I don't believe the NSA are incompetent. I believe they are malevolent, in that they prioritize spying on American citizens (indirectly, of course) over finding

I don't believe the NSA are incompetent. I believe they are malevolent, in that they prioritize spying on American citizens (indirectly, of course) over finding and fixing these kinds of vulnerabilities. They expend vastly more on spying, cataloging, and archiving information about people than they do on figuring out when the software that runs the Internet is vulnerable. If they are to exist on the taxpayer dime, they should serve the taxpayer first and foremost. They like to brag about this kind of thing, because it makes them look good (and maybe allows them to believe they are "good people", as I often see folks who defend the NSA say of them) but it isn't actually their priority, and it is not something they have a history of doing. For example, this is the kind of thing the NSA actually spends significant money on: https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center That same money would have employed a number of excellent security researchers, and the tools they need to help make the Internet a safer, more secure place, for all Americans. In short, this kind of article is misdirection, and people in our industry should not be snowed by those tactics. We should know better, based on their historical behavior.