Comment by grugq

> I appreciate your honesty and taking responsibility.

It is a fatal character flaw I have. When people want to know about something I try to help them.

> You mention that everyone is doing it with no citations of academic sources. I'd be interested in reading any recent research you believe is high quality

There was one by RAND which is good.

https://www.rand.org/content/dam/rand/pubs/research_reports/...

> represents the current market.

There is nothing that I am aware of that discusses the current market. The RAND paper is closest.

> acting in good faith.

I should not have used a blanket statement. My point is that there are people in IC who are legitimately going after terrorists and child abusers. They have a legitimate need for capabilities that enable them to do that.

I am not saying that the IC is a benign and wonderful government organ. I am saying that within IC there are people who are actually hunting terrorists and pedophiles. I didn't want to explain all of that because it is obvious that it is true. Hence, "lets take it for granted". Rather than discussing the history of the IC, I wanted to explain that there are legitimate uses for 0day and that is the issue being discussed.

The rest is not relevant to explaining how the vulnerability market operates. (Well, how it did in 2011.) When someone asks "how do shares work?" you don't start off by talking about boom and bust markets and macroeconomics. Same thing here. "How does the market work?" is not a question about the IC. It is about how the market works. If you're talking about the vulnerability market you talk about the vulnerability market. You have to assume that there are legitimate players who are acting in good faith.

This entire post is why I abridged it to "lets assume good faith."