Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is a little bit like talking about why they hoard the guns. The reason governments have caches of exploit chains is not hard to understand.


It is substantially different from hoarding guns: not hoarding exploits takes away those exploits from adversaries.

If an important factor is the ratio of exploits A and B have, then publishing their hidden but common exploits the ratio does not remain the same.

The ratio is interesting because potential exploitation rate is proportional zero days (once used, the "zero" day is revealed and remediated after a certain time span).


You're the expert, and certainly not wrong, I wrote my comment because I have had to explain this to folks in a professional capacity and thought it might be helpful.


It's just a rhetoric thing. We're talking about the USG "hoarding" stuff, but, in a sense, the government has a conceptual monopoly on this kind of coercive capability. Anybody can find vulnerabilities and write exploits, but using them in anger and without mutual consent is an authority exclusively granted to law enforcement and intelligence agencies. This is just an extension of the "monopoly on violence".

The longstanding objection to this is that secretly holding a gun doesn't intrinsically make everyone less safe, and there's a sense in which not disclosing a vulnerability does. That argument made more sense back in and before 2010; it doesn't make much sense now.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: