I just wrapped up a post over on the SDL blog with some comments about an article on Google's security work.