Hacker News Reader

Come on, we both know the score here.. There is no ethical purchaser.

That was my assumption, but my netsec knowledge could be written on a stamp, so who knows! ;-)

I imagine some people think being rewarded for finding vulnerabilities is unethical entirely, but there seems to be a huge dose of pragmatism around the space.

Answered here: https://news.ycombinator.com/item?id=27875883

Thanks - that was helpful.

In theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor.

Alternatively depending on how nationalistic someone feels NSA could be a eithical buyer for them as well.