Let's all accept a depressing fact: effective cyber-security places all of us in a state of perpetual war. You cannot learn from your enemy without invasive action, and you cannot test your capabilities without constantly attacking your adversaries, whether they know it or not. We cannot simply fork their nation's Github repo and try out zero-days in a safe and isolated environment.

We shouldn't be so quick to rail against government zero-day stockpiling. It is likely that other branches of government are using these flaws for their own means to monitor foreign states and other entities. If we give up that power we risk crippling our offensive capabilities more than we might stand to gain by having a stronger defense.

I cannot vouch for one side or the other. I am not a senior intelligence official and I do not have all the facts.