The 35 number was invalidated awhile ago anyways once the amended charges were filed (when the maximum sentence would theoretically be 50 years). So if you see 35 without qualification then they don't know what they're talking about.

The judge could assign more than 2 years (if convicted on all or most charges) so I'd be careful against suggesting that was the likely sentence. Given that the prosecution had mentioned pushing for 6-7 years I'd use that as the worst-case upper bound with 1-4 being the most probable band. However, both previous cases involving CFAA and the particulars of Aaron in particular (who had no malicious intent toward MIT) seem to argue against prison sentences as long as 4 years being a possibility in this case, but that's just my opinion.