You seem to not want to lose either. I'm a software developer myself who specializes in websites. If Microsoft knows a severe exploit, they probably wouldn't go around telling everybody exactly how to exploit it, would they? And we don't know that it works perfectly, just that it works enough to use it.