As long as software exists, by definition, zero-days will exist. A zero-day is simply a bug in its most nascent state; one person has found it, and nobody else knows about it. Whether the finder is a &quot;security researcher,&quot; a &quot;blackhat,&quot; or a &quot;nation-state&quot; has no impact on whether the bug exists or not. In fact, the bug exists even if nobody finds it! The distinction of who found it, and what they do with it, is purely political. Anyone can still exploit the bug.<p>Sure, maybe the &quot;friendlier&quot; bug finders will responsibly disclose any bugs they find. But there will <i>never</i> be a way to guarantee that all bugs found will be responsibly disclosed. Even if we convince the FBI&#x2F;NSA to &quot;responsibly disclose&quot; every bug they find (will never happen), what about every other country? The hundreds of security firms? The thousands of independent hackers and &quot;researchers?&quot;<p>Zero-days will ALWAYS exist. Software will ALWAYS be exploitable. Worrying about how people react when they find those exploits is the similar to arguing about gun control. Sure, maybe we can convince <i>some</i> actors to responsibly disclose, but the bad actors will always keep the exploits for themselves and use them &quot;irresponsibly.&quot; And there will always be bad actors.<p>So instead of fretting about what happens when someone finds a bug, why don&#x27;t we prepare for the eventuality that all bugs will be found and exploited, often times without anyone&#x27;s knowledge? Why don&#x27;t we build security systems to be <i>tolerant</i> of exploits, instead of resistant to them? There is no security panacea, just as there is no reliability panacea.<p>We build distributed systems with the assumption that nodes will fail, and we call that &quot;fault tolerance.&quot; We don&#x27;t say a system is broken because a node fails. We say it&#x27;s broken if it cannot handle a node failing.<p>Why can&#x27;t we do the same for our security systems? Exploits are as inevitable as any type of system failure. We need to design for <i>exploit tolerance</i> with the same enthusiasm we design for <i>fault tolerance.</i>