Or maybe they shouldn't revoke the very accounts researchers are required to use to communicate exploits to MS?