I wish the U.S. government was actually one of the customers. It would then be reported to the National Vulnerability Database http://nvd.nist.gov/ and reported back to the firms that make the software. After all, security vulnerabilities hurt trust in the overall economy and makes the nation weaker. Not something any government really wants to do.

Nor are banks VUPEN customers. U.S. regulations require banks to share known security vulnerabilities with other banks and with the company that produced the software. That would hurt VUPEN’s bottom line.

I doubt that VUPEN is selling these exploits to either governments or banks.

Obviously, the assorted spooks inhabiting NATO enjoy having exploits with which to access various computer systems.

However, it is widely asserted that hacks against the US and other NATO-bloc nations are a serious security issue(and, as a nation with major financial, industrial, and scientific endeavors online compared to most other countries capable of fielding hackers, this isn’t exactly implausible).

Further, the routes for legal access to most domestic systems are already quite wide(CALEA, warrants, national security letters) and extralegal access probably wider still, and you don’t need an exploit if you have a warrant and a gun.

Given these things, why are such entities tolerated? Sure, in the CIA’s ideal world, they’d have access to absolutely everything; but this isn’t their ideal world: they know that outfits like China have fairly sophisticated hackers, and even petty racketeers have script kiddies and basic virus kits. Surely it would be in their interest to promote computer security, no?

An insecure system can be broken with an exploit, and all sorts of people have exploits. A secure system can be broken with a warrant or a gun and rather fewer people have those. It seems like even the most nakedly self-interested intelligence entities would prefer the latter case, given their access to warrants and guns…

In my dream, the CDC has a branch that handles the epidemiology of computer infection. The CDC collates infection rates and  publishes meaningful metrics that allow us to judge the relative effectiveness of various programs of IT Security measures.

A couple years ago, I doodled the outlines of those metrics at: https://it.wiki.usu.edu/SecurityPerformanceMetric

In my dream, governments and ISPs have coordinated to isolate and reform any ISP that tolerates the insertion of spoofed source packets. Prolonged DoS attacks are a faint, distasteful memory.

I dream that the US government refuses to do business with any organization that interferes with effective and timely disclosure of security vulnerabilities. Once the NSA started regularly disclose all it’s known IT vulnerabilities the world vulnerability market-place collapsed.

And a pony. In my dreams I’m riding a blue, hypo-allergenic pony.

Of course if you’re a terrorist and want to avoid all these vulns, all you probably have to do is run a web browser like Lynx.