I knew a guy from Syracuse. His identity, from the view of those who knew him, was that he was the guy from Syracuse.
He was basically, 'it's a feature not a bug'. And 'it's expected that people using this library know about security.' Which I guess doesn't include him because his own example was vulnerable.