The paper documents their approach pretty thoroughly, and honestly, if it were me (and I'm a damn-the-torpedos-full-disclosure-open-access-everything kind of guy), I'd think twice about publishing a program that would give the kiddies something to do on a wet, wet, wet, day.
Well, the authors stated that they will publish the bugs.
Further, publishing a program like this has the potential of finally having software that is not easily exploitable (eg. by requiring every Debian software to pass that program).
Now that it is closed source, only a selected set of people will be able to benefit from it.
