I'm not sure this isn't a "good thing", to some degree. Companies like Apple and Google offer rewards for people who find exploits in their software, but they have little incentive to raise the reward even as the exploits become more and more rare, and demand more time to find. This may give them the false impression that there are no more exploits, while in reality they just haven't incentivized people sufficiently. This company operates on the other side (of which I don't approve), but by pricing exploits more accurately (via supply and demand), it forces companies to raise their prices as well to compete.

In other words, this can be seen as part of the free market incentivizing people and companies to find and patch exploits, or for programmers to just write safer code in general.

Since the offer is made by a shadowy organisation, how would we know whether it indicates anything reasonable? Companies with money to spare could use it to easily discredit competitors. First, company A offers $X (where $X might be a full-term equivalent salary or more) to a shadow broker for an exploit in company B's product. Likely outcomes include:

If an exploit is found, company A can play it for what it's worth, either accusing B of negligent behaviour, sloppy coding, defunct bug award program, etc., or exploiting the bug (via anonymously hired help) for a while, possibly in such a way that company B's customers notice the issue before company B does.

If an exploit is not found company A can still accuse company B of negligent behaviour if company B hasn't matched $X in their bug awards.

If company B has done everything right company A can pull the offer, and try to convince a reporter that this indicates an exploit was found and is being used without anyone at company B noticing. Dumber stories certainly have surfaced, and the damage could be significant.

Couldn't the same argument be made about a thriving market in ways to break into your house at night and kill you?

If your home has 250 mill people using it a month, probably.

More like... 250m people use a given brand of lock.

I wouldn't trust a lock that doesn't have a $500K bounty offered for exploits.

So what do you use at your house? Watching the lock pick village videos from defcon made me realize that there are no perfect locks.

I use a cheap lock and don't expect it to hold up against any but the most lazy attacks. I don't trust it.

Human social order is built around a desire to feel superior to others. Capitalism "won" because it weaponised that desire -- not the other way around.

Intentional division of capability is what the present economic system is based on, but I agree

digital privacy has never and will never exist... it's a myth created to sell 'secure' products. (which never turn out to be actually secure, and even if they were , are running on insecure devices....)

you are right it's a human problem, and the problem is lack of respect for eachother. won't be fixed by any software patches for sure =]