[rincebrain]

The assertion was not that there are only a few hundred people, but that the organization responsible for this software employed at most a few hundred people to write it.

(There are other problems with the article's conclusions absent the data they withhold, but I don't agree that this is one of them.)

e: Actually, on further reflection, neither your interpretation of their statement nor mine is a reasonable conclusion, so I now agree with you that this is a flaw in their argument.

[zigzigzag]

But that isn't the approach the article takes - it tries to narrow down the list of possible authors from public data, not identify employees of organisations that may have a few hundred hackers.