luau VS FrameworkBenchmarks

As far as I can tell, they aren't.

http://lua-users.org/wiki/SandBoxes

There is a lot of information there, but it doesn't handle resource exhaustion, execution time limits or give any guarantees. It does indicate that it's possible, and has a decent example of the most restrictive setup, which is a good start. But I would for example compare it with Luau's SECURITY.md.

From https://github.com/luau-lang/luau/blob/master/SECURITY.md:

> Luau provides a safe sandbox that scripts can not escape from, short of vulnerabilities in custom C functions exposed by the host. This includes the virtual machine and builtin libraries. Notably this currently does not include the work-in-progress native code generation facilities.

> Any source code can not result in memory safety errors or crashes during its compilation or execution. Violations of memory safety are considered vulnerabilities.

> Note that Luau does not provide termination guarantees - some code may exhaust CPU or RAM resources on the system during compilation or execution.

So, even luau will have trouble with untrusted code, but it specifies exactly what happens and so on. I think that's fair enough.

Alternatively, Luau is a well-supported Lua variant with type checking and performance improvements, aimed more towards being a sandboxed embedded scripting environment.

https://luau-lang.org/

If you need Lua but also type-safety, how about Luau [1] then?

[1] https://luau-lang.org/

I had the pleasure of working with Lua 5.1 back in the late noughties. For me it's replaced Tcl whenever I want something I can configure above a C library. At the time I used it I found it quite nice but I'll also not forget the hours I wasted tracking down nil table corruptions which could have easily been caught by a type checker.

I had some hope that Luau https://luau-lang.org or Teal https://github.com/teal-language/tl would make things better but with the following example

    function foo(x: number): string

Looking at other replies here, I can see I wasn't the only one who didn't realize there is Lua and Luau. Luau is an extension of Lua: https://luau-lang.org/

> Luau is syntactically backwards-compatible with Lua 5.1 (code that is valid Lua 5.1 is also valid Luau); however, we have extended the language with a set of syntactical features that make the language more familiar and ergonomic.

Lua is usually the embedded language of choice. If you are focused on security, you could check out the Roblox fork, Luau (https://github.com/Roblox/luau) where the creators took extra care to lock down the language on what scripts could do.

Luau - Lua variant by Roblox

On a side note, I've heard that they recently switched from Lua to Roblox's own fork of Lua, Luau.

https://www.youtube.com/results?search_query=luau+roblox&sp=...

Luau

https://github.com/Roblox/luau

Roblox wrote a superset of Roblox Lua which is way faster

https://luau-lang.org/ - some documentation, and examples https://create.roblox.com/docs - documentation, tutorials, and examples https://www.youtube.com/user/AlvinBLOX - tutorials https://www.youtube.com/@TheDevKing/videos - tutorials https://www.lua.org/manual/5.1/ - not specific to Roblox, but Lua reference manual https://www.codecademy.com/learn/learn-lua - Lua on Codecademy

Neat. Thanks for sharing!

Interestingly, may-minihttp is faring very well in the TechEmpower benchmark [1], for whatever those benchmarks are worth. The code is also surprisingly straightforward [2].

[1] https://www.techempower.com/benchmarks/

[2] https://github.com/TechEmpower/FrameworkBenchmarks/blob/mast...

ntex was formed after a schism in actix-web and Rust safety/unsafety, with ntex allowing more unsafe code for better performance.

ntex is at the top of the TechEmpower benchmarks, although those benchmarks are not apples-to-apples since each uses its own tricks: https://www.techempower.com/benchmarks/#hw=ph&test=fortune&s...

Ruby is slow. Very slow. How much you may ask? https://www.techempower.com/benchmarks/#hw=ph&test=fortune&s... fastest Ruby entry is at 272th place. Sure, top entries tend to have questionable benchmark-golfing implementations, but it gives you a good primer on the overhead imposed by Ruby.

It is also not early 00s anymore, when you pick an interpreted language, you are not getting "better productivity and tooling". In fact, most interpreted languages lag behind other major languages significantly in the form of JS/TS, Python and Ruby suffering from different woes when it comes to package management and publishing. I would say only TS/JS manages to stand apart with being tolerable, and Python sometimes too by a virtue of its popularity and the amount of information out there whenever you need to troubleshoot.

If you liked Go but felt it being a too verbose to your liking, give .NET a try. I am advocating for it here on HN mostly for fun but it is, in fact, highly underappreciated, considered unsexy and boring while it's anything but after a complete change of trajectory in the last 3-5 years. It is actually the* stack people secretly want but simply don't know about because it is bundled together with Java in the public perception.

*productive CLI tooling, high performance, works well in a really wide range of workloads from low to high level, by far the best ORM across all languages and back-end framework that is easier to work with than Node.JS while consuming 0.1x resources

Although that seems to have improved in recent years.

https://www.techempower.com/benchmarks/#hw=ph&test=json§...

RoR and whatever C++ based web backend there is count as a valid comparison in my book. But comparing the languages itself is maybe a bit off.

On a side note, you can actually compare their performance here if you’re really curious. But take it with a grain of salt since these are synthetic benchmarks.

https://www.techempower.com/benchmarks

Most benchmarks you'll find essentially have someone's thumb on the scale (intentionally or unintentionally). Most people won't know the different languages well enough to create comparable implementations and if you let different people create the implementations, cheating happens. The TechEmpower benchmarks aren't bad, but many implementations put their thumb on the scale (https://www.techempower.com/benchmarks). For example, a lot of the Go implementations avoid the GC by pre-allocating/reusing structs or allocate arrays knowing how big they need to be in advance (despite that being against the rules). At some point, it becomes "how many features have you turned off." Some Go http routers (like fasthttp and those built off it like Atreugo and Fiber) aren't actually correct and a lot of people in the Go community discourage their use, but they certainly top the benchmarks. Gin and Echo are usually the ones that are well-respected in the Go community.

There is certainly a lot of speculation in Techempower benchmarks and top entries can utilize questionable techniques like simply writing a byte array literal to output stream instead of constructing a response, or (in the past) DB query coalescing to work around inherent limitations of the DB in case of Fortunes or DB quries.

And yet, the fastest Ruby entry is at 274th place while Rails is at 427th.

https://www.techempower.com/benchmarks/#hw=ph&test=fortune&s...

oh what machine? with how many workers? doing what?

search for "node" on this page: https://www.techempower.com/benchmarks/#section=data-r21

JustJS would like a word https://www.techempower.com/benchmarks/#section=data-r20&tes...

In terms of RPS, this web service is more-or-less the fortunes benchmark in the techempower benchmarks, once the data hits the cache: https://www.techempower.com/benchmarks/#section=data-r21

Or, at least, they would be after applying optimizations to them.

In short, both of these would serve more rps than you will likely ever need on even the lowest end virtual machines. The underlying API provider will probably cut you off from querying them before you run out of RPS.