[tptacek]

That's true, but the bigger problem with the document is that ESR's role in "hacking" is largely "making things to assign CVEs to".