Vic Gundotra, Google’s VP of Engineering, posted successive tweets earlier today about the speedy sellout, saying it took 90 days and 50 days in 2009 and 2010, respectively, for the event to sellout.

No doubt that today’s sellout is a reflection of the Google’s growing popularity in the developer community (specifically re: Android), but surely it also doesn’t hurt that Google gave away free phones at I/O for the past two years.

There’s more discussion on Techmeme.

Oh, and I’m live blogging this, and I’ve had no sleep (see Bing above), so who knows where it’s all going. Oh my, Vic just said this is going to take an hour and a half. I only have half a bottle of Diet Coke.

Vic says the product is magical. We’ll be stunned. And the two people who made it worked on Google Maps. We won’t believe this can be done in a browser.

Three Ps — it’s product, platform and protocal.

OK, talking about email as like a thread. Wave starts out not as individual messages going back and forth but a shared object on a server, you leave your replies, go away, next person adds and so on. Kind of like bulletin board. Where oh where will my developer touchstone grunting dude be today? That’s some developer I can watch to see if any of this makes sense to them and they’re awed. I’m looking.

OK, Lars is typing an email. There was a spell checker that made the developers applaud. I don’t know why. Aren’t spell checkers easy?

Now Stephanie (hope I’m spelling that right) is replying to Lars. Steph (can I call you that) says that because this is a hosted conversation, she can insert her answer in the middle of Lars’s original email (yes, Lars’s is correct, shut up). This is cool. She says. Well, I can reply to email and shove stuff where i want, but I know i’ll be stunned soon.

Now applause because they’re like both emailing to each other at the same time, and the character by character as they typed starting showing up. So kind of like IM, but you don’ thave to wait for the “she’s typing she’s typing etc). And this is good because you can speed up the conversation, no need to even wait to see what she was saying fully. You can just start responding without letting her finish. And this is good. Unless you’re impolite. OK OK, I’m sure it’s good. And yes, if you don’t want all to show as you type, there’s a hide thing they’re working on.

Now Jens (think I got that right) is on the Wave. He’s entering into the conversation late, so now he’s using a feature called playback. So now he’s seeing what everyone said in order, and this makes the audience applaud. Because they’ve never seen email sorted by date? Or threaded conversations in Gmail? Oh my I clearly am not a developer.

Have I mentioned the incredible tiredness I feel at the moment? It wa a long night writing. That Bing thing.

OK, now we see a way to send private replies to one person in the conversation but not the others. Because the wave is a tree structure, so you can I guess block branches as you want.

Now he’s dragged pictures onto the web, and we’re applauding again. Well, the developers are. And Steph could see a preview of the images before they even fully loaded. Because so often I’m having to impatiently wait to get the picture? And the dragging is cool, but drag and drop from the desktop to the browser — can’t I do things like that already? Maybe I drag from app to app. Anyway, they applauded. It must be awesome.

Just saw MG from TechCrunch is also live blogging: Google Wave Drips With Ambition.  A New Communication Platform For A New Web. . I’m sure he’s more coherent. But I’ll keep going. I started so I shall finish.

Now we’re talking a blogging site, where we can embed Wave on its pages. And we can put an automated agent called Bloggy. Which built the page using App Engine.

Now here’s Greg, who is demoing the Firefox proxy server not found error page. And now he’s showing how he can respond to that original thread, the tree email, that’s been inserted into the blog. He’s like typing write on the page, and his stuff shows up. And now I’m sorry, I’m totally not thinking this is the most awesome thing in the world. And I’m wondering uh, how will search engines crawl stuff that’s embedded?

I wait patiently for awesomeness.

Now we’re using Orkut, Google’s social network that’s big in Brazil and I think still in Iraq. But you can use your Orkut contacts into Wave. Please please tell me you can have contact in another way other than Orkut. I’m sure you can. Sorry, correction — what’s happening is she’s inserting a Wave into Orkut.

Now it’s Wave on our mobile devices. He’s showing his Wave inbox on the phone, replying to something, and then the reply is showing up on another phone he has. Well, it would if the wireless was working in the room. Isn’t this called IM on the phone?

OK, stressing that there’s only one copy of the Wave out there. Which is confusing because Wave is the product that also produces Waves. So there’s Wave conversation out there, a single one we’ve been working with, that people keep interacting with.

Now what if you’re a product manager and wondering if you need to email something or put onto a wiki for collaboration. Wave lets you do both. Now Lars is editing Stephanie’s message on his screen, and applause, a bit. Now it goes to Stephanie’s inbox all marked up. More applause.

Now where collaboratively creating a document, with sliders that let you see what it looked like at any point, you can do a playback thing. This seems cool, I mean easier than some of the other ways you can do version control. See, version control is a fancy word for tracking changes to software code. I think. Writers, we just say tracking edits.

“This is going to become a very power document production tool,” Lars said. And now we have an official Google blog post. Here. Which is pretty much making me think I don’t need to keep live blogging. We’ll see.

Yeah, I gave up. But the developers love what I could only describe as Lotus Notes 800.0. That’s the best metaphor I’ve got, sorry. You can get more info at the Wave site.

He’s welcoming the audience and saying it’s great to be in front of programmers and saying, “it’s time. it’s time for us to take advantage of the amazing opportunity before us … it has been 20 years trying to build a programming model that’s the right one.”

Internet programming is the right way. Have the network, the programmers to build the right types of opportunities out there.

Expects Android to have a strong year, thousands of apps and lots of hardware partners who are innovating to take phones that do much more.

It’s time, he says, because there’s the power to do things simply, to make them work.

There’s a new model of programming, where you can pick the best code around and mash it together. “We can take the collective intelligence of the internet … and do amazing things.”

My message to you is that this is the beginning of the real win of cloud computing, of applications, of the internet, which is changing the paradigm that we’ve all grown up with so that it just works … regardless of platform or hardware you’re using.

Next up, Vic Gundotra, VP of engineering who oversees all of mobile and many other things.

“Never underestimate the web” he says, and a lesson he learned 15 years ago when working at Microsoft. Argued then was web apps could never rival desktop ones. Keyhole was an example they used — Keyhole (later Google Earth) made software Microsoft thought could never happen as a web app. “A web app, that simply left us stunned,” after Google acquired Keyhole and added sat views to Google maps.

Yes, the web has won. It has become the dominant programming language of our time. HTML 5 standard will be covered in first half of his keynote that allow amazing thing, then in second half, things from Google itself that help.

Web platform is accelerating. New technology, browser releases, development accelerating.

“What we thought was impossible to do in the browser with JavaScript may become possible.”

Gmail was a killer app that exploited AJAX and got people using it more. “Recognize that having the capability in the underlying platform is not enough,” he said — people have to build apps that bring the tech forward

Talking about Canvas app that allows drawing with pixel level control (and I note here that much of this event for developers is going to get way beyond me).

Showing now an internal Google profiling tool that allows monitoring performance of an app to see what’s slowing stuff down. I guess this is awesome because the programmers next to me are groaning in amazement. They seem to want this thing.

Now we’re seeing an app (from someone else, Matt — sorry, didn’t catch his last name) that allows for 3D animation within a browser, 03D. The graphics look pretty cool. These are graphics, he points out, that aren’t running in a game program but instead right within the browser. The programmer next to me is so amazed that he’s either texting or twittering WOW to someone else. I’m going to depend on him as my touchstone for this weird world of programming.

For this to work well, they need common APIs to be supported by all the browsers, so Google is working with Opera, Mozilla someone else (and notably not Microsoft, an ommission that’s generating laugh) to make that happen.

Vic is back.

Canvas is available across all modern open source browsers (chart, and no Microsoft, and laughs in audience). He says he knows they noted he didn’t mention them. Said Microsoft is committed to HTML 5 open standards, said they’ll support it “and we eagerly await that” to more laughs and jokes he’s gotten past that “elephant.”

Now to video. How about a video tag as simple as image? There’s one in HTML 5. My programmer guide goes oh, that he’d want this. Vic rotates the video upside down. Programmer guy groans again.

YouTube up now as example, bouncing over thumbnails to make them play. “Oh my goodness” says programmer guy, and audience applauds. Vic said this is test, not that it will come to YouTube.

Now onto location. Google, Skyhook and others in past year are now giving really good location data, that combined with GPS allows a users location to be well pinpointed with their consent. But how do you get that in the browser? The Geolocation API allows. And now Jay Sullivan, VP of Mozilla to tell us more. Sullivan is no relation to me, if you really care. I mean hundreds of years ago, maybe we shared an ancestor. Or not. Who knows.

Vic is thanking Mozilla, which is nice because you know that Chrome is kind of designed to kill it. But the programmers are applauding the thanks, and I’m probably too cynical. Plus, Microsoft is still the evil empire that won’t be on stage, so it’s all family, right?

Jay says browser competition is heating up and so important to improve the user experience, make things faster, protect private. With no competition, things stagnate. Firefox has helped lead the modern browsers “and we’re glad these other folks are producing browsers.”

Notes each organization has its own reasons and mission to do browser. Three commonalities to all:

1) Web is the platform for the future

2) Developers need to keep having new capabilities

3) Need to not fragmenting the web (IE worrying about cross-browser incompatibilities). Strongly believes a good API that’s in 5 browsers is better than a perfect API that’s in one.

Says Firefox 3.5 is much better. Supports Canvas, video tag, geolocation. Wants video out of plugin hell. I think he said hell. You get the point.

Google Maps soon to get a “My Location” tab which he demonstrates, then laughs as it says “can’t be determined.” OK, now it’s done this. And I’m scratching my head thinking um, doesn’t Windows Microsoft Live Search Kumo But soon to be Bing already do this? Because I’m pretty sure it does and has been for over a year.

Well, maybe it will come to Firefox and work better than Google Latitude does when I try to get it to autodetect my location like last night and it said you need Gears (formerly Google Gears) and I downloaded it and it failed to do anything and I was annoyed now there’s a run-on sentence.

And that’s it on geolocation. I gather it’ll make things easier for developers to pull in geolocation data into their web apps.

Hey, speaking of Latitude, here it’s being demoed. Latitude on the iPhone! Frigging finally. And in the browser. And this is possible because they can build apps there. This will be there when Apple releases 3.0 for iPhone. But then you also think hmm, hey Google-Apple, since you’re all buddy buddy on the board level, can we just have an app for Latitude. I mean, isn’t it all, there’s an app for that? But demonstrates how even if there isn’t, as with Gmail on the iPhone, Google needn’t depend on the App Store.

Just noticed that Tim O’Reilly has posted a summary of the keynote that hasn’t even ended. So he had an early look. And it’s great, lots of links and annotations. Check it out! And side note, while down at D, it’s all about the thin client Web 3.0 vision (and Google having nil presence at that show), Google’s doing I/O theme all about it’s not thin client mobile but HTML 5 / IE it’s all about the web browser, baby. Call it Web 2.0 on steroids, maybe. Hmm, makes you wonder if there was some conflict.

Now Vic’s showing how web apps can work for keeping track of stuff when you’re offline, including an HTML web app that runs on Android that allows offline email composing.

Now someone is demoing an accelerometer in a web app, which I think sounds cool like if I were going to throw my laptop. But developer guy seems not impressed.

Vic is back with slide “I wil not host the browser with JavasScript” written over and over Bart Simpson-style on a blackboard, making people laugh and me think hmm maybe I should have learned programming. In BASIC, I can make my name appear on a screen over and over. Or a girl’s name, which was handy in 5th grade when we loaded programs on tape.

Anyway, there’s a Web Workers thing in HTML 5 which lets things run in the background and not hurt each other if they don’t play nice. He’s showing a video of someone walking, JavaScript is then mapping her movement by detecting her motion in the video. Little boxes hover over where she walks. (programmer guy, whoa, whoa). These things happen at the same time.

And that’s it about HTML 5. And I’m wishing Google would have developed that power through the air things, but I still have half my remaining batter. Time for how Google can help. Brain implant time. Help, they’re coming for us…..

Just joking. Talking Google App Engine, which someone new is saying let programmers “leave the servers to us.” With App Engine, no need to worry about configuration, usage spikes, rescaling your app if it gets popular. See, Twitter should have been built on App Engine.

Says White House used Google Moderator, which uses App Engine, which handled the load just fine. As long as Google doesn’t mark the web as malware or send traffic through Asia. But c’mon, those only happened for an hour or so. Be nice!

Now Java language support. Developers have dived in to get Java framework going with App Engine but also a lot of acroynms that sound like bark bark bark Java bark bark PHP to me. And next step on App Engine….

Opening sign-ups on App Engine to create a Java app right now. Applause, developers seem happy.

MG Siegler over at TechCrunch is also live blogging, by the way, complete with bulletpoints. While something completely uncomprehensible is now happening on stage, I’m taking a moment to link over to him. And:

• I could
• do bulletpoints
• if I wanted

OK, so the guy has made an app in Java, tested in the browser, and is now uploading it to app engine. I’m pondering handing my laptop to programmer guy but it’s so hot that’s burning my lap because Apple despite complaints for years can’t see to vent heat from their laptops. But that’s OK, because HTML 5 is coming.

OK, his app is on the web, the one he did in Java, with no server configuration, and there’s applause. I think the programming folks like the stuff.

Two features coming in Google Web Toolkit. Despite HTML 5 “sanity,” still will need to do cross-browser stuff. So GWT allows for browser-proof apps. And in next version, you can debug in the browser — any browser (even those from the evil empire. No, the other evil empire).

Now talking about runAsync  for GWT 2.0. Allows some code to download in background after user is busy doing something else in the program. Helps apps load more quickly. Decreases the initial download size for apps by 7X. Takeaway to me: push a small app out that won’t scare people with its size, then it grows up as it gets used.

Vic’s back, Google Product APIs is up. Announced they’ve crossed the 4 billion API threshold, coming in every day for Google. Thanks for support and says now everyone has to pay 1 cent per call. Heh — no, just joking.

But says they asked if they could make any Google app embeddable like AdSense. So now we’ve got DeWitt Clinton up (hey DeWitt). Google Web Elements is new product. Copy and past website content. Hey — didn’t Yahoo just do this last year? I’ll have to look later.

He’s showing news elements, how he pulls news content over to past into the page. Now he’d getting a map and pasting it (can’t I do this already within Google maps?). And now he’s pasting Google Custom Search with a code snippet.

Now he’s making it social, with Google Conversation Element, post comments, video. Not sure what that uses — do you have to have a Google Account/Profile to comment?

Is it just me, or do all the iframes this uses make me nervous. I’m sure it’s just me. I’m sure iframes are all safe.

Android time! Vic says 10 caried in 12 countries and 4,9000 apps in markete; 40+ app downloads per users.

Romain Guy, software engineer, now up to show sneak peek. Click on home screen, type, finds the right app or brings up web results. But thought search UI could work as a brand new launcher — if you click a search results, system remembers this, and more you use Android, you get prepopulated results / apps.

Now the device is being shown translating text from one language to another. All in the right accents, he says. Of course, Google Voice Search still doesn’t support British English, so we’ll see.

Oh, this is neat. Want to filter your contacts or find a song. Draw a letter on the screen with your finger, and it filters that way.

Vic is back! It’s summary time, which is good as my battery is low. And programmer guy has just jumped up and left, leaving me without a grunting guide.

Three more things:

1) Android Developer Challenge 2 is coming, http://code.google.com/android/adc

2) Everyone at the conference is getting an Android phone to help them develop. Marketshare just increases by 4,000.

3) With SIM with unlimited 3G data and thousands of hours of voice data for 30 days.

He says tomorrow’s keynote will have lots of stuff that’s not been announced and that he thinks is amazing.

And we’re done. Thanks for tuning in.

For related stories, see Techmeme. Google also has some links and resources here plus a blog post. And as mentioned above, see coverage also from TechCrunch and O’Reilly Radar.

Postscript From Danny: Finding security exploits via Google or other search engines is pretty old news, going back for years. Below, a recap of some of these issues plus how you need to watch what your systems are spitting out for Google and other search engines.

In July, we had news of the Malware Search tool tapping into Google results to make this easier for those wanting to protect their sites.

Another story in July talked of using regular Google to seek out exploits.

Back in January 2005, McAfee released a tool to tap into Google to do the same thing.

Here’s New Scientist with an article on using Google to find exploits back in August 2003. From the lead:

Computer hackers have adopted a startling strategy in their attempts to break into websites. By using the popular search engine Google, they do not have to visit a site to plan an attack. Instead, they can get all the information they need from Google’s cached versions of web pages, say experts in the US.

And another from Wired in March 2003, same topic:

“Google, properly leveraged, has more intrusion potential than any hacking tool,” said hacker Adrian Lamo, who recently sounded the alarm.

Google Code Search scans through just computer code, which potentially makes finding exploits easier. The concerns over this were aired back after it launched in October. See articles such as:

• Google Code Search peers into programs’ flaws from SecurityFocus
• Google Code Search for Security Vulnerabilities from Chris Shiflett (and discusses some of the exact things at ShoeMoney’s article)
• Google Code Search gives security experts a sinking feeling from SearchSecurity.com
• Using Google Code Search to Find Security Bugs from O’Reilly.

I think ShoeMoney’s post is mainly interesting in that he made use of the Google Sitemaps program and was spitting out a file listing everything on his web server. Everything. He writes:

Now while this was interesting it still did not explain how the page was even indexed…. ohh wait I use Google Sitemaps and I had it on to index everything (the default setting) OUPS!!

Now to be honest… this is my fault. I in no way blame Google what so ever. I had old exploitable code on my server and I told sitemaps to index it so… my fault.

I have since been working with the sitemaps team and I had some suggestions to leave some files off by default (like .inc .func) or only allow common web files with extensions like .php .html .asp etc… I hope they do this cause as sitemaps gets more popular its only going to expose more idiot webmasters like me that run with the default settings.

To be clear, sitemaps has no “default” setting to index everything. By default, Google itself will spider any URL it comes across. But the “default” ShoeMoney is talking about almost certainly relates to a third-party sitemaps program to generate a sitemaps file for Google.

I’m not sure what blog software he’s using, but he’s probably got a plug-in running and the defaults of THAT PLUG-IN (not Google) was spitting this all out into a sitemaps file that ShoeMoney was telling Google to index.

The idea of automatically blocking some files from sitemaps is interesting but doesn’t make a lot of sense. Some people don’t use “common extensions” at all and are going to be annoyed to discover that Google is “ignoring” what they told it to index. The idea behind a site owner purposely putting out a sitemaps file is that they are explicitly saying, “index this stuff.” Don’t want it indexed? Don’t put it out on the web.

The real culprit is whatever program is generating links to some of these files, as well as security needing to be tightened over all. ShoeMoney’s pretty with it in not blaming Google. And one expert in that SearchSecurity.com article saw positives in Google Code Search:

Still, the new search engine has plenty of potential as a legitimate tool for developers and could end up being a net positive in terms of security, Caceres said.

“People shouldn’t be so quick to label this a security disaster,” he said. “Security-wise, in the long term I think it could be a good thing because developers will realize that what they do has implications and will be seen. So maybe they’ll be a little more careful.”