Microsoft's MSRC and the rogue zero-day researcher "Nightmare Eclipse"
- https://www.youtube.com/watch?v=9kxx5xp5nTQ
- Original title: "We will ruin your life" -Microsoft
Prime covers "Nightmare Eclipse," a lone security researcher who has dropped six devastating Windows zero-days in six weeks (Blue Hammer, Red Sun, Undefend, Yellow Key, Green Plasma, Mini Plasma — several unpatched), getting banned from GitHub and GitLab in the process. It looks like pure malicious chaos until you learn the backstory: this appears to be a former Microsoft insider retaliating after the Microsoft Security Response Center (MSRC) allegedly told them "we will ruin your life" — and did. The video builds sympathy by documenting MSRC's long pattern of stiffing researchers.
The pattern: MSRC silently fixes, denies credit, withholds bounties
Multiple disclosed cases: a decade-old context-menu command injection that MSRC declined to reward or assign a CVE, then quietly fixed a month later in Windows 11 Canary. A Defender Guard bypass where MSRC agreed to a CVE, asked for a 90-day extension, then "changed their minds," patched it anyway, and issued no CVE — stringing the researcher along to keep them quiet. A legacy-OTP password-spray/smart-lockout bypass: 5 months later "doesn't meet the bar," silently fixed and closed. The recurring theme is taking researchers' work without credit or payment.
Bigger picture and Microsoft's response
This is years deep: a 2023 letter from Senator Ron Wyden asked CISA/DOJ/FTC to hold Microsoft accountable for negligent security practices enabling Chinese espionage; per Google Project Zero, Microsoft products account for ~42.5% of all zero-days discovered since 2014. Microsoft's official response leans on "coordinated vulnerability disclosure" and threatens that its Digital Crimes Unit will bring cases against actors who don't responsibly disclose — i.e., criminalizing non-disclosure while (per the stories Prime cites) disincentivizing researchers by not crediting or paying them. Prime frames making the video as his own "responsible disclosure" of how badly MSRC treats researchers.