U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, First-Ever Report

Governments who want power will hoard the knowledge, which is power. Other governments will share. This is perpetual tension: we collectively receive utility when good policy is active (rapid dissemination of vuln info), but we need third parties to seek these exploits out when government cannot be relied on. Very similar to the concept of journalism being the Fourth Estate imho.

(vuln mgmt in finance is a component of my day gig)

Most likely these vulnerabilities were known by adversaries and they decided to report these to make it more difficult for those adversaries to attack.

I’m sure the really juicy zero days they’ve discovered in-house are kept out of reports like these

I doubt it. Historically, most government agencies around the world have had appalling security and each iteration is just as bad as the previous with a few half-assed patches on top to cover the known holes.

I might be a contrarian, but I think it makes sense for the NSA to hoard 0-days. They should disclose only after they burn them.

I'd be surprised if the policy continues.

Or if the people who worked at the agency are still there.

Take a wild guess as to which country has the most zero-day exploits and uses them to do reprehensible things...

Oh wait - Israel

Probably not, trump's first term he was all for allowing ransomware. And the only reason we started seeing a strategy for mitigating was because of Biden. Since trump is all in on crypto and the fact that russia is the main beneficiary of ransomware, I highly expect cybercrime to ramp up as the current admin is positioned to benefit directly.

Aint no way.

All major governments hoard 0days or buy them to use for espionage. I dont see this being some kind of "turning point" and more of a feel good easy PR win for the US gov but really they are still using many 0days to spy.

Similar, but my thought is that they found out some other gov(s) know about it as well. And that it hurts others more than it hurts the US gov.

This presupposes that the purpose of government is to protect citizens.

The purpose of government is to take and maintain power and prevent any other organization from displacing them. It involves citizens only as a means to an end.

It would be a failure of government to place citizen safety over continuity of government.

Yep. From the article:

> This lack of transparency could become a greater issue under the Trump administration, which has vowed to ramp up the government's cyber offensive operations, suggesting that the government demand for zero-day vulnerabilities may increase over the next four years. If this occurs, the government’s previous statements that the VEP favors disclosure and defense over withholding and offense may no longer be true. ...

> “The VEP and that number of 90 percent was one of the few places where the president and the White House could set the dial on how much they liked defense vs offense,” says Jason Healey, senior research scholar at Columbia University’s School of International and Public Affairs and former senior cybersecurity strategist for CISA. “[The Trump administration] could say we’re disclosing too [many vulnerabilities]. If the default [in the past] was to disclose unless there is a reason to keep, I could easily imagine the default is going to be to keep unless there is a reason to disclose.”

Easy, just hire people who constantly say “thank you for your leadership sir.”

I often talk about encouraging a truthseeking culture at work, because people naturally tend to gravitate toward easy or popular ideas.

But this is more like a lie-seeking culture.