Autopilot Full Self-Driving Demonstration [video] - <AUTHOR> https://www.tesla.com/en_GB/videos/autopilot-self-driving-hardware-neighborhood-short <comment><USER2> A longer Tesla demo video with no cuts: [1] This one is at a consistent speed, about 3x normal, and it's worth playing at 1/3 speed to see what's happening. No freeway driving; it's driving around the Page Mill Road / Los Altos Hills area. This video shows an ahead view and three of the vehicle's cameras with their annotations. The system puts rectangular 2D boxes around things it recognizes.

Road centerline recognition seems good. Every road seems to have really clear centerline markings, though. Road edge recognition isn't always successful. Roadside obstacle recognition seems very dependent on recognizing cars and people. The system doesn't recognize a large trash can in the roadway until very close. Recognition of roadside traffic cones and barriers seems to be about 50%. Guard rails aren't recognized at all.

This has the look of something using deep neural networks trained on common obstacles. It doesn't look like something that profiles terrain.

[1] [https://vimeo.com/192261894](https://vimeo.com/192261894)

<comment><USER3> Is there an easy way to play a Vimeo video at 1/3 speed?

<comment><USER4> Press F12 go to the console and type `document.querySelector('video').playbackRate=0.33;`

</comment></comment></comment><comment><USER5> There seem to be some issues. E.g. it recognizes the joggers (0:55) as obstacles even though they're obviously (to a human) on the sidewalk. And when taking a right turn (1:01) it mistakes a hydrant and a parked car in a parking bay on the other side for an obstacle and stops for a moment before noticing that they're not actually in its lane.

I think a polite driver may have slowed down gradually to not startle the joggers, but not stopped if it were avoidable, especially since there was a car behind the tesla.

In the latter case i guess the field of view of the cameras is not wide enough to assess those things during a turn in advance?

<comment><USER6> Does this new Telsa autopilot use stereo cameras? Would stereo camera help to have a better 3D vision? Or is a video stream enough to get the 3D data.

From the video it looks like lane detection and 2D object recognition.

It might use a structure-from-motion (SfM) running on CUDA to get a 3D point cloud out of the 8 cams. Does someone know more about how their new auto pilot works?

<comment><USER7> They do not. They have 3 forward cameras (1), but they all point directly forward and are for separate use cases. I've always thought it would make more sense to have two cameras at either side of the windshield rather than one in the middle. The downsides are you need a new method to clear water and debris since the wipers won't hit that area, and there might be limited FOV.

Stereo might require some level of calibration to account for camera alignment, maybe they want to avoid that? I would think that implementing stereo would be fairly cheap both computationally and in hardware- if they can get by this well without it, they could pare the stereo computations down to a few frames per second, on specific objects in the scene. Maybe a future update will add binocular cameras in the dash, but they are pretty confident about their current hardware.

1: [https://www.tesla.com/en_EU/autopilot](https://www.tesla.com/en_EU/autopilot)

</comment></comment></comment><comment><USER8> Very cool demonstration (despite curious choice of music!).

I did notice that the lane markings are suspiciously bright and well-painted throughout the video. Almost as if they'd been touched up by Tesla! Or maybe this area just has particularly diligent road-painting crews.

In many parts of the real world you'd be lucky to get such clear lane markings throughout the journey, certainly not here in the UK or in places that get winter ice & snow.

<comment><USER9> In my autopilot gen 1 Tesla, when the software was first released, lane markings had to be really clear, but as the software has matured, it now does less than perfect lane marking in pretty heavy rain without issue.

<comment><USER10> What does it do on roads without any lane-markings? My country has lot's of them outside the cities.

<comment><USER11> It does two things.

 _Holistic path planning_ uses the entire scene to identify the lane, not just the lane markings.[1] This is exactly how a human drives on a rural road.

Once enough fleet learning data is gathered, _high resolution maps_ will mark out the road surface to high accuracy (cm).

Of course that's no good unless the car knows where it is within cm! For this Tesla uses sensor fusion with GPS, an onboard IMU (similar to a smartphone), four wheel wheel odometry (via the ABS sensors), steering angle, and torque delivery. Owners report that the Autopilot 1.0 cars know their position in a parking space to within about 10 cm. And it has demonstrated high accuracy and low drift in no-GPS situations[2].

This type of sensor fusion (Kalman filtering) was originally developed for the Apollo spacecraft, and was one of the responsibilities of the famed Apollo Guidance Computer.

[1] [http://wccftech.com/tesla-autopilot-story-in-depth- technolog...](http://wccftech.com/tesla-autopilot-story-in-depth- technology/4/)

[2] [http://motherboard.vice.com/read/how-teslas-model-s- tracks-y...](http://motherboard.vice.com/read/how-teslas-model-s-tracks-your- location-in-a-tunnel-without-gps)

<comment><USER12> I wonder how it works in situations like we have in NZ where the recent earthquakes have moved parts of the country six metres.

</comment></comment></comment></comment></comment><comment><USER13> There's also the longer (3:28) video with the Paint It Black theme: [https://www.tesla.com/videos/autopilot-self-driving- hardware...](https://www.tesla.com/videos/autopilot-self-driving-hardware- neighborhood-long)

<comment><USER14> That's really weird choice, who are picking these songs? :) I can't imagine they've licensed the music either... I guess next up is the "Highway to Hell" video

<comment><USER15> My guess? Elon.

<comment><USER14> Haha, I find the image of him doing that, and no one daring to try change his mind, hilarious for some reason. I can see it escalating:

"So for our next video let's set up smoke machines on the road here, and then we'll have a camera team in front capturing it coming out of the smoke in slow-motion with "Smoke On the Water" as soundtrack. It's going to be amazeballs!"

"Umm, ok Elon..."

"Put in a lion roar as well"

"I quit."

</comment></comment></comment></comment><comment><USER16> Impressive to watch. The Tesla drives quite politely, but not annoyingly so (read that as impeding traffic). It actually stopped for the joggers who wasn't actually in the road, but very close. It also waited for a bicyclist on the right to turn left in front of the car.

Looks pretty promising, not bad, especially since the trend in software (and sensors) is to get better over time.

<comment><USER17> On perfectly marked roads, in fair weather, with no bad behaviour seen from other drivers in the video. Impressive, but the technology has a long way to go yet before it can replace human drivers.

<comment><USER18> I do not understand why the focus on self driving is so much on the whole trip.

90 - 95% of the time I am driving long stretches, I spend on highways. No problem if only that part would be done selfdriving. Those few minutes in busy town centers I do not mind to do myself. No problem of driving short stretches (10 - 15 min) either.

<comment><USER19> Autodriving 90% of the time would be a fantastic feature.

Autodriving 100% of the time is where it gets revolutionary (mass-layoffs of truck drivers, taxi drivers, summon features that park cheaply outside of downtown).

The former is great, but there's a lot of hype going around right now so it's not strange for people to be cynical.

<comment><USER20> Forget parking, the cars would be driving, ferrying people and goods around, as much as possible when not charging. No need to own one, just hail one when you need a ride.

<comment><USER21> That's practical, and for people like you and me who aren't bothered by the idea of not owning our own vehicle, but it's very culturally desirable in the US to own a personal vehicle. Not an unsolvable problem, but it will definitely be a bump in the road.

<comment><USER22> i don't think its an issue. live in the city? dont own a car. just like today. uber is way cheaper than owing a car.

live in the gonnies? own a car. hailing one would take forever. having cars near you in the gonnies,that you dont own wouldn't be economical.

basically, there would be less vehicule owners but not that many less.

<comment><USER20> I do wonder how many people living in cities would still choose to own a car if they could just get a self-driving one on demand.

For example, friends of mine recently bought a summer cottage. It's a little over an hour's drive. They don't have a car, so they currently rent one or try to borrow one when they want to go there. Once there, the car will probably sit still for a week.

Currently, there's no really good solution to this. Renting is expensive if you just need to drive a couple of hours a week. Buying a car might make more economic sense in the long term, but it's still pretty expensive for the purpose. Taxi rides like that cost an arm and a leg too. But if the car could drive itself out of the woods...

Of course it's a question of pricing, and I'm guessing we're still some way off from having self-driving cars navigate dirt paths that pass through people's yards as is the case here.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> I believe Tesla's AP 2.0 is built on NVIDIA's platform (with probably a lot of custom stuff, of course). If you want to learn more about how that kind of system works, that CES 2016 demo is very instructive, especially from 42:50 onwards: [https://www.youtube.com/watch?time_continue=2573&v=KkpxA5rXj...](https://www.youtube.com/watch?time_continue=2573&v=KkpxA5rXjmA)

</comment><comment><USER24> Reading through Tesla blogs and watching this video, my understanding is the self driving hardware is cameras and ultrasonic sensors.

Does the lack of lidar not scare anyone else?

Also, Out of curiosity, does anyone know how a Tesla behaves if you point ultrasonic transducers in the same frequency at it? Do they have special modulation to avoid tampering in this manner? I imagine you could confuse the car into thinking there are barriers it can't see.

<comment><USER25> > Does the lack of lidar not scare anyone else?

I don't think lacking lidar should be inherently scary, humans don't have lidar sensors either and they do well enough. I do hope that cheap solid state lidars do come to market to improve low visibility driving nonetheless.

<comment><USER26> The human eye has an incredible dynamic range (>20 stops). It also have very high resolution at the point of interest. I seriously doubt that Tesla's cameras are anywhere close to the performance of the human eye. LIDAR can also make up for deficiencies in the software. The human CPU is also probably a little more advanced than the one driving this car so anything helps.

</comment></comment></comment><comment> martin-adams I would absolutely love to see how it handles roundabouts in the UK. Some of the ones I use daily are pretty hairy even for a competent driver.

And then there's the magic roundabout in Hemel Hempstead! [https://www.youtube.com/watch?v=ih223jffmek](https://www.youtube.com/watch?v=ih223jffmek)

</comment><comment><USER2> Much better music video of real self-driving: [1] This is what traffic looks like when you totally eliminate human drivers.

[1] [https://www.youtube.com/watch?v=zm_rlLyelQo](https://www.youtube.com/watch?v=zm_rlLyelQo)

<comment><USER27> It's so amazing, I was wondering if it's a computer simulation or for real. Great job! [http://www.ect.nl/en/content/euromax-terminal- rotterdam](http://www.ect.nl/en/content/euromax-terminal-rotterdam)

</comment></comment><comment><USER28> To be completely fair, you can show me almost anything with Benny Hill music in the background and I will enjoy it ;)

Anybody knows if these 3 cameras on the right are the only ones used by the auto pilot?

<comment><USER29> No. The system uses 8 cameras. Three forward facing (narrow, wide, standard), two rear facing sides (the two showed here), one rear, and two side cameras.

<comment><USER28> Thanks. makes sense, and I guess makes easier to implement some kind of depth perception.

</comment></comment></comment><comment> martin-adams I think watching this in real-time would be more informative. At 1:32, it pull out on what looks like could be a busy road, then stops before starting again. It doesn't look so bad sped up in the video, but not great in reality.

<comment><USER30> Here's one someone did, from the teslamotors subreddit. [https://www.youtube.com/watch?v=hLaEV72elj0](https://www.youtube.com/watch?v=hLaEV72elj0)

</comment></comment><comment><USER31> What's the most amazing is that Elon mentioned on twitter that it's only using data gathered in the past month since they announced the hardware/first video.

<comment><USER32> But why wouldn't they use old training data to make it even better ?

<comment><USER33> Could be because there'd be assertions made under the old system, that were later found to be unhelpful or unwise?

<comment><USER34> A simple one, the old system didn't have 8 cameras so you don't have the full training data you need.

</comment></comment></comment></comment><comment><USER35> Fastest speed clocked in at 35mph during the entire trip with an average of 15-25mph for remainder of the time. Does this suffice a realistic use case? Specifically in US?

<comment><USER15> In town, with the level of traffic seen? Yeah, it's keeping to the posted speed limits. Realistically, I'd be doing 5 to 10 over except in explicit residential zones, when there are cops (limit to 5 over), and when traffic doesn't allow it.

</comment></comment><comment><USER36> Couple spots where I think an inattentive driver could have easily rear-ended the car. ~0:55 mark is a prime example.

I understand that whether the driver was paying attention or not, he or she would be at fault, I'm just pointing it out.

</comment><comment><USER37> So it appears it's reading the road signs? I see it stops on the intersection with a stop sign where's no traffic lights. But what if the sign is damaged or removed? The car will go straight without stopping?

<comment><USER38> Maybe it's relying on maps & GPS data.

<comment><USER39> What if the GPS data is outdated?

<comment><USER40> What would _you_ do if you'd remember there _used to be_ a stop sign there, and now it's gone?

<comment><USER41> I'm still having a hard time not stopping at the intersection by my old high school and they removed the stop sign there 3 years ago!

</comment></comment></comment></comment></comment><comment><USER42> I'm disappointed that radar images aren't included in the video. They ought to be very interesting, a whole new perspective on the world around us.

<comment><USER30> What the car sees with radar does not translate directly to an "image" (it's not 2D radar, it's 1D with time of flight for depth).

<comment><USER42> Still it can be visualized.

</comment></comment></comment><comment><USER43> I'm curious about the implications of this technology (which is amazing) on courteous driving habits.

I regularly stop to let people cross the road, I cross the center line when safe to give people and cyclists (if I plan to pass) extra space etc. I suppose, in this Tesla at least, you can just take control, but some other proposed implementations seem to have a less traditional UI.

</comment><comment><USER44> Well it was certainly fun to watch. Aren't there more detection methods than just cameras? This is certainly the best one I have seen from them but I still want to see it at night, in rain, and such, times when people need the most help with driving. This was still too nice of weather to get a good impression of how far its come.

Also, if the driver wants to exceed the speed limit of a road will autopilot allow them? If so, who becomes liable since the system will obviously know the speed.

If the road had not been curved when it came upon the joggers would it have passed without stopping? Is that something that needs work on? I understand its erring on the side of safety.

So next drives, a night run, a rain run, and if they are really ballsy then both at one time. Would be cool to have someone throw something in front of it while its going through the parking lot, beach ball, etc.

<comment><USER45> It seems like the right-bound of the lane (the right red line in the midview camera) was not calculated, so it thinks the joggers were inside a big lane. that'd be my guess as to why they would think the joggers were not "outside" of the lane for the system to breeze by. At 1:23-1:24, there's a person walking their pet and it looks like they were really close, but the camera was able to detect the right boundary.

</comment></comment><comment><USER46> I'm surprised by the number of Stop signs everywhere. Is that normal in US? Also, there are moments in this video where the car was turning left and a driver coming from the opposite direction was turning right - yet Tesla turned first? How?

I really wish they provided a non-sped up video.

<comment><USER47> I agree, the roads are _perfectly_ marked. It's early days but incorrectly hardly complex edge cases, like graffiti on the signs, could be a matter of life or death.

I wonder if the AI just detects an intersection and if it doesn't know what to do, disengage?

<comment><USER48> Why would a missing sign cause life or death? It has radar and complete around-the-car vision. Should do a lot better than a human.

<comment><USER46> I'm almost certain that I can't see around corners though.

</comment></comment></comment></comment><comment><USER49> I'd love to see this in $heavilyPopulatedIndianCity. ahha, found this : [http://www.theunrealtimes.com/2016/09/17/top-secret-uber- tes...](http://www.theunrealtimes.com/2016/09/17/top-secret-uber-tested-its- self-driving-car-in-india-and-these-are-the-results/)

these guys are doing it right (teach your car to drive on the other side of the road) : [http://www.deccanchronicle.com/technology/in-other- news/0103...](http://www.deccanchronicle.com/technology/in-other- news/010316/self-driving-car-indian-techie-builds-autonomous-tata-nano.html)

</comment><comment><USER50> Is a realtime version available?

I notice at 0:24 in the short version (0:41 in longer version [0]) it seems to stop early for a stop sign and then resumes driving to the stop sign. It looks like the vehicle in the oncoming lane may have caused the stop. I only noticed because in the longer version the person in the driver's seat lifts his hands when the stop occurs (not as noticeable in the short version).

[0] [https://www.tesla.com/videos/autopilot-self-driving- hardware...](https://www.tesla.com/videos/autopilot-self-driving-hardware- neighborhood-long)

</comment><comment><USER51> I think the most interesting part of this video is that there's a lot of fog.

</comment><comment><USER52> Is it doing a weird maneuver on 1:32 or is it just me? Something like stopping right after turning. I'm not full aware of the USA transit laws so this might be required but it doesn't seem likely.

</comment><comment><USER53> That's really impressive, but I really want to see it driving through rush hour in a densely populated old Italian city. Let's continue pushing the envelope.

<comment><USER54> I did it. Once. Friday evening in Milan.

Something you wouldn't wish on anyone who is even remotely your friend.

</comment></comment><comment><USER55> I think the choice of music is quite clever, makes it seem jolly and approachable, instead of the connotations of solemn futurism that self-driving usually has.

</comment><comment><USER56> The car seems to have a bad habit of turning its steering wheel at stop signs before making its turn. This isn't really a problem at stop signs, but would definitely be dangerous if turning left on a green while waiting for oncoming traffic.

The only left on green we get to see in the video is at 15s, but it didn't have to wait for any oncoming traffic. Hopefully it knows to treat those situations differently.

</comment><comment><USER57> I would love to see how autopilot works in different cities (e.g Mexico City, Rome, Buenos Aires). I Just found "I tested Tesla Autopilot in Manhattan traffic — and lived to tell about it" [http://mashable.com/2015/11/06/tesla- autopilot-new-york/](http://mashable.com/2015/11/06/tesla-autopilot-new-york/)

</comment><comment><USER58> I wonder how these self-driving systems are going to deal with wildlife or even domestic pets running wild. It's fairly common on my commute to see deer grazing along the roadside just a few feet from the pavement. I typically slow way, way down and creep by as they'll walk right onto the road if the mood strikes them. Getting enough test-cases for the software could be difficult.

</comment><comment><USER59> I really hope Tesla would do a demo on the roads of India. If a car can self drive there I would have no trouble purchasing one. Indian drivers are some of the most resourceful drivers I have seen on my visits there, yes its complete chaos, but how they navigate through all that, while utilizing every bit of the road is, just amazing.

p.s I really enjoyed the choice of music on that video.

</comment><comment><USER60> As I watch all the views from the cameras, and watch how it is making decisions based on that information, I have to ask: who says a machine can't be conscious? Who says it can't have free will? How do you define those terms so that includes people and animals, but doesn't include this vehicle?

</deep philosophical mode>

</comment><comment><USER61> Daimler done that 3 years ago even in high density city traffic. Daimler could even pass vehicles that covered half the lane and didn't need to stop for them. [https://youtu.be/SUOC8tE4bdM](https://youtu.be/SUOC8tE4bdM)

<comment><USER62> And a horse could do it centuries before that, but that's not a fair comparison either.

The car in that video had so much extra custom stuff it's not even funny. And while it's still a technical feat, I don't see every mercedes being sold with that equipment in it already.

The reason this is amazing is because Tesla is planning on switching this on for all of their new cars in the very near future. It might not be the most technically advanced, but it's here.

<comment><USER8> It's just like how Mercedes (and others) have shown some fantastic "Tesla killer" electric vehicle concepts. That's nice, but it's not really something that competes with Tesla until it's available to buy.

While the others make promises, Tesla's making cars.

</comment></comment></comment><comment><USER63> Anyone understand how it's color coding the boxes on the right? Seems like green, blue, and purple all likely stand for different categories of objects.

<comment><USER64> there's a legend at the bottom of the video

</comment></comment><comment><USER65> I wonder if it can detect when it doesn't know what do it. Like when it can't find the edge of the lane.

</comment><comment><USER66> Camera based... so if you drive through mud or it's raining hard does this still work?

<comment><USER67> Do your eyes still work when you drive through the mud or it's raining hard?

<comment><USER66> Do the cameras have windshield wipers? At times if the window gets too dirty or it's raining too hard I need to pull over to clear it, even with my high tech eyes. Will the car go into a fail safe mode? Just stop in the middle of the lane because it thinks the bug-strike on the lens is a person?

</comment></comment></comment><comment><USER68> Ok... I'm officially old now. I've been keen on the idea of self driving up until now. Watching this just makes me want to grab the wheel... too much traffic, too many people on the side of the road... nope I don't think would I be comfortable.

Oh well... I guess I'll have to wait for the mini-van style with blacked out windows :)

</comment><comment><USER69> That's impressive, but still an easy course compared to what I see daily in my (large) city. I'll get mine in February and am curious to see what it'll do in those narrow roads where 2 vehicles going in opposite directions can't pass each other sometimes.

<comment><USER48> Wouldn't the answer be "same as an average human?"

<comment><USER69> I hope not; the average human can't pass an obstacle at 1-2cm distance safely, a machine could.

</comment></comment></comment><comment><USER70> Can someone explain the left turn on 1:41? Seems a bit aggressive.

<comment><USER71> Watch out at regular speed. Ashley consider the acceleration power a Tesla has. It can get into a tight spot quickly without altering traffic.

</comment></comment><comment><USER72> what happens when a few autopilot cars come to different roads on a 4 way stop?

What about driving through a parking lot (lots of cars around).

Seems dang near impossible to deal with all the edge cases.

</comment><comment><USER73> the design possibilities and field day designers will have when steering wheel and forward-facing seats aren't retrictions will be amazing

</comment><comment><USER74> best part at end: you can save time by exiting before the car parks itself.

<comment><USER75> I thought the best part was the car doesn't need to park anywhere near. Large parts of cities will be freed for us to use.

<comment><USER76> Large parts of cities will be turned into roads for driverless cars to ferry themselves to and from the office 2x as many times to save the owner $10 on parking. Traffic will go slowly because driverless cars don't care about speed when no one is inside. And then all the plebs still driving their own cars will be stuffed.

<comment><USER47> This is kind of true, as much as this tech is fascinating, I can't help but feel trains and better planned cities are the real solution to the car problem.

Even in parts of Europe I noticed they put big trucks on trains to automate a large part of the journey and a driver finishes the last leg of the trip.

Trains are also much easier to automate, I also imagine a train track costs less to maintain than a road.

<comment><USER32> Trains are complementary but there will always be need for personal transportation.

<comment><USER47> I never said there wasn't, however; What is obvious is that if taxis and trucks (privately owned or not) are now so cheap to run because there are no labor cost involved in having them on the road, then the next problems we will face are increased congestion, increased pollution (electric cars still consume a lot of power), increased road degradation. The only way to control this might be through increased taxes or car registration fees.

This still means the car problem needs solving.

</comment></comment></comment></comment></comment></comment><comment><USER77> I don't know about other countries, but at least in the Netherlands the Benny Hill song is used mainly in videos to ridicule the subject. I remember when funny 'Home Videos' were a thing on TV (before cats took over on the interweb) this song was used in about 90% of them. So to me, using this song in something as serious as a self driving car demonstration is pretty weird.

<comment><USER78> This song is also often used in a recurring absurd segment in cartoons when some people are running after each other and they go into / come out of random doors in a hallway.

<comment><USER71> Which is an homage to Benny Hill.

</comment></comment></comment><comment><USER79> The Benny Hill theme tune was a pretty unfortunate choice of background music, not sure if that's the impression they wanted to make (maybe it was, not sure).

<comment><USER80> When the last video came out, there were quite a few people saying "wait, that video's sped up, right? It doesn't seem to be taking turns at a safe speed."

I expect Tesla got feedback indicating that some people didn't notice that the last video was sped up, so they decided to make this video a lot more obvious by speeding it up even more and adding the music. I agree, it's not really a good choice, but I can see how they might have come to that decision.

<comment><USER40> Indeed; for me this music has two primary connotations - "funny" and _" sped up"_.

</comment></comment></comment><comment><USER81> Wow so many comments about the Benny Hill music. I for one love that Elon Musk's quirky sense of humour. So many people take themselves far too seriously.

<comment><USER82> Do you think that Elon Musk was the one to put this out (or even design the video)?

I'd have a hard time believing that, to be honest.

<comment><USER83> Elon is known for being closely with involved with his companies' PR. Here he acknowledges the music choice explicitly: [https://twitter.com/elonmusk/status/799908000689336320](https://twitter.com/elonmusk/status/799908000689336320)

</comment></comment></comment><comment><USER84> His fingers, so twitchy.

</comment><comment><USER85> What I've learned from this is how boring demonstration videos of self-driving are, regardless of whether Yakety Sax plays in the background</comment>


Free Trademarks For Startups - <AUTHOR> http://www.erikjheels.com/?p=1097

<comment><USER2> Startups who take advantage of our FreeTrademarksForStartups.com offer are free to leave at any time. We hope to demonstrate to them why many startups have chosen us. We work hard to get our trademark applications right the first time to avoid any problems. Problems can occur no matter who files your trademark. And we've chosen to cap this offer at $1500 (which includes the USPTO filing fee for one class). Twitter me @ErikJHeels if you have questions. Thanks.

</comment><comment><USER2> The filing fees can add up quickly. Intent-to-use applications are touted as quick ways to get your trademarks on file (which they are) but they end up costing more because you have to do multiple filings. Based on a survey we did, companies have - on average - four unregistered trademarks. Registered trademarks can also help against cybersquatted domain names.

</comment><comment><USER3> If you plan to trademark your product or service I would also contact Athol Foden at www.brighternaming.com you don't need an attorney (in this "free offer" any work after the initial filing is at $300/hr) to file a trademark application. There are a number of issues beyond getting the USPTO paperwork completed correctly involved in selecting a name/trademark.

</comment><comment><USER4> For a guy who just spent $600 on filing fees... I'm impressed.</comment>


Best way to connect with developers? - <AUTHOR>

Guys, what would you say is the best way to connect with developers. I am the business type that has the money but not the team of developers to get my start up off the ground. I am looking for developers that would be interested in an equity stake for creating a web and mobile platform business. Looking for any advice,<p>DK <comment><USER3> You meet someone, chat, learn about preferences and passions, and maybe you get along. You begin talking about your project and maybe they love it - <USER2> not, don't bother trying to convince them, quietly move on. Of course, you can always pay someone a fair market rate to provide the same service - sadly, its much harder finding a partner than a working programmer. It's a lot like any other relationship... without demonstrating your talents and abilities, many programmers will chuckle as they click along.

Tell us about your business or at least your skills, something. This sort of post comes by about every day, in some way or another...

</comment><comment><USER4> [http://www.google.com/search?hl=en&q=site:news.ycombinat...](http://www.google.com/search?hl=en&q=site:news.ycombinator.com+find+developers&aq=f&aqi=&aql=&oq=)

[http://www.google.com/search?hl=en&q=site:news.ycombinat...](http://www.google.com/search?hl=en&q=site:news.ycombinator.com+find+hackers&aq=f&aqi=&aql=&oq=)

[http://www.google.com/search?hl=en&q=site:news.ycombinat...](http://www.google.com/search?hl=en&q=site:news.ycombinator.com+find+cofounder&aq=f&aqi=&aql=&oq=)

</comment><comment><USER5> I do consulting work for startups, mostly using rails 3, jquery, backbone.js, and mongoDB. My contact info is in my profile if you want to chat.

</comment><comment><USER6> Connecting with a developer? My best advice would be to check my profile for my email address.

Wow what good advice.

<comment><USER7> the sad part is, nobody can see your email address. try logging out of HN and looking at your own profile.

if you want others to be able to contact you, you have to put that information in your 'about' field.

</comment></comment><comment><USER8> Learn to program.

<comment><USER8> Wow. I'm surprised this got downvoted. There is no better way to network with developers than to learn to program. First you will eventually find your way into the natural habitats of us developers (HN, StackOverflow, IRC). From there you'll end up learning about developer events like hacker dojos and superhappydevhouse

The problem is that if you show up in these hacker habitats as a business person with no programming knowledge, you are just going to derail the conversations instead of participating. You will also connect better with hackers if you speak their lingo.

Which would work better:

"I'm a business person with an idea that I want you to build"

or

"I'm learning to program because I'm a business person with an idea that I'm learning to prototype and I'm looking for someone to build it with me."

I'm a business person myself learning to program and I pretty much dismiss all other almost all other business people that come to me with ideas. Part of being a good business person is about being able to sell your idea and speak in the language of the customer. Until you found a technical co-founder, your only customer is a developer. You need to sell them your idea before you sell it to anyone else. If you want to sell you idea to a developer, then learn to program.</comment></comment>


CA high speed rail proj canceled OR Americans hate public transit - <AUTHOR> https://news.yahoo.com/america-high-speed-train-travel-off-track-061158544.html <comment><USER2> Actual title: "In America, high-speed train travel is off track".</comment>


List of Companies Currently Using Lisp and Scheme - please help me expand it - <AUTHOR> http://www.pchristensen.com/blog/lisp-companies/

<comment><USER2> At YC we use Arc not only for this site but also for a bunch of internal software we use to run YC itself.

<comment><AUTHOR> I figured as much but didn't want to presume :). I'll update that.

</comment></comment><comment><USER3> An easy way to find more would be to go through <http://weitz.de> and look at the page for each library. Most of them have a list of some of the users. Clutu, TwitterBuzz, Jalat, Heike Stephan, xOs, and the NIST all use Hunchentoot. CafeSpot, Cleartrip, PK Bass & Tackle, and the Cork Multitext Project use its predecessor, TBNL.

</comment><comment><AUTHOR> Shooter, Zak, joshwa, vikram, ias, chris_l, gibsonf1, phony_identity, herdrick, and brlewis - I mentioned all of you from comments you made about using Lisp/Scheme in your startups/companies (pg too, of course)

<comment><USER4> Terraminds twitter search (<http://terraminds.com/twitter/>) uses Common Lisp for everything but the (external) indexing engine.

Btw, did you use a search of hacker news to find our usernames?

<comment><AUTHOR> I did a few Google searches like "Lisp company site:news.ycombinator.com" and "scheme startup site:news.ycombinator.com" and then read through a bunch of long, old conversations. While I was doing it, my question of "Why hasn't anyone done this yet?" was answered very clearly!

</comment></comment></comment><comment><USER5> Apple uses Scheme in the new Leopard security scheme.

</comment><comment><USER6> iRobot occasionally posts jobs for Lisp hackers. I believe they use their own DSL built off Common Lisp for their consumer stuff (Roomba, etc.). However, I don't work there, so any iRobot employees out there are welcome to tell me I'm full of it...

<comment><USER7> You're right. The home robots side that makes the roomba's uses a version of lisp. The PackBot side uses C++, tcl, and python.

</comment></comment><comment><AUTHOR> Thanks for the additions, keep them coming! I'm going out of town for the holidays but I'll add these and more in the next week or so.</comment>


Edward Snowden Explains Why You Should Use Passphrases, Not Passwords - <AUTHOR> http://lifehacker.com/edward-snowden-explains-why-you-should-use-passphrases-1696958545

<comment><USER2> Wait now where did I put that xkdc link...</comment>


How do I get people to share their confessions?  - <AUTHOR>

A college friend of mine and I have been working on a website the past 9 months and are trying to gain users now.  It's a website that people can post love confessions on anonymously.  It was a Facebook fad that went through our school awhile back and we added features and such.  Let me know your thoughts please. <comment><USER2> Water boarding, sensory deprivation, drugs, electric shock and such all seem popular and are supported by the very best democratic governments - so that must be OK.

Me - I think privacy needs to be at the forefront of everything we do for a long long time (maybe for ever now). So no confessions and "no comment".</comment>


Ask HN: On marketing & ethics, where is the limit? - <AUTHOR>

Recently I have seen how a 5-year company decided to not continue anymore with the service they were providing. 8 months, this same company had a really agressive campaign to get users from similar tools by offering them big discounts.
After their shutdown notice, karma comes around.5 competitors companies are doing a lot of efforts on paid search to make firewood out of the fallen tree.
I got the impression that the first campaign done to grab users from other companies - while they were still alive  is 'nicer' - or at least more ethic - than the campaign that nowadays are doing its competitors.
Ethic both actions? <comment><USER2> I've tried to live by the mantra, "if you have to ask if something is ethical, you already know it's not, you're just looking for an excuse."</comment>


Ship It Now Is The Best Time Ever To Start An Internet Company - <AUTHOR> http://blog.socialmedian.com/2009/05/ship_it_now_is_the_best_time_e.html

<comment><USER2> "Think small. Think cheap. Think fast."

I'd like to add "Fail fast." because that's what you likely will do thinking "cheap" and "small". Enough of this "it's so easy"-posts already.

He seems to be an intelligent guy but this post has just no content. (Except those 25 occurrences of "ship it").

<comment><USER3> Fail fast, for sure. Give yourself one year to prove it. If you can't prove it in a year, move on. There are plenty of other interesting problems to solve.

</comment></comment><comment><USER4> Also, you might want to offer a compelling product...</comment>


WordPress 2.6 released: "a more powerful CMS" - <AUTHOR> http://wordpress.org/development/2008/07/wordpress-26-tyner/

<comment><USER2> Sheesh. How long until WP, with regular, excellent upgrades surpasses Drupal, which is loads more "powerful" but has a much slower development cycle and a lousy, awful UI?

<comment><USER3> That would seem to depend on what you're trying to build. If you're building a blog, or something else that fits squarely in the WordPress design space, go ahead and use WordPress.

WP has, historically, aimed to solve different problems than Drupal. And I would hope that WordPress doesn't try to become Drupal if the cost is additional complexity, a slower development cycle, and less time to spend refining the documentation and user experience. I wouldn't say that Drupal is _more powerful_ : it's more _general-purpose_. That is often a source of power, but it also entails being harder to design and develop, harder to use, and _very_ hard to document -- the ecosystem is _huge_ , and diverse, and all the modules evolve at different speeds. To the extent that WP has a tighter focus, they should _treasure_ that feature, and maintain it wisely.

<comment><USER2> Well-said. I'm coming at this from a media perspective. So the use case is always "online magazine." Right now, I'd go with Drupal for that, since its got features WP doesn't and much better access control. But WP is catching up.....

<comment><USER4> I find "The Morning After" WP theme, a good online magazine theme. <http://code.google.com/p/the-morning-after/>

</comment></comment></comment></comment><comment><USER5> Some yummy changes; particularly the Wiki-like edit tracking.

<comment><USER6> The wiki-like revision tracker is extremely useful, I'm also a fan of the "press this" feature... its just the name seems a bit odd for the functionality.</comment></comment>


Wuala shutdown notice - <AUTHOR> https://support.wuala.com/2015/08/wuala-shutdown-notice/

<comment><USER2> Another reason not to trust these services. Next week this could be dropbox.

</comment><comment><AUTHOR> Any recent experiences on Tresorit vs. Spideroak?</comment>


Is writing a framework the only thing developers get recognition/respect for? - <AUTHOR>

It seems that primary way to get recognition or respect in the developer community is to write a framework.<p>It feels like if I don't write a framework that becomes widely used, nobody will really care about me or what I have to say. <comment><USER2> I would say that this is untrue. How much (or how little) people care about what you say is simply tied to what they've heard from you or about you in the past.

A framework project helps with this, because it presents a history of your work - but it only helps if other people are actually _using_ the framework. That same history and reputation could be established by authoring a widely- used library, or by voluminous contribution/collaboration with open-source projects.

In some cases, even just imparting your knowledge can establish the positive reputation. This is where blogging and speaking at conferences (and unconferences/lightning talks, to start out with) can help.

</comment><comment><USER3> Framework is too specific -- developers of widely used applications, operating systems, languages, etc. also get recognition and respect. But, yes, if you want to get respect from other developers, the best way is probably to develop something that gets widely used, especially something widely used by other developers.

</comment><comment><USER4> I don't think so. Most of the developers that I have most looked up to over the years either did not write frameworks, or if they did, that was only a small part of their work, and I likely would have viewed them as great developers even had they not done a framework.

</comment><comment><USER5> Frameworks are less interesting than usable applications.</comment>


Why I wrote a book about interpreters - <AUTHOR> http://thorstenball.com/blog/2016/11/30/why-i-wrote-a-book-about-interpreters/ <comment><USER2> The way I would sum up interpreters and compilers, trying to put it as concisely as possible:

Step 1. Write a program that reads the input program into a data structure that exactly represents the language. You just wrote a parser.

Step 2. Write a program that operates on the data structure from (1) to execute the program. You just wrote an interpreter.

Step 3 (Optional): Write a program that converts the data structure from (1) into a different data structure that you can interpret more efficiently. You just wrote an optimizer.

Step 4 (Optional): Keep iterating on (3) until the output of your optimizer is machine code. You just wrote a compiler.

Not saying the above obviates the need for a book like this one (at all), I just had never thought of it in quite this way and wanted to write it down. :)

<comment><USER3> Nit: The output does not have to be machine code to be considered a compiler.

<comment><USER4> What, then, is the difference between a compiler and an interpreter? Just that the compiler saves its output rather than executing it?

<comment><USER5> I would define it as: when a compiler operates on its own source code, the resultant compiled compiler executes as fast as the original. When an interpreter evaluates its own source code, the resultant interpreted interpreter is an order of magnitude slower. This definition allows for things like "just in time" compilation, and rules out silly tricks like bundling an interpreter and some source code into an executable image.

<comment><USER6> Until you get to the Forth family

<comment><USER7> Why does that change with going to Forth?

<comment><USER6> The speed differential. Your basically making a list of jumps into machine code and then jumping in a loop. The interpreter takes your input and turns it into a jump list which it pumps into the loop. You can reuse a jump list by defining it as a new word.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I highly recommend the Coursera compilers class: you don't have to work though it in synch with a class; just sign up and work at your own pace. If you have to watch the same video two or three times, you can. None of this stuff actually turns out to be that complicated: it just takes a little while to get the lingo and concepts.

I implemented the entire parser, typechecker, and compiler in Go here: [https://github.com/zellyn/gocool](https://github.com/zellyn/gocool)

I then went back and hand-wrote a recursive descent parser, just for fun: Cool is such a simple language that it really wasn't difficult.

<comment><USER9> FWIW, I think the coursera class is now gone, but the course should have matched this [http://web.stanford.edu/class/cs143/](http://web.stanford.edu/class/cs143/)

<comment><USER8> That's a pity: the lecture videos were worthwhile, and I got all the unit tests by dissecting the auto-checking scripts that the class supplied :-/

<comment><USER9> it's possible they are available in the internet archive backup, but I don't have idea how to inspect those without downloading tens of gigabytes of stuff.

[https://archive.org/details/archiveteam_coursera](https://archive.org/details/archiveteam_coursera)

<comment><USER10> It seems to be available from Stanford's Lagunita site: [https://lagunita.stanford.edu/courses/Engineering/Compilers/...](https://lagunita.stanford.edu/courses/Engineering/Compilers/Fall2014/about)

<comment><USER8> Nice! Same lecturer: Alex Aiken

</comment></comment></comment></comment></comment></comment><comment><USER11> [Ignoring the dupes since they got no attention. Good reason to resubmit if material is worthwhile.]

The author seems to be doing a good thing. Like he said, most of the write-ups on this subject are either ultra-heavy with theory or basically nothing with code examples. Doing interpreters piece-by-piece like in SICP or The Little Schemer series in an accessible language gradually giving them the code and theory they need is a good idea.

It could also help in my verifiable builds scheme where people show no subversion exist by building from ASM to small language (or interpreter) then to bigger one then whole compiler. I was debating p-code, Oberon, Scheme, MiniML... Biggest problem is that the best stuff, eg Scheme's or ML's, is least likely for imperative programmers to try to understand. Something like this could help if I use an imperative base.

<comment><USER12> At the time I pointed out that this is a dupe the previous submission had been less than an hour earlier, scarcely giving it enough time to get any attention.

But screw that, let's just submit things every 10 minutes until they get upvotes.

<comment><USER11> Oh I overlooked that. Guessed that the others were older. My bad on that.

</comment></comment></comment><comment><USER13> Except the dupe story, does anyone gave the book a closer look and can say if it's suitable for beginning programmers? By that I mean if it's suitable to study and implement an interpreter in other language without a degree in computer sience?

Programming is one of my hobbies and my dream is to do an interpreter on my own, but most books are so heavy to understand if you know what I mean.

Thank you very much for your opinion.

<comment><USER14> Disclaimer: I'm the author of the book and thus pretty biased.

As a matter of fact, I wrote this book specifically for people like you and me: no CS degree, highly interested in interpreters and compilers, but intimidated by the existing literature. (If you studied compilers in college, this book will probably teach you nothing new.) There's a sample on the landingpage that should give you an impression of the difficulty - my guess is, that if you already know how to program and know the basics of Go, you'll get along just fine.

<comment><USER15> On a total tangent, I'd love to get that metacircular interpreter poster, any chance you'd like to sell a print-quality copy? :)

</comment></comment></comment><comment><USER16> I like these kinds of books a lot. I'm not at all interested in Go, so I'll probably convert the code to C# for my own amusement...but I dig it. I've mucked with lexers for text editing purposes and have always wanted to build my own compiler. It's somewhere down on the bucket list.

</comment><comment><USER12> Dupe: [https://news.ycombinator.com/item?id=13079250](https://news.ycombinator.com/item?id=13079250)

And again: [https://news.ycombinator.com/item?id=13071939](https://news.ycombinator.com/item?id=13071939)

 _Edit: To those who downvoted me, let me just point out that this was submitted less than an hour after the previous submission, hence my pointing at that (barely) earlier item._

<comment><USER17> Please don't post previous submissions without comments, they are worthless.

<comment><USER12> So let me ask a serious question here. Suppose someone submits a story. The following day it has few points, and no comments. If someone then submits the same story, fair enough.

Now suppose the story is submitted, has few points, no comments, and then 30 seconds later someone submit the same story. Is it fair to point at the one that's only 30 seconds old? I would say yes, you might disagree, I would be interested to know what you think.

If it's reasonable to point at a submission that's only 30 seconds older, then we have a question:

How old should a previous submission be to declare that it's fair enough to give it a second chance?

I would say that an hour isn't long enough, so if something is submitted a second time within an hour then it's perfectly reasonable to point at the previous submission.

If you disagree, fine, say so. If you think it's reasonable that something is submitted within seconds of a previous submission, say so.

I'd be interested to know what you think is reasonable. It's plausible that we have different opinions about what is reasonable in this context. If so, I'd like to know what you think.

<comment><USER17> If you have issues with the site functionality, you should contact email@example.com.

<comment><USER12> So it's OK for you to tell me what to do, and what not to do:

      > Please don't post previous
      > submissions without comments,
      > they are worthless.

... and yet you decline to answer my question, or to tell me your opinion on these matters.

That's a pity. I'd've liked to have known your thoughts as to whether it's reasonable to have multiple submissions within minutes without indicating the duplication.

</comment></comment></comment></comment></comment><comment><USER18> A fun and fairly simple project, with a surprisingly high ratio of usefullness to effort, is to write an interpreter for a concatenative language. Concatenative languages, like FORTH, can do a lot with very limited resources, making them good candidates for embedded systems.

If you want to play around with making your own concatenative language, it is actually surprisingly simple. Here is an overview of a step-by-step approach that can take you from a simple calculator to a full language with some optimization that would actually be quite reasonable to use in an embedded system.

So let's start with the calculator. We are going to have a data stack, and all operations will operate on the stack. We make a "dictionary" whose entries are "words" (basically names of functions). For each word in the dictionary, the dictionary contains a pointer to the function implementing that word.

We'll need six functions for the calculator: add, sub, mul, div, clr, and print. The words for these will be "+", "-", "x", "/", "clr", and "print". So our dictionary looks like this in C:

        struct DictEntry {
            char * word;
            int (*func)(void);
        } dict[6] = {
            {"+", add}, {"-", sub}, {"x", mul},
            {"/", div}, {"clr", clr}, {"print", print}
        };

We need a main loop, which will be something like this (pseudocode):

        while true
            token = NextToken()
            if token is in dictionary
                call function from that dict entry
            else if token is a number
                push that number onto the data stack

Write NextToken, making it read from your terminal and parse into whitespace separated strings, implement add, sub, mul, div, clr, and print, with print printing the top item on the data stack on your terminal, and you've got yourself an RPN calculator. Type "2 3 + 4 5 + x print" and you'll get 45.

OK, that's fine, but we want something we can program. To get to that, we first extend the dictionary a bit. We add a flag to each entry allowing us to mark the entry as either a C code entry or an interpreted entry, and we add a pointer to an array of integers, and we add a count telling the length of that array of integers. When an entry is marked as C code, it means that the function implementing it is written in C, and the "func" field in the dictionary points to the implementing function. When an entry is marked as interpreted, it means that the pointer to an array of integers points to a list of dictionary offsets, and the function is implemented by invoking the functions of the referenced dictionary entries, in order.

A dictionary entry now looks something like this:

        struct DictEntry {
            char * word;
            bool c_flag;
            void (*func)(void);
            int * def;
            int deflen;
        }

(continued in reply)

<comment><USER18> Now the main loop has to look something like this:

        while true
            token = NextToken()
            if token is in dictionary
                if dict entry is marked as C code
                    call function from that dict entry
                else
                    InterpWords(def, deflen)
            else if token is a number
                push that number onto the data stack

and InterpWords looks something like this

        void InterpWords(int * def, int deflen)
            while (deflen-- > 0)
                InterpOneWord(&dict[*def++])

        void InterpOneWord(dict * dp)
            if (dp->c_flag)
                (*dp->func)()
            else
                InterpWords(dp->def, dp->deflen)

With this, we can add new built-in functions defined in terms of already defined functions. Before we do any of that, though, we should add some more stack manipulation functions. Add at least "dup", "drop", and "swap", which, respectively, push a copy of the current top of stack onto the stack, pop an entry from the stack, and exchange the top two items on the stack.

For reference, after adding those, the dictionary offsets of the 9 words we've defined are:

        0 +
        1 -
        2 x
        3 /
        4 clr
        5 print
        6 dup
        7 drop
        8 swap

and they are all marked as C code. Now let us add a built-in function "sq", which squares the top item on the stack. To do that, add a new dictionary entry initialized like this:

        {"sq", false, 0, sq_def, 2}

where sq_def looks like this:

        int sq_def[] = {6, 2}

That's marked as being interpreted rather the C code, so when the main loop finds it it will call InterpWords, passing it sqdef and 2, and InterpWords will end up invoking dup and x, with the result being the top of the stack is squared.

OK, that's all fine and dandy, but we want to be able to define functions in our language from our language. So far, we can define functions in our language, like sq, but we have to do it by editing a C data structure and recompiling.

(continued in reply)

<comment><USER18> To do this, we'll need some changes to both InterpWords and/or InterpWord, and to the main loop. The basic idea is that we add a "compiling" mode. When we are in compiling mode the main loop does not execute the tokens it gets. Instead it just makes a list of the dictionary offsets of the words it would have executed. So in compiling mode, if you type "dup x", the main loop doesn't actually call dup and x, it just makes the list {6, 2}. That is used to make the function we are compiling. We'll have to find some way to tell the interpreter what we want to call the new function. The interpreter can than make a new dictionary entry for it, referencing that list of dictionary offsets.

The above only covers words in compiling mode...what do we do when the main loop sees a number in compiling mode? That's where we need to extend InterpWords. We need to change the list of dictionary offsets it receives to be able to also specify numbers. Maybe something like this (taking advantage of the fact that dictionary offsets are always non-negative):

        void InterpWords(int * def, int deflen)
            while (deflen-- > 0)
                if (*def >= 0)
                    InterpOneWord(&dict[*def++])
                else if (*def == -1)
                    push def[1] onto data stack
                    def += 2; deflen--;
                else error

A -1 in the word offset stream now means that the next item in the stream is a number to push onto the stack rather than a word offset. So now we can support functions like "dup x 10 +" that squares the top of the stack and adds 10, which would compile to {6, 2, -1, 10, 0}

We still aren't there, though, because we don't yet have a way to enter or leave compiling mode. That's easy. We'll add a new built-in function, ":". We'll write this in C. What ":" does is read the next token, see if it is a legal word name and not already in use. If it is (legal) and isn't (in use), it creates a new dictionary entry for it, allocates space for the definition, and flips on the global compiling flag.

Great! Now we can start defining new words from in our language. Just one problem...how do we terminate compilation? The main loop is compiling everything, so how do we get it to execute the command to stop compiling and finish making the dictionary entry?

For that, we need yet another flag in the dictionary: the immediate flag.

        struct DictEntry {
            char * word;
            bool c_flag;
            void (*func)(void);
            int * def;
            int deflen;
            bool immediate;
        }

Change the main loop so that when it sees a word with the immediate flag set, it executes it even if it is in compiling mode. With that, we can add a word ";", with the immediate flag set, that turns off compiling mode and finalizes the compilation of the word that was being compiled. When we get these changes in, then we would be able to define "sq" from within the language instead of making it a built-in like we did earlier: ": sq dup x ;"

Of course, we probably want our language to support some kind of if/else construct and some kind of looping construct.

I bet you can see how this will be done. Most of the work is done in InterpWords. Much like we used -1 to indicate that the next entry is a number for the stack, we'll use -2 to indicate a goto. The entry after -2 will be the offset to go to. (Should it be an absolute offset or relative? Your choice). We'll use -3 to indicate a conditional goto. It works like -2, except that it only goes if the top of the stack is non-zero, and it pops the top of the stack. If the top of the stack is zero, it pops it, and then skips over the offset.

Here's how we could use this to implement a do...while kind of loop. First think of how we want it to look in our programs. It might be something like this "do <body of loop> <loop condition> while". So we want the compiled code to look like this:

        <dict offset list for body of loop>
        <dict offset list for loop condition>
        -3
        offset of body of loop above

To make "do" and "while" work, we need to flag their dictionary entries as immediate words. So when we are compiling and hit "do" the code for "do" is executed. For now, let's make this C code. What the "do" code does is simply save the offset of where the next word will be compiled to. What the "while" code does is put the -3 in the compiled code, and then put the offset that was saved by the "do" into the compiled code.

You can do similar things for if/else constructs, for loops, and any other control flow you want: make the low level operations you need in InterpWords, and then make immediate words for use during compilation that gather and use the necessary information to write that control flow.

Now let's talk a bit about optimization. One thing you can do is some inlining. Consider this function ": cube dup sq x ;". When compiling this, we could notice that "sq" is not C code, and put its definition inline, so we end up compiling cube as if it were written like this: ": cube dup dup x x ;".

(BTW, remember earlier when I said it was up to you whether you use absolute or relative offsets in the low level control flow? Relative will make inlining easier if the inlined function has any branches).

Now if you are going to implement entirely in C or similar, that's about the end of the simple optimizations (at least as far as my feeble mind can handle). However, if you are willing to work in assembly language some, you can get much fancier.

You can make the lowest level built-ins, such as add, mul, dup, and similar assembly language. (In the following I'm going to continue to say C function, for consistency with the earlier stuff, but what it now means is a function that is not defined in our language). We can change the way non-C functions are defined from being a list of dictionary offsets to a pointer to actual code. So for ": sq dup x ;" instead of compiling that as a pointer to the list {6, 2}, we compile it as a pointer to a list of call instructions, followed by a return. For sq, that would look like this:

        call dup
        call mul
        ret

Cube would look like this (without optimization)

        call dup
        call sq
        call mul
        ret

and with sq inlined at the high level, it would become

        call dup
        call dup
        call mul
        call mul
        ret

For built-ins that are position independent assembly code, we can do another level of inlining and replace calls to them with their body.

Depending on the addressing modes your processor supports, this could end up with cube being as simple as four instructions (not counting the return), with all the calls eliminated!

You can go farther and do things like cache the top few stack items in registers, and add peephole optimizers that go over the compiled code to eliminate redundant operations.

The really cool thing is how easy bootstrapping this kind of thing is. You only need a small number of built-in assembly functions to give you enough to write the rest of the language in itself, and these systems tend to be small and perform reasonably well. These kind of languages can be great in embedded systems, and indeed that is where the granddaddy of this kind of language, FORTH, got its start.

<comment><USER19> I agree with your approach! I built a non-Turing-complete Forth-like interpreter in Go a few years ago with words similar to the set you've defined above:

[https://lawlessguy.wordpress.com/2013/07/20/an-rpn- interpret...](https://lawlessguy.wordpress.com/2013/07/20/an-rpn-interpreter- in-go-golang/)

</comment></comment></comment></comment><comment> nv-vn Awesome! As someone interested in compilers and interpreters who has not completed a degree in computer science it was quite hard to get any of the background. This post is spot on: you'll either read a 1000 page book about it or you're stuck reading tiny blog posts. Notation also sucks for beginners, few books ever bother explaining it at all. My favorite/most helpful text I've found so far is Essentials of Programming Languages, which covers a wide variety of topics and introduces them as parts of (complete) interpreters. The code is written in very readable Scheme (so much so that I was able to understand everything despite not knowing Scheme or Lisp at the time I began reading it).</comment>


Abusing Gmail to get previously unlisted e-mail addresses - <AUTHOR> https://blog.0day.rocks/abusing-gmail-to-get-previously-unlisted-e-mail-addresses-41544b62b2 <comment><USER2> I'm going to have to agree with Google here, in that this isn't an exploitable security vulnerability. Knowing that the mailboxes email@example.com or firstname.lastname@example.com exist doesn't bring me any closer to exploiting the knowledge. I don't know that Famous Celebrity is in fact THE famous celebrity. I don't know whether Controversial Journalist still reads mail sent to that account. Most importantly, I don't learn anything I couldn't have learned by sending messages to every likely permutation of email@example.com. This won't teach me anything particularly useful for spearfishing, as I'm just throwing out a net hoping something gets caught.

<comment><USER3> To verify the existence of a single account all you need to do is go to gmail.com and attempt logging into it. It's that simple. Sometimes you will even see the profile pic so you know who this user is or claims to be.

The OP found a way to discover 40000 new addresses of random people per day by brute forcing through a dictionary-generated list of plausible candidates.

Use it for Nigerian scams, Viagra ads, account hijacking, anything you please.

<comment><USER4> This feature really grinds my gears. They should at least allow a feature to disable showing the picture/name until the user has logged in. In some cases I'm handing out my email to avoid handing out my actual identity because I don't want to be spammed or followed. Until then I will continue to use a false name and photo under my accounts signed up to google (apart from the one work email I have thru them).

<comment><USER5> AFAIK the picture is only shown if Google is reasonably confident that it is actually _you_ trying to log in.

<comment><USER3> > AFAIK the picture is only shown if Google is reasonably confident that it is > actually you trying to log in.

I didn't know about this feature, but I often saw pictures of people I know when I tried. Apparently, it seems that for example just sharing IP address is sufficient to trigger this reasonable confidence. Not sure what other ways there may be. But indeed, it didn't work for a few random strangers from LKML I just tried.

<comment><USER5> IP is a factor, but it's actually much more sophisticated than that :)

</comment></comment></comment></comment></comment></comment><comment><USER6> I see companies trying to solve a similar issue on their password reset forms. They ask you to enter an email address - then give you a reply "if that email exists, we have sent a password reminder there".

The problem is these sames sites have a self-signup, using a unique email as your login. So you can already find out if an email address is in use or not.

If you've going to 'leak' the data one way or another, dont sacrifice UX for the sake of it.

<comment><USER7> Do the same thing on the signup page: If the email is already registered just progress the same way - send an email to that address and notify them that they already have an account.

<comment><USER8> Which is great for most accounts, but what about a primary?

How do you sign up for Gmail without an email account in this case?

<comment><USER7> well, obviously this will not work for a primary account. It also adds friction the signup process, leading to lower conversion rations. But for some use-cases that may be a valid trade-off. Think dating sites, ..., stuff where knowing that a certain email is subscribed already may be embarrassing or worse (gay dating websites in certain countries).

<comment><USER8> Oh absolutely, it's a good system and many sites already utilize it.

I only mentioned the Gmail example because that's what the article was about, it sounded like you were suggesting a solution for that scenario.

</comment></comment></comment></comment></comment><comment><USER9> This isn't an issue, you can do the same thing with the main login form and a number of undocumented APIs. I've never seen anyone else acknowledge "confirmation of email address existence" as a security issue and I don't see why Google should be the first.

<comment><USER10> > I've never seen anyone else acknowledge "confirmation of email address > existence" as a security issue

It's usually called "username enumeration" and there's plenty of pen testing firms that include this as a standard part of their process.

<comment><USER11> How do you prevent username enumeration when you want to have a username taken feature in the sign up process? I suppose a way to handle that would be to throttle the number of times such an IP can make those requests per month or something. This still will not prevent a motivated attacker, or the casual use to check if one or two usernames are registered.

<comment><USER10> In most cases, you can use an email address as the account name, and send a confirmation email containing a link they can use to sign up.

If the account already exists, you send an email saying something like "Hey, you tried to sign up but you already have an account. If you need to reset your password, follow this link." If the account doesn't already exist, you send the normal "follow this link to confirm your account" email.

From the attacker's point of view all they get told is "Check your email to continue" whether or not the account is already registered, so it doesn't leak this information.

This isn't always suitable – a mail provider like Gmail is an obvious example – but it would work for the vast majority of websites / web applications.

To be honest, I don't really rate username enumeration as a severe problem for most projects – obviously it's a problem if you can determine whether an email address is registered on, e.g. Ashley Madison or similar though. But it's simply not the case that "nobody else acknowledges it as a problem" – it's a very widely used test, even if the severity is usually considered low.

</comment></comment></comment></comment><comment><USER12> There's a more API friendly endpoint to do this that returns a nice JSON response, like this:

      {"input01":{"Valid":"false","ErrorMessage":"That username is taken. Try another.","Errors":{"GmailAddress":"That username is taken. Try another."},"ErrorData":[""]},"Locale":"en"}

See: [https://gist.github.com/saml/2268291](https://gist.github.com/saml/2268291)

<comment><USER13> Checked and it still works too. Ported to node and added to: [https://github.com/mikemaccana/is-gmail-account- valid](https://github.com/mikemaccana/is-gmail-account-valid)

</comment></comment><comment><USER14> From what I can tell, this is a useful first step towards credential stuffing.

Requests against endpoints like this are going to be unauthenticated, since by their very nature they happen before the user is actually authenticated against the system. So you can burn through a few thousand (or hundred thousand) possibles and find out which ones actually have accounts.

From there, you can use one of many other email/password dumps and try authenticating. Hitting an endpoint where you can use an email and password is (hopefully) going to be much more guarded and will start blocking IPs when the rate or variance is too high.

That being said, I don't really know how you can stop the first step. There are plenty of answers here that say you should just let them "sign up" and then send them an email if they already have an account. But what happens if your signup process includes something like accepting payment? Obviously you don't want the user filling out all of that information again.

</comment><comment><USER15> Wouldn't a similarly effective method be to script SMTP and see which ones get rejected as envelope to addresses?

<comment><USER16> Sure, but I imagine there is some form of rate limiting on that, whereas the point of the article is that they found an endpoint without rate limits.

<comment><USER15> There might be a rate limit, but it's definitely possible to use this method and get higher than the ~40k a day that the author attained.

</comment></comment></comment><comment><USER17> Email enumeration is often determined to be a UX choice rather than a security issue. I've explored this in the past with the idea of doing this to popular sites to build a demo/psychographic profile of an email address. Had a MVP hosted but not working at the moment. I remember sites included FB, Sephora, Home Depot, CafeMom, ESPN. Most have a XHR call to an API that determines if email exists or a message saying "Your password is incorrect".

<comment><USER18> That is very interesting! I wonder if some companies already doing that to "qualify" email addresses for sending spam, or more ethicaly enhancing their own email lists with this.

e.g. checking if my customers use competitors

</comment></comment><comment><USER13> I got bored over lunch and made this a node module:

[https://www.npmjs.com/package/is-gmail-account- valid](https://www.npmjs.com/package/is-gmail-account-valid)

        const isGmailAccountValid = require('is-gmail-account-valid')

        isGmailAccountValid('some.username', function(err, result){
            console.log(err, result)
        })

</comment><comment><USER19> Is there something like this for Outlook?

</comment><comment><USER20> Thanks Google :( I think they should at least put a rate limiter to that endpoint.

<comment><USER21> Nah, it's not a security bug, that means we can exploit it.

<comment><USER22> Makes me wonder what they require to classify the bug as a security bug. Perhaps it gets classified otherwise since there's no data leakage other than an address? The existence of an address isn't exactly confidential.

<comment><USER23> I guess the authors idea of

1\. Checking if an email address exists

2\. Running it against a known dump of leaked data, with passwords etc

3\. Try logging in to google account with the leaked password, hoping the user reuses passwords

Google encourages their users to use 2FA and has other measures to detect when logins are coming from unknown locations, so I guess they figured the risk of this was pretty low

<comment><USER22> Agreed, a popped account is a bad thing, especially if it's published as such. A larger risk would be somebody popping one of the compromised-credential repositories. Then you've got both username and password. But here we're effectively seeing a slow-scale brute force...

Everybody should enable 2FA, and use the strongest 2FA you can. Buy a yubikey or other U2F key and use it for everything possible. And webdevs, please start supporting U2F in addition to RFC 6238 TOTPs. It's really not that hard.</comment></comment></comment></comment></comment>