Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If someone is going to accuse a company of having third party spy chips in their phones, they'd better be ready to prove it. Especially if that company is known for their insanely strict (not very strict, actually insane) supply chain management and have been known to put suppliers into bankruptcy for not meeting the company's supply needs exactly (GTAT sapphire). Especially a company very recently in the news for having picked apart every chip on a server motherboard to find out if any of those chips were not in the BOM.

I don't have to blindly trust anything to know the burden of that proof is on the person making that claim. If you're going to accuse that company of mismanaging their supply chain and compromising the security of their users and their products while crowing publicly otherwise, you'd better come with some evidence.



Assume innocence over guilt, assume guilt over innocence; false positives or false negatives. Where burden of proof stands depends on the kind of error you're attempting to minimize.

In this case I don't think it's warranted to try and minimize the rate of error of accidentally not trusting even if you have had some trust before. It's because security is a hard, induction-based problem. You counter it with vigilance in the long-run. Ignoring local rumors with high potential impact adds up.

Additionally unless you truly believe you can't be impacted by privacy theft or think your actions are so petty that they would never be useful to analyze by a bad actor; or, you additionally have Apple stock or some equivalent stake, I don't know why you wouldn't be willing to distrust vehemently. To me it seems like accidentally being wrong about Apple is not worse than any of those things.


Alright then, I can play that game too. Apple Watches collect and process your DNA and the US Army uses it to create waves of genetic clone soldiers.

It must be true, because some random person said it on the Internet. If you want to assume Apple is doing awful things based on laughably improbable rumors with absolutely no proof, you must believe this is true. Every soldier is actually a genetic clone of an Apple Watch wearer, and you must explicitly accept this as true because I said it's true. I don't have to prove it's right, and you can't prove it's wrong, which by your logic means it must be true with no exceptions.

Unless you truly believe you can't be impacted by DNA theft or your genes are so petty that they would never be useful to the US Army, or you own Apple stock or some other stake, you must believe that Apple is creating an army of clones that will replace you and integrate into society as sleeper agents until the revolution is upon us.

You see how ridiculous that sounds? That is your argument.


My argument is weaker, it's just "trust but verify" plus our disagreement about the background probabilities of such rumors being correct based off of the contextual information we each believe is relevant. Chinese espionage and tech transfer is not a new thing but it's only recently been coming to a head in geopolitical discourse.

Try browsing this 2018 report: https://ustr.gov/sites/default/files/Section%20301%20FINAL.P...

Most of the indicting evidence is mainly cyber-security related, which is not always the same as exploiting a hardware backdoor. But hardware backdoors are a solid vector for penetrating digital systems and this strategy has been exploited by state actors and corporate actors in domestic and foreign operations before. Like NSA plus Intel chips or their Google data-center taps as revealed through the PRISM leaks. Or Google with their microphones bypassing the recording lights.

So even if the evidence currently falls in Apple's favor, which is fine, there's still no good reason to believe that this will always be true and it's still good security hygiene to go through a cycle of paranoia to ensure that it stays true. China is just the most recent bad actor to add to the pile of institutions to defend against.

I agree that the rumor itself could be weak. But I would also be curious under what conditions you would be willing to take on the possibility of compromised hardware. Would it have to be Apple's CEO taking the issue public, risking their stock price? Would it have to be a verified Apple insider putting their reputation on the line for leaking trade secrets about their pipeline without confronting their superiors first?


It should also go without speaking that distrust is not quite the same as believing something. It's closer to holding doubt, and even if doubt can be motivated by a guess it's not the same as endorsing a guess as fact. You're misrepresenting my point in at least that regard.


Assume innocence over guilt is for individuals. For huge entities, the sane approach is to doubt them and request continuous never ending proof they are well behaving.

Currently the opposite is happening.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: