The author of this paper seems to have a reputation for irresponsible disclosure (just google his name) and was called out on it by, you guessed it, Sophos: http://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-ple...