IMO the best situation _for customers_ would be for researchers to sell their discoveries in an open market, one in which MS is free to pay "market price" (they

IMO the best situation _for customers_ would be for researchers to sell their discoveries in an open market, one in which MS is free to pay "market price" (they certainly have the funds). In the short-term, MS buying these discoveries would allow them to close vulnerabilities, ensure researchers are compensated appropriately, and establish a clear financial cost to poor security. The long-term effects would be increased security research, shorter windows of vulnerability, and more secure software.