Exploiting a Bug in Google's Glass

FWIW:

1. It wouldn't have taken days, it would have taken roughly the same time no matter when it happened, or whether it was requested privately or publicly.

In most cases, faster. Part of the time delay was that I needed to give the code.google.com oncall folks a heads up in case it caused them a massive amount of traffic (it's generally bad form to cause a DDOS to someone else's service without giving them a heads up), since that was not the original planned release mechanism, and historically, these releases generate a bunch of traffic.

2. The very small number of times (in the 7 years i've been there) these things have been screwed up, even privately, we have almost always given people source within hours, so i'm going to say it was more that I try to correct mistakes as quickly as possible.

The only case it didn't happen that quickly that i'm aware of was when someone in a beta program requested pre-release GPL source, which we, of course, gave them, but it took a day or two to actually pull it together.

When it comes to stuff like open source compliance, what you do when things go wrong matters as much as what you do when things go right.

You should always feel free to ask folks for source, and beat them over the head if they don't reply quickly.

Besides that, the general rule of thumb for the GPL is that if you give binaries outside the company, that's what matters, not whether it was only sold to a few people, labeled a beta, or whatever.

There were a few companies (this is about 13 years ago now) using GCC that tried to use NDA's to separately restrict GPL release of new architecture patches until some "public release date" for that architecture, and the FSF threatened suit. It got worked out, and eventually led to this seemingly random message to the GCC mailing list: http://gcc.gnu.org/ml/gcc/2001-07/msg01342.html

(This is also when the GPL FAQ was updated with the same answer)

Neat.

http://dl.acm.org/citation.cfm?id=1102169

"We present a novel attack taking as input a 10-minute sound recording of a user typing English text using a keyboard, and then recovering up to 96% of typed characters. There is no need for a labeled training recording. Moreover the recognizer bootstrapped this way can even recognize random text such as passwords."

I think this also works on dvorak, but it might be stumped by plover + custom dictionaries. Especially for short typing sessions. Although short sessions might be mitigated by recording from multiple locations... hm.