> Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? No. I'm disagreeing with his speculation being s

> Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? No. I'm disagreeing with his speculation being stated as fact with nothing to back it up. This is something he does a lot. I realise he's not the most technical author, but a link would go a long way. The monetization of exploits has been around for a long time, a lot longer than OWASP and longer than people had mature software security programmes. Whatever incentive there is, so far hasn't resulted in a public incident that I can clearly think of, so I would say that while the incentive may exist, the relationship damage between the governments in question buying an exploit of a deliberately introduced bug and getting caught doing so would be too high risk for the government in question to buy it. I admit that there may be more look in finding a private sector customer, or even some intermediary, but again, we're not aware of this ever happening, this market has existed for a long time and if it was a real incentive I would have expected something high profile by now. I am happy to be proven wrong on this one, so if anyone has any examples please do call me out on this.