Is it in fact illegal to sell a zero day exploit of an open source application or library to whoever I want?
replyDepends. Within the US, there are data export laws that could make the "whoever" part illegal. There are also conspiracy to commit a crime laws that could imply liability. There are also laws that could make performing/demonstrating certain exploits illegal, even if divulging it isn't. That could result in some legal gray area. IANAL but have worked in this domain. Obviously different jurisdictions may handle such issues differently from one another.
replyThanks, great answer. I was just thinking from a simple market value POV.
replyWhat about $500K selling it to governments?
replyIssue 1: Governments which your own gov't likes, or ones which it doesn't? The latter has downsides similar to a black market sale.
replyIssue 2: Selling to governments generally means selling to a Creepy-Spooky Agency. Sadly, creeps & spooks can "get ideas" about their $500k also buying them rights to your future work.