>Even today a 'zero day' exploit for a major platform can be dealt with though But they can only be dealt with once they're discovered by people with an incent

>Even today a 'zero day' exploit for a major platform can be dealt with though But they can only be dealt with once they're discovered by people with an incentive to fix it. The NSA says they weren't using Heartbleed[1], but I can't think of a single reason they wouldn't lie about it. In any case, that was a massive security flaw that could have conceivably been exploited for more than a decade. If it affects 30 percent of systems instead of 90 percent, that seems like worthwhile hedging of bets. [1] http://www.engadget.com/2014/04/11/nsa-heartbleed/ http://www.engadget.com/2014/04/11/nsa-heartbleed/