Hmm... what about the damage done to all the folks between when this was first released and now? Or what about the damage done to folks who don't know that their particular ransomware infection is based on this?

Oh... and now that he's published what the exploits are he's provided a simple path to correcting them (use a better random number generator, don't use a static salt, don't send the data over http, don't use the same IV).

And he's provided a tool for breaking Hidden Tear... that's great except it's a visual studio solution. Not like my grandma can easily sort through that and figure out how to run it. No harm no foul?

All in all it seems like a lot of bullshit.