[oasisbob]

The authors didn't cite Netscape because the 40-bit key is too short, they cited it because the the PNRG in the SSL implementation was faulty.

They link to this page with more details: http://www.cs.berkeley.edu/~daw/papers/ddj-netscape.html