[tptacek]

A vulnerability isn't "NOBUS" just because it exploits an unpublished zero-day. Dual EC was NOBUS because exploiting it required a curve private key that presumably only NSA had.