CIYAM says hardcoding a port <1024 is bad security wise. He is not a Java dev as far as I know. Cfb says it's necessary because it makes testing a lot easier, and it's only for the reference implementation. In the final, non reference client there won't be a hardcoded port.

Thats all there is to the discussion. It has nothing to do with code not written very clean.

Please please do not delegate your ability to gain knowledge to an authority (neither ciaym nor cfb/iotatoken), use your own brain instead.