Valentine actually dictated it, but it did actually happen. Brian's mail was something along the lines of, "I'm tired of reading about the latest security vulnerability in the NYT, so...". And I think it was six weeks, not a month.

Source: me, who worked there (in VS, not Windows) at the time.

EDIT: oh, yeah, forgot about the Gates mail. References are buried in this link: http://www.microsoft.com/security/sdl/story/#chapter-1

I stand by the B. Valentine version, just can't find a link.

This is the closest reference I could find. http://www.cnet.com/news/gates-security-is-top-priority/

I don't have Microsoft source though.

Man this is a well known and often commented fact, but god damn am I having trouble searching for sources and references on this one. Can anyone help out?