Reporting them would trigger normal processes, Microsoft would have time to work on patches during which time bad guys wouldn't be writing WannaCry. Normally f

Reporting them would trigger normal processes, Microsoft would have time to work on patches during which time bad guys wouldn't be writing WannaCry. Normally full disclosure happens after about 45 days (I'm not an expert, I don't know exactly) but in special cases the time is extended. This would probably be considered as a special case as Microsoft exceptionally released updates to unsupported, old versions of Windows and the hole itself was critical. Please note that WannaCry hit in mid May - not that long time ago. Shadow Brokers Group public disclosure of stolen tools from NSA happened in April.