3 ms·

I have seen absolutely no evidence that the story was bullshit. It's clearly unconfirmed and probably shouldn't have been reported for that reason. But there's

I have seen absolutely no evidence that the story was bullshit. It's clearly unconfirmed and probably shouldn't have been reported for that reason. But there's a difference between unproven and proven wrong. Did I miss some evidence that proved this story false?

zepto 7y ago
It is literally a conspiracy theory. Why should anyone believe it true without some kind of proof.
- solidasparagus 7y ago
  I generally believe that the default reaction to a news story should be "it might be true, it might not". The ratio depends on the claim and the evidence. This is an extraordinary claim with mediocre-to-weak evidence, so I'm on the "unlikely to be true" side, but it's hardly an impossible story. The story is essentially that there was a breakthrough in an effort that everyone in the world is pursuing (hardware supply chain attacks) and then everyone involved behaved as you'd expect them to behave (secretive at first and then defensively once the secret was out). While I don't expect people to believe it, I do expect some evidence if you're going to call it bullshit.
  - otterley 7y ago
    You’re needlessly nitpicking. The more fantastic the story, the greater the burden of proof needed to sustain it. It’s never been the public’s burden to disprove a story that no one has ever heard before. And at this point, enough time has passed since the story broke without any evidence being put forth that it’s reasonable for people to think that yes, in fact, the story is likely bullshit.
    - solidasparagus 7y ago
      It is reasonable to think that the story is likely bullshit. It is not, IMO, reasonable to go from that to claiming that it has ruined the credibility of the reporting organization and that you should presume all stories from them are likely false. To come to that conclusion, I believe you need some proof that the reporting was incorrect, not a lack of proof that the story was correct. When we are talking about national security, the consequences of sources being identified are so high that it is not surprising that Bloomberg is unwilling to provide primary sources.
      - otterley 7y ago
        Trust is the currency of journalism. When journalists make fantastic claims that turn out to be false, it tarnishes the credibility both of themselves and the enterprises that sponsor them and publish their work. I don't think anyone is actually saying that everything Bloomberg publishes is suspect without exception (the quote above notwithstanding). Nobody would question, based on previous history, a Bloomberg story claiming water is still wet. Where they do lack credibility now are stories claiming bombshells relating to technology companies. In this instance we have both Alex Stamos, who knows a lot of inside information and is a well-regarded security expert, and the head of WhatsApp itself both denying the claims. And any time a company or one of its high level representatives makes a material statement of fact, investors are going to pay close attention. If they prove to be wrong, an army of shareholders' attorneys are going to march to court to extract a pound of flesh. If there were even a shred of possibility that these stories were true, these folks -- as well as the leaders at Amazon and Apple implicated in the earlier stories -- would clam up instead of going on the record unambiguously denying the stories.
        solidasparagus 7y ago
        But this hasn't "turned out to be false". It's unconfirmed and thus very suspicious. This is an article about an attack so advanced it's generally considered impossible, using the most valuable attack vector in the most important battlefield (see DNI Maguire's hearing answer to the biggest threat facing America) between the world's two superpowers. Would it really be that shocking if, after an initial leak, the US government was able to shut down leaks? You make good points, particularly around the public denials, and I don't want to debate this any further (I was mostly railing against that ridiculous quote), but I think people are being pretty quick to claim this report is false rather than probably false. 130,000 people worked on the atomic bomb for 6 years in secret - when it comes to matters the government considers crucial to national security (and cutting edge breakthroughs in cyber warfare would certainly qualify), silence can be kept.
        zepto 7y ago
        You are missing the point. Bloomberg has provided no evidence at all that it is true. A report that is not supported by any evidence is not just ‘unconfirmed’. It is bullshit plain and simple.
- soup10 7y ago
  these are the same companies that were "shocked" by the snowden revelations. its not a question of "are these databases less secure than advertised, its a question of to what degree are they less secure than advertised. so i think calling the china access a conspiracy theory is too naive
craftinator 7y ago
Reporting is not and should not be "innocent until proven guilty". You don't need evidence of bullshit to mistrust a media article, you need lack of validation. If a scientist suddenly discovers a new means of creating fusion, but refuses to release any data about it, no one is going to believe him/her, and no one will fund them either. If they aren't reporting based on facts, they should be reporting at all.
- skybrian 7y ago
  Nope, that's not actually a rule. Sometimes reporters can work that transparently, but they can also report stories based on private information, and your only choice is whether to trust that they're telling the truth. For example, a newspaper will sometimes report things based on anonymous sources. You don't get to know who the sources are. You just have to trust that the newspaper isn't making things up and properly vetted their sources. Of course, that doesn't mean you immediately start trusting any random reporter or newspaper, but trust is based on track record and reputation, not being transparent about sources in every story.
- solidasparagus 7y ago
  I'm of the opinion that you need evidence of bullshit if you're going to claim that the reporting organization has lost all credibility. Anonymous sources unwilling to go public is the nature of intelligence community reporting. If this story is real and sources are made public, people are almost certainly going to jail - some of those sources (if real) had to have security clearances.
  - vkazanov 7y ago
    ...and spreading unverifyible rumours and believable misinformation also is (the nature of intelligence community reporting). Almost by definition. Can't replicate or check info? Then there's no information to speak about in the first place.
kccqzy 7y ago
Did you look at the unequivocal denials posted by the very companies mentioned in the story? As Bloomberg reported: https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond https://www.bloomberg.com/news/articles/2018-10-04/the-big-h... Apple: https://www.apple.com/newsroom/2018/10/what-businessweek-got-wrong-about-apple/ https://www.apple.com/newsroom/2018/10/what-businessweek-got... Amazon: https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/ https://aws.amazon.com/blogs/security/setting-the-record-str... Supermicro: https://www.supermicro.com/en/pressreleases/supermicro-refutes-claims-bloomberg-article https://www.supermicro.com/en/pressreleases/supermicro-refut...
- solidasparagus 7y ago
  I did. I would need a lawyer to better understand what exactly we can extract from those denials, but this is what I can say for sure: all 3 of those companies would be extremely damaged by the public thinking this story is true. AWS considers security to be its single most important job and if the public discourse were to become cloud=supply-chain vulnerability, it would be devastating. This is clearly an existential threat to SuperMicro. I can't say as much about Apple, but from the outside it looks like they believe security/privacy to be one of their core brand strengths. Whether the article is true or false, I would fully expect these companies to minimize the impact of this article to the full extent they are legally able. I would need a legal opinion to understand if their denials would put them at legal risk were the article to be true (in which case I would be much more inclined to believe their denials) and whether their denials tell us anything about potential government gag orders (if the article is correct about a top-secret investigation, I would imagine they would have legal obligations around what they can say). I don't want to use false equivalence to make it seem like I believe this article is as likely to be true as not (I think it's unlikely or at least extremely misleading), but everything I can see from my not-so-informed position is consistent with both a true and a false article.

zepto 7y ago

It is literally a conspiracy theory. Why should anyone believe it true without some kind of proof.

solidasparagus 7y ago
I generally believe that the default reaction to a news story should be "it might be true, it might not". The ratio depends on the claim and the evidence. This is an extraordinary claim with mediocre-to-weak evidence, so I'm on the "unlikely to be true" side, but it's hardly an impossible story. The story is essentially that there was a breakthrough in an effort that everyone in the world is pursuing (hardware supply chain attacks) and then everyone involved behaved as you'd expect them to behave (secretive at first and then defensively once the secret was out). While I don't expect people to believe it, I do expect some evidence if you're going to call it bullshit.
- otterley 7y ago
  You’re needlessly nitpicking. The more fantastic the story, the greater the burden of proof needed to sustain it. It’s never been the public’s burden to disprove a story that no one has ever heard before. And at this point, enough time has passed since the story broke without any evidence being put forth that it’s reasonable for people to think that yes, in fact, the story is likely bullshit.
  - solidasparagus 7y ago
    It is reasonable to think that the story is likely bullshit. It is not, IMO, reasonable to go from that to claiming that it has ruined the credibility of the reporting organization and that you should presume all stories from them are likely false. To come to that conclusion, I believe you need some proof that the reporting was incorrect, not a lack of proof that the story was correct. When we are talking about national security, the consequences of sources being identified are so high that it is not surprising that Bloomberg is unwilling to provide primary sources.
    - otterley 7y ago
      Trust is the currency of journalism. When journalists make fantastic claims that turn out to be false, it tarnishes the credibility both of themselves and the enterprises that sponsor them and publish their work. I don't think anyone is actually saying that everything Bloomberg publishes is suspect without exception (the quote above notwithstanding). Nobody would question, based on previous history, a Bloomberg story claiming water is still wet. Where they do lack credibility now are stories claiming bombshells relating to technology companies. In this instance we have both Alex Stamos, who knows a lot of inside information and is a well-regarded security expert, and the head of WhatsApp itself both denying the claims. And any time a company or one of its high level representatives makes a material statement of fact, investors are going to pay close attention. If they prove to be wrong, an army of shareholders' attorneys are going to march to court to extract a pound of flesh. If there were even a shred of possibility that these stories were true, these folks -- as well as the leaders at Amazon and Apple implicated in the earlier stories -- would clam up instead of going on the record unambiguously denying the stories.
      - solidasparagus 7y ago
        But this hasn't "turned out to be false". It's unconfirmed and thus very suspicious. This is an article about an attack so advanced it's generally considered impossible, using the most valuable attack vector in the most important battlefield (see DNI Maguire's hearing answer to the biggest threat facing America) between the world's two superpowers. Would it really be that shocking if, after an initial leak, the US government was able to shut down leaks? You make good points, particularly around the public denials, and I don't want to debate this any further (I was mostly railing against that ridiculous quote), but I think people are being pretty quick to claim this report is false rather than probably false. 130,000 people worked on the atomic bomb for 6 years in secret - when it comes to matters the government considers crucial to national security (and cutting edge breakthroughs in cyber warfare would certainly qualify), silence can be kept.
        zepto 7y ago
        You are missing the point. Bloomberg has provided no evidence at all that it is true. A report that is not supported by any evidence is not just ‘unconfirmed’. It is bullshit plain and simple.
soup10 7y ago
these are the same companies that were "shocked" by the snowden revelations. its not a question of "are these databases less secure than advertised, its a question of to what degree are they less secure than advertised. so i think calling the china access a conspiracy theory is too naive

craftinator 7y ago

Reporting is not and should not be "innocent until proven guilty". You don't need evidence of bullshit to mistrust a media article, you need lack of validation. If a scientist suddenly discovers a new means of creating fusion, but refuses to release any data about it, no one is going to believe him/her, and no one will fund them either. If they aren't reporting based on facts, they should be reporting at all.

skybrian 7y ago
Nope, that's not actually a rule. Sometimes reporters can work that transparently, but they can also report stories based on private information, and your only choice is whether to trust that they're telling the truth. For example, a newspaper will sometimes report things based on anonymous sources. You don't get to know who the sources are. You just have to trust that the newspaper isn't making things up and properly vetted their sources. Of course, that doesn't mean you immediately start trusting any random reporter or newspaper, but trust is based on track record and reputation, not being transparent about sources in every story.
solidasparagus 7y ago
I'm of the opinion that you need evidence of bullshit if you're going to claim that the reporting organization has lost all credibility. Anonymous sources unwilling to go public is the nature of intelligence community reporting. If this story is real and sources are made public, people are almost certainly going to jail - some of those sources (if real) had to have security clearances.
- vkazanov 7y ago
  ...and spreading unverifyible rumours and believable misinformation also is (the nature of intelligence community reporting). Almost by definition. Can't replicate or check info? Then there's no information to speak about in the first place.

kccqzy 7y ago

Did you look at the unequivocal denials posted by the very companies mentioned in the story? As Bloomberg reported: https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond https://www.bloomberg.com/news/articles/2018-10-04/the-big-h... Apple: https://www.apple.com/newsroom/2018/10/what-businessweek-got-wrong-about-apple/ https://www.apple.com/newsroom/2018/10/what-businessweek-got... Amazon: https://aws.amazon.com/blogs/security/setting-the-record-straight-on-bloomberg-businessweeks-erroneous-article/ https://aws.amazon.com/blogs/security/setting-the-record-str... Supermicro: https://www.supermicro.com/en/pressreleases/supermicro-refutes-claims-bloomberg-article https://www.supermicro.com/en/pressreleases/supermicro-refut...

solidasparagus 7y ago
I did. I would need a lawyer to better understand what exactly we can extract from those denials, but this is what I can say for sure: all 3 of those companies would be extremely damaged by the public thinking this story is true. AWS considers security to be its single most important job and if the public discourse were to become cloud=supply-chain vulnerability, it would be devastating. This is clearly an existential threat to SuperMicro. I can't say as much about Apple, but from the outside it looks like they believe security/privacy to be one of their core brand strengths. Whether the article is true or false, I would fully expect these companies to minimize the impact of this article to the full extent they are legally able. I would need a legal opinion to understand if their denials would put them at legal risk were the article to be true (in which case I would be much more inclined to believe their denials) and whether their denials tell us anything about potential government gag orders (if the article is correct about a top-secret investigation, I would imagine they would have legal obligations around what they can say). I don't want to use false equivalence to make it seem like I believe this article is as likely to be true as not (I think it's unlikely or at least extremely misleading), but everything I can see from my not-so-informed position is consistent with both a true and a false article.