out a simple hack to see if it were "possible".

Using an attiny85 uC, a couple resistors, a cap, and a couple diodes I had laying around, I was able to wire up a two terminal "device" that pretty much acts like a 5k pull up resistor on a I2C line.... But when you pass data through the signal line (SDA) wire it can read and modify it. It is crude and very limited, but it works (only at lower I2C data rates in this case, but hey, it's a cheap hack).

A nation state adversary could trivially miniaturize this to the size and form of an SMT resistor, and use a much more capable uC in the process.

Im not saying that this substantiates the Bloomberg story in any way.

Just saying it's a great (black hat) idea, and it works.

It would surprise me a little if this weren't used in the wild by somebody.

Re: Super Micro says review found no malicious chips in motherboards

#234

Post by exoesquitur »

crispyambulance wrote: post #124
admax88q wrote: post #94

Earlier quoted context omitted.

> At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth. That would be a mistake. Don't just throw your sources to the wolves if you couldn't prove their story. They should press their sources for proof, or stronger evidence. If they can't find any then they should issue a retraction.

The "should have" pressed the sources for hard proof, or found examples in the wild of adulterated servers before publishing the story. That ship has sailed, of course. But if what was reported was actually true the best thing that can happen now, for Bloomberg and the public, is for their sources to step forward voluntarily with proof. Admittedly, that will take a lot of courage in today's political climate, but if…

If this is actually a thing, it's probably 5 eyes that has the most invested in the tech.

(Waves hands and puts on tinfoil hat)

Check mate, atheists.

Re: Super Micro says review found no malicious chips in motherboards

#235

Post by Bartweiss »

freeflight wrote: post #218
Bartweiss wrote: post #210

Earlier quoted context omitted.

This is certainly how things ought to work, but it's far from clear that it does. A reporter on an international affairs beat can't possibly dismiss sources as broad as the State Department or CIA - which makes it very possible to rotate through mouthpieces as they're proven unreliable. (And that's usually when clear dishonesty is found, not just plausibly-mistaken claims.) And anonymity is usually protected even whe…

> A reporter on an international affairs beat can't possibly dismiss sources as broad as the State Department or CIA It's actually worse, the power dynamics are completely lopsided: He/she can't disgruntle his governmental sources or else there's the very real possibility of being cut out of the loop/any access at all in the future. Which isn't a great prospect for any journalist because you can't get any "scoops" wh…

Yes, that's a very good point.

In-depth interviews, early story tip-offs, and 'approved' leaks with accurate content aren't just a way to distribute information and build connections with reporters, they're a way to cultivate dependence. If 95% of unverified content is accurate, a reporter who can't get pithy 'official' quotes or advance warning on stories will consistently produce worse output than those who can.

It seems like a few particularly famous publications can push back because they're too big to shut out, though their individual reporters often still fold. (e.g. the NYT on Iraqi WMDs.) And there's a bit of room for dedicated 'dissenting' sources like The Intercept and CounterSpin, because they can curate a reputation as leak recipients and then fill out the rest of their schedule with media analysis instead of breaking news. But overall, first-line sources seem to be very effectively trapped by this pattern.

Re: Super Micro says review found no malicious chips in motherboards

#236

Post by maemilius »

tertius wrote: post #216
voidmain wrote: post #169

Earlier quoted context omitted.

> Where do you see a problem with this type of response? "It is impractical because it is a descending spiral ending in destruction for all. The old law of an eye for an eye leaves everyone blind."

Or maybe a start to the democratic process to encourage lawmakers to discover nuance and legislate. Or maybe a good place for someone with knowledge to show why it's a bad idea and what the arguments are that have been struggled with. One person getting irked because another happily destroys reputation without any consequence is natural. Reputation is too important. A single person wanting to see consequence does not…

I feel like there's an argument to be made that every firebombing mob started with a single person wishing some consequence.

An idea has to start somewhere.

Re: Super Micro says review found no malicious chips in motherboards

#237

Post by kllrnohj »

ekianjo wrote: post #151
finnthehuman wrote: post #54

Earlier quoted context omitted.

>What are the consequences for Bloomberg for this incompetence? You, not the general concept of the reader, but you personally neya. You stop trusting Bloomberg's reporting. That's the consequence. Their reputation suffers. Why do threads like this on HN always have such a desire for retribution?

> Why do threads like this on HN always have such a desire for retribution? Let's say the Bloomberg article incurred 50% loss of revenues after it was published for Super Micro. (just making up numbers for the sake of the argument). Following this, Super Micro would have to scale down their operations and potentially fire people. That's just the same thing as sending a DMCA request on Youtube for something that is so…

Bloomberg has no intrinsic power over the revenue of Super Micro. They only have that influence because people trust them. People only trust them because their reports tend to be trustworthy.

False reports harm Bloomberg, as it erode their trustworthiness and trustworthiness is very nearly their only actual value/product. False reporting is inherently its own repercussion/consequence here.

This is different from DMCA as that has power granted to it by law, not by inherent trust. DMCA does also have consequences for fake claims, so it's a false equivalency here anyway.

Re: Super Micro says review found no malicious chips in motherboards

#239

Post by tomphoolery »

neya wrote: post #28

Let's say Super Micro is right and there were no malicious hardware at all for sure. What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something.. Just because you're a news organization, you can't simply escape with "Oh, my bad". This had real implications on stock prices of so many companies and wiped off shareholder value on many of them, including Super Micro. If Bloomberg's…

> What are the consequences for Bloomberg for this incompetence? I mean, there needs to be something..

Hah! What makes you think they should be accountable after we elected a President on the basis of fake news stories?

Re: Super Micro says review found no malicious chips in motherboards

#240

Post by asdff »

jakobegger wrote: post #29
pmorici wrote: post #14

Earlier quoted context omitted.

I think the most likely explanation is that Bloomberg got played by the sources who perhaps wanted to trade on the price action the story would obviously cause. We don't really know anything about Bloomberg's sources we do know the nature of all the parties denying any of this is true.

Nope. The only named source in the article said on Twitter that the journalist reported speculation about possible attacks as facts. The story was fabricated by the journalist. How it got through fact-checking, I don't know.

That doesn't mean people didn't feed the journalist heavy handed speculation to make a profit from short positions.
Post reply on HN