There is a zero sum trade-of between exploit brokers and the public's interests. I don't mind for-profit businesses, especially large ones, paying for exploits

There is a zero sum trade-of between exploit brokers and the public's interests. I don't mind for-profit businesses, especially large ones, paying for exploits to their own products. Open source projects such as the BSDs, however, can't afford it and they donate their work to the public for public benefit. For those systems selling and buying exploits rather than reporting them to the devs is unethical, IMHO, for both the exploit discoverer and the broker.