irundebian

How do you know? There were offers on HackForums which did not relate to software components such as smartphones operating systems or webservers but to web sites. Why wouldn't that be possible for Google's developers docs site?

How do you know? You could explain the impact of the vulnerability and let buyers on the black market decide and bid whether they could do something useful with it.

Security is not always a cat and mouse game.

Yes, you can take the day off, but your pay will be reduced by 20%. Just because technology and productivity are advancing doesn’t mean you can work less and still get the same pay. By that logic, hardly anyone would need to work today, as productivity has increased many times over compared to previous centuries. If one company works less, then other companies that work more have an advantage. That’s why it doesn’t work.

Danke Merkel

Some domains work, some not. I assume that working domains are cached.

That doesn't mean anything.

Do you have evidence for that?

I doubt that most critical systems are air gapped. Even if there are, most part of Russians economy is not, but is still using IT based on COTS systems. Why wouldn't the Ukraine DoS or compromise the whole non air-gapped IT infrastructure of Russia to hit the economy if they could have easy access to RCE just because they are a government?

No, he didn't. Learn to discuss properly. OP stated that any government could get RCE for any OS. And that is highly unlikely, since budget above market rates does not imply that you can easily get RCEs. The market rates are high because there is scarcity of such vulnerabilites.

Governments using COTS operating systems does not imply that these systems are unackable. If the statement of OP would be true, we would just see constant exploitation of RCE zero days, or at the least the impact of that. But that is not the case.

Just because the market would buy something for X$, doesn't mean that you could buy that if you have more than X$.

The provided binaries may still contain malicious code but it guarantees that no malicious code has been inserted in between the build process of the published code. So if your binaries contain malicious code, you can be sure that all other users of the software version are affected, too.

It can be hard to write macros with state in typst.

In Ada you can pay for integer overflow checks (runtime) if you want to. With Ada SPARK you can prove that your code does not contain integer overflows so that you don't need runtime checks.

These should be very few cases in contrast to the number of people traveling into the US.