This is why you treat security researchers with respect and follow through on your bug bounty program. Otherwise you end up with disgruntled people like this who know how to fuck your shit up, and you'll be scrambling to patch it. Will M$ learn from this? My money is on no, but no harm is hoping a little that they do. Secure systems are better for everyone (assuming no draconian bullshit like what Google is trying to do with Android).

lol

GIGO

Mistreating your bug bounty participants and then threatening legal action for 0days is a great way to get vulnerabilities in your software to be sold on the darknet.

Funny thing is this person doesn't sell the exploits. They just release them. Which is totally legal btw, Microsoft threatening legal action is just an attempt to intimidate. I'm not even sure selling the exploit constitutes anything illegal as long as you tax those sales proper, as long as you're not the one using it to gain unauthorized access to a system