I listened to a discussion with Perlroth on a podcast where she said things that implied strongly that exploits, in general, writ large, were leaked NSA tradecraft. I don't have even 1/5th the skin in this game Halvar does, and I found it offensive enough to yell out loud in my car, just at the implication.

In reality I think it's kind of an embarrassment how much CNE technology goes the other way, from industry and research to the IC. Not for moral reasons (though: I would have ethical problems selling bugs to attackers of any sort and am thankful I don't produce the kinds of bugs that have this market) so much as "it's not that hard to do this work and we should be getting more for our tax dollars".