Someone always tries to make this comment when a security vulnerability comes up, and it&#x27;s just as silly every time. If Microsoft asked him to investigate this, then paid him nothing then sure, you can call it &quot;free work&quot;. But really, it&#x27;s just that the author was interested in this one particular thing and decided to investigate it as a hobby and sent his findings in. The company shouldn&#x27;t be expected to pay for it, or even care about it because they never requested it, and calling it &quot;free work&quot; or trying to imply that a company is in the wrong for not paying him because they&#x27;re a &quot;multi billion dollar company&quot; is asinine.