The legalness of the "attack" got murky when the "attacker" put in the order for the eth short. Curious to see if using that information, or dissemination of it to others, constitutes insider trading.
The vulnerability
was open sourced before he did it thus apparently no insider information was used! Even the developers of DAO had a patch but didn't push through with it.
It is so unbelieveable, but I can't make this stuff up.