What would it take to convince you that there are no rogue chips, malware or security compromise? I don't personally know if the Bloomberg story is false. But

What would it take to convince you that there are no rogue chips, malware or security compromise? I don't personally know if the Bloomberg story is false. But I do know that, so far, it's essentially unsubstantiated. So let's assume for the sake of argument that the Bloomberg story is incorrect. What would you expect a company to do other than issue a strongly worded denial and explain their side of the story? What would you have them do, publish their entire network logs and supply chain security assessment notes just because an unsubstantiated story claims they were compromised? In essence: it sounds to me like you're demanding evidence to disprove an accusation that doesn't have any evidence. That doesn't strike me as a fair or rational way to ascertain truth. Now I have a few responses to your specific points: > I am not aware of a single f500 company that was not breached at some point Most Fortune 500 companies have not suffered a breach. Every single company in the world has critical/high severity vulnerabilities in any given software product at any given time; this is the essential nature of software in 2018. A breach is something categorically different: it consists of a technical security vulnerability which has been demonstrably exploited to achieve tangible data compromise and exfiltration. Unless you have access to information I don't, no, most Fortune 500 companies have not experienced this. Consider that tech journalism has begun to conflate security vulnerabilities and actual data breaches in recent years. > Scanning outbound connections is not a meaningful defense in this case there are legitimate outbound connections going to say China and given China's ability to capture any inbound traffic there are def. ways to ex-filtrate data without raising any flags. This kind of claim borders on fantasy and conspiracy theory. Apple employs more security engineers than most companies in the world employ people period. If your threat model provides your adversary with vague omnipotence such that they can exfiltrate data undetected across countries under the nose of one of the most capable information security teams in the world for months at a time, then the entire discussion is moot. If you honestly believe that's a reasonable thing to believe then our disagreement is fundamentally insoluble. Do you honestly believe it's reasonable to say no material details were provided in this letter when you're talking about data exfiltration from Apple with no material details of how China would do that? You can't just give fantastical powers of exploitation to an adversary because they're a country. If we bring this down to reality we have the following observations: 1. The attributes and capabilities you're assuming of the adversary in this story are not only unproven, they're unfalsifiable. We can talk about what could be possible all day long, whether it's the NSA, China, Russia, chemtrails, 9/11, etc. I can also claim there's an invisible 0day that can compromise our entire electrical grid sitting on my desktop. Prove me wrong? 2. Bloomberg's story is essentially unsubstantiated. The sources are anonymous and several claims rely on a single source. At least one source has come forward to disagree with the story as written. 3. Every company involved in Bloomberg's story has issued vehement denials. If your response to a denial is, "But there could be a gag order!" then I'm frankly curious what level of evidence you think is required to refute an accusation that has no evidence.