This is why you treat security researchers with respect and follow through on your bug bounty program. Otherwise you end up with disgruntled people like this who know how to fuck your shit up, and you’ll be scrambling to patch it. Will M$ learn from this? My money is on no, but no harm is hoping a little that they do. Secure systems are better for everyone (assuming no draconian bullshit like what Google is trying to do with Android).