content: Just notifying Microsoft of the issue accomplishes nothing. Microsoft could respond with "lol NSA wants this vuln, no patches for this ever". By publicly releasing it he forces the matter and it must be acknowledged and addressed.