Microsoft on security holes