Nah, that's more false than it is true. I've seen Microsoft sit on cases simply because they can. I'm sure that they were not resource-bound in this case, they

Nah, that's more false than it is true. I've seen Microsoft sit on cases simply because they can. I'm sure that they were not resource-bound in this case, they simply didn't make it a top priority. Their self-imposed timeline is 180 days by default. Unless it comes from Google of course, because they know Google take the 90 day deadline seriously (or 7 days for active attacks such as this). That alone speaks volumes, and pretty much validates the necessity of Google's forced disclosure policy.