As always, logical reasoning arrives just a tad too late to the party. The original story has already circulated the web and stirred anger and mistrust in a sufficient amount of people who will never read this common sense follow-up. Chalk up one more win for sensationalism and fear-mongering.
The reason corrections to sensational stories never make it as far as the original is because the people who propagated the first story have to admit they were fooled, or at least misinformed. I'm about to share this correction to my own link feeds -- but I'll be honest, I'm not enthusiastic about looking dumb.
Most of the replies on HN to the original story lined up with this follow up article. Wait and see, it's a debug feature, not necessarily a military chip, etc. On many other sites it was a different story, and I'm sure this follow up won't make their headlines either.
I believe that the original version of that quote is, A lie can travel halfway around the world while the truth is putting on its shoes. In which case http://www.quotationspage.com/quote/23633.html says that it should be attributed to Mark Twain.
Except that it wasn't a lie, as the original article didn't make these claims. Only the HN headline -- which wasn't in the original article -- and this new article contain sensationalised claims ('bogus story', for example).
You could argue that the original was worded to be deliberately confusing, perhaps even implying that the claims were proven, but I certainly didn't find it that way when I read it.
Are we talking about the same article that had claims about how most chips are manufactured in China (false) and that the vulnerability could be used in a Stuxnet style attack?
Can you offer proof that those are both false? The China claim I grant you — especially as the actual claim was 99% (I somehow missed this in my initial reading).
The stuxnet thing is trickier. To make use of this remotely you (or a stuxnet style virus) would need access to a JTAG connection. These come in many forms, including USB (needing access to the host computer — like stuxnet) or Ethernet (needing access to the network). It seems a bit unrealistic because JTAG tends to be used for development, but field-reconfiguration is one of the advantages of FPGAs.
Of course, I believe this specific Actel FPGA uses flash for configuration, which makes updating it in the field somewhat inconvenient and therefore less likely to be used in practice. I remember hearing that this is why NASA switched to Xilinx, as they now require field reconfigurability.
Still, the article certainly wasn't 'bogus', and the new article claiming so contained far more errors. Especially when you read the actual paper and not just the linked press release.
