I understand your point, but I think tone and context matters - they're owning up to the fact that like, "Look, we screwed up, we didn't do a good job here, and hey, we realized that we don't have the resources to do a good job at the moment, so we want to fix that".
It would be different/inappropriate coming from a purely commercial service, but a site that uses a lot of volunteeer/community effort should be able to acknowledge mistakes while asking for help.
http://php.net/manual/en/function.password-hash.php:
PASSWORD_BCRYPT - Use the CRYPT_BLOWFISH algorithm to create the hash. This will produce a standard crypt() compatible hash using the "$2y$" identifier. The result will always be a 60 character string, or FALSE on failure.
I think that if OSNews were a company selling products you would be correct. However, the "product" at OSNews kinda IS the community.
Not sure if the OSNews folks are reading this, but I'd definitely not consider either Blowfish or DES to be secure password storage methods. Surely there's some library that'll do bcrypt/scrypt/etc in PHP?
Also, it seems pretty bold to push users with a call-to-action around volunteering / sponsoring in the same post as they alert users to a breach.