I don't see why it is important to measure who is biggest threat? I we have to measure, I say MSFT is worse, but that is not so relevant IMHO. You are assuming that Oracle will get a free pass if people don't leave Microsoft alone. Not so. Both can be watched. (And Apple too). Both Oracle and MSFT are threats, they are both bunch of litigious bastards and none of them use patents only defensively. I don't think MSFT would go through the trouble of crating consortium and blowing up $450m only to sit on Novell's patents. Microsoft just crated a patent trolling consortium, it is that obvious. They are creating patent trolls, and their existence now only depends on how much they can squelch free software. See what ex Microsofties are doing when they leave mother ship. They do patent trolling, against Microsoft competitors. Paul Allen and Nathan Myrhwold are biggest examples, but there are more.
You seem to imply that Microsoft is using patents defensively only. I don't think that patent extortion is acceptable or "defensive only". Whey you threaten someone, that is offensive. And I think it is more dangerous to have company go around and suing/extorting GNU/Linux users and OEMs (like Microsoft does regularly), than to sue someone directly and blatantly (like Oracle did). Microsoft should either openly sue and show patents in question, or shut up.
>That being said, Patent Trolls are a _major_ threat because there is no "defensive patent" contingency that can be used against them.
That is why Microsoft is creating shell companies and breading patent trolls. They don't have guts to sue for themselves, so they are using proxies.