I think the reference is that Karpeles does everything in PHP, so the "stolen" Windows/Mac executables are clearly not his. (Though I don't know that anyone thought they were.)
Right. A man who writes an SSH server in PHP just because he can, then immediately deploys it in production, is probably not the same man who writes a native app here.
