Something I've never been able to wrap my head around is the scale at play with the Supermicro story.

If the story is that a small handful of motherboards that were destined to be shipped to cloud providers from Supermicro had some remote monitoring / control capabilities (of varying types opportunistically applied) added to them at the behest of the Chinese government that sounds completely plausible and incredibly hard to verify and/or defend against.

I say plausible as we know that US intelligence agencies have conducted similar actions:

https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...

And that's without even direct access to the manufacturing floor (as in the Supermicro case).

Was it confirmed that it was made up?

It’s often impossible to prove something didn’t happen. (Overused example: you beat your wife, prove you didn’t.) But when all parties involved universally denied the event (unusually strongly in this case), and the journalists couldn’t produce a single piece of solid evidence, especially considering the attack surface was pretty big (14 companies they say?), I’d say at least the story failed pretty epically as far as journalism goes.

Also take into account the fact that when the story first broke, people were quick to point to past reports by the same journalists that are provably false but never retracted.

Btw, last I heard about this story, it was said (IIRC) that Bloomberg assigned different journalists to re-investigate it. Did anything ever come of it?

It was denied. No one else was able to confirm the existence. Bloomberg never mentioned it again. Does not sound like a solid story.

> Bloomberg never mentioned it again.

If they're unable to determine the veracity of the story, they should retract it. If they're convinced of some elements of the story but not others, they should say so.

The failure to follow up with either affirmation or retraction seems dishonest.

The thing is, if they were unable to determine the veracity they would have retracted it.

If they had been able to determine the veracity of it they would be able to tell us the ways that they did. Not just silence.

Discussing sources is tricky business for journalists, but given the pushback, it seems like at the very least Bloomberg should have conducted some follow-up investigations.

How can you confirm that something is false without any evidence for it being true in the first place?

I don't know, but I see that some assume it is false because companies mentioned denied it, well, everyone would deny it. If they didn't they would go out of business (at least the cloud part of those companies).

I ask, because it is quite plausible to have something like this planted, considering that majority of electronics is produced in one country.