I feel about Cryptocat the way you would probably feel about someone who set up an inner-city neurosurgery clinic after reading a bunch of Usenet HOWTO posts.<p>I think there are two separable arguments here. We may disagree on both of them. But:<p>* The first argument is whether it&#x27;s OK for <i>researchers</i> to stockpile vulnerabilities --- to learn things about software and then not share them. This might seem like an artificial distinction, but there are <i>lots</i> of good researchers who back-pocket great, important vulnerabilities. They don&#x27;t exploit them, they don&#x27;t sell them, they just find them, make some notes, and move on.<p>* The second argument is whether it&#x27;s ok for anyone to <i>weaponize</i> vulnerabilities. If you believe that the USG has an obligation to disclose vulnerabilities, you&#x27;re almost (but not quite) required to believe they can&#x27;t do exploit development work --- for any reason. Disclosing vulnerabilities to vendors kills exploits.<p>I&#x27;m OK with researchers stockpiling. I&#x27;m OK with the USG weaponizing. I&#x27;m OK with the latter in the same sense as I&#x27;m OK with them carrying firearms or breaking down doors to serve warrants or freezing bank accounts. Obviously, I&#x27;m not OK when the USG abuses those powers.