Hi Crispin,

I agree with almost everything you say until here:
"I continue to dismiss the requirement that an 0day be found
maliciously exploiting machines, because that requires inferring
intent."

IMO, everybody in this thread is taking this from an
inside-to-outside approach, whereas a '0day' i...

[ more ]