What we know from the TV footage: the first bomb that triggered went off just over 4 hours after the marathon started (the clock shows 4:09:53 a few seconds after the explosion in this video footage near the finishing line) at 2:57pm local time. The second bomb went off approximately 12-13 seconds later as you can see in this second video which covers the relevant timespan. You can also see that very few windows near the first bomb are broken, which indicates that the blast either wasn't that powerful, or was focused away from the buildings. Those are the facts.
The next level of information are the reports, and let's remember that first reports are always wrong but we're later i the news cycle so these reports should be reasonably solid. Two other devices are reported as having been recovered. There have been 3 deaths so far, about 130 injured, many limb injuries and amputations. This implies that the devices were not that big. In terms of explosive power they were probably a bit smaller than the 7/7 London bombings where the devices were in backpacks and killed an average of 13 people each - the 7/7 bombs all detonated in confined spaces, which amplified their effects. The Boston bombs detonated in relatively open areas, with the ground reflecting some of the blast up and away from people. They may have been hidden in garbage cans, causing increased shrapnel (and hence limb shredding) but restricting the blast effects which hit the respiratory system and heart, causing fatalities. One of the Boston fatalities was reportedly an 8 year old child - their bodies are more vulnerable to trauma, so the 3 fatalities is more like 2 in comparison to the 7/7 average.
The casualty count was also likely lowered by the presence of many medics near the scene, allowing them to intervene in the seconds and minutes after the explosion, stop potentially fatal bleeding and clear obstructed airways. They would have had emergency kits targeting heart attacks, asthma and similar afflictions of exertions, but the airway management apparatus and plentiful oxygen would have been key in fighting off shock (under-oxygenation of the body) which is a classic killer in trauma.
I saw one particularly messy photo at The Atlantic (you can find it if you search for it, no doubt) of a gentleman with his lower leg gone - flesh and muscle stripped off the bone halfway down the shin, and foot missing entirely. That's going to hurt, no doubt, but it's not going to kill you - the guy looked reasonably alert as he was wheeled away. His lot is much better now than ten years ago. We've had ten years of the Sunni militia, Taliban and the Iranian Revolutionary Guards proxying through Shia militia with IEDs; immediate management of explosive trauma, long-term rehabilitation and the sophistication of prosthetic limbs has made great strides in that time.
If there were four bombs, and hence two duds, it's going to be interesting to see how they were triggered and detonated. Were the duds due to trigger failure or to bad detonators? I find it interesting that the two bombs which detonated were 12 seconds apart - were they on timers, or was there a cellphone trigger for each? Was the intent to scare the crowd away from bomb #1 and have them gather near bomb #2? If so, the timing was off - the 12 seconds was barely enough for people to collect their wits and start to move, let alone travel 100-200 yards. It's also interesting to speculate why the bomb wasn't timed for just after the first runners were crossing the finish, when the crowd and media interest would be at the peak. Where were the other two bombs, and when might they have been intended to explode?
For a more informed take on the composition of the explosives, though, I'm waiting for the expertise of The Register's Lewis Page who will no doubt weigh in on the matter with the benefit of his background in bomb disposal.
You'll notice I have not speculated on the identity of the perpetrators of this outrage. I doubt we'll really know anything for at least a few days.