1. The bug itself was an error that any very amateur cryptographer could make (that would include me) if they were foolish enough to try to implement this without any sort of help or review from a competent cryptographer or mathematician (that would not include me). That still foolish, but perhaps understandable given limited resources and a mandate to implement the promised features anyway.
https://i.imgur.com/fRbLD4G.pngThe known log is not the reason for the SDC lack of anonymity (rather it's plain old commutative property of multiplication), but this paragraph describes a good rule of thumb.
