luau VS Lua

As far as I can tell, they aren't.

http://lua-users.org/wiki/SandBoxes

There is a lot of information there, but it doesn't handle resource exhaustion, execution time limits or give any guarantees. It does indicate that it's possible, and has a decent example of the most restrictive setup, which is a good start. But I would for example compare it with Luau's SECURITY.md.

From https://github.com/luau-lang/luau/blob/master/SECURITY.md:

> Luau provides a safe sandbox that scripts can not escape from, short of vulnerabilities in custom C functions exposed by the host. This includes the virtual machine and builtin libraries. Notably this currently does not include the work-in-progress native code generation facilities.

> Any source code can not result in memory safety errors or crashes during its compilation or execution. Violations of memory safety are considered vulnerabilities.

> Note that Luau does not provide termination guarantees - some code may exhaust CPU or RAM resources on the system during compilation or execution.

So, even luau will have trouble with untrusted code, but it specifies exactly what happens and so on. I think that's fair enough.

Alternatively, Luau is a well-supported Lua variant with type checking and performance improvements, aimed more towards being a sandboxed embedded scripting environment.

https://luau-lang.org/

If you need Lua but also type-safety, how about Luau [1] then?

[1] https://luau-lang.org/

I had the pleasure of working with Lua 5.1 back in the late noughties. For me it's replaced Tcl whenever I want something I can configure above a C library. At the time I used it I found it quite nice but I'll also not forget the hours I wasted tracking down nil table corruptions which could have easily been caught by a type checker.

I had some hope that Luau https://luau-lang.org or Teal https://github.com/teal-language/tl would make things better but with the following example

    function foo(x: number): string

Looking at other replies here, I can see I wasn't the only one who didn't realize there is Lua and Luau. Luau is an extension of Lua: https://luau-lang.org/

> Luau is syntactically backwards-compatible with Lua 5.1 (code that is valid Lua 5.1 is also valid Luau); however, we have extended the language with a set of syntactical features that make the language more familiar and ergonomic.

Lua is usually the embedded language of choice. If you are focused on security, you could check out the Roblox fork, Luau (https://github.com/Roblox/luau) where the creators took extra care to lock down the language on what scripts could do.

Luau - Lua variant by Roblox

On a side note, I've heard that they recently switched from Lua to Roblox's own fork of Lua, Luau.

https://www.youtube.com/results?search_query=luau+roblox&sp=...

Luau

https://github.com/Roblox/luau

Roblox wrote a superset of Roblox Lua which is way faster

https://luau-lang.org/ - some documentation, and examples https://create.roblox.com/docs - documentation, tutorials, and examples https://www.youtube.com/user/AlvinBLOX - tutorials https://www.youtube.com/@TheDevKing/videos - tutorials https://www.lua.org/manual/5.1/ - not specific to Roblox, but Lua reference manual https://www.codecademy.com/learn/learn-lua - Lua on Codecademy

The EventSource uses the Lua language to search for any services with ports set to 80 or 443 in the ‘argocd’ namespace. More examples can be found here.

If you're new to the 12 in 24 series, I'm learning and building projects with a new programming language every month - this month, it's the Lua scripting language. You can find source code for the projects I build in the official GitHub repository (check it out, this week's folder contains code for both this and two other bonus projects!).

This month, we're talking about Lua. It's not always a first choice when it comes to programming, but I think there's a lot to enjoy about this little language. Heck, I'm a big game development fan myself - I would look into it even if that was the only reason to.

It’s Portuguese. It’s the same in the Lua codebase [1].

[1]: https://github.com/lua/lua

If we think we need more flexibility for processing records, we can write our own embedded filters using Lua language. Lua is a highly efficient programming language used mainly for embedded scripting.

Lua

➜ ~ brew info lua ==> lua: stable 5.4.6 (bottled) Powerful, lightweight programming language https://www.lua.org/ /opt/homebrew/Cellar/lua/5.4.6 (29 files, 788.7KB) * Poured from bottle using the formulae.brew.sh API on 2023-05-16 at 11:03:06 From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/l/lua.rb License: MIT ==> Caveats You may also want luarocks: brew install luarocks ==> Analytics install: 16,599 (30 days), 56,745 (90 days), 139,027 (365 days) install-on-request: 1,763 (30 days), 6,266 (90 days), 21,105 (365 days) build-error: 0 (30 days)

I think Lua is a good example of doing documentation well. The source code is commented only as much as needed, mainly with brief comments about things that might not be obvious and a small number of longer explanations of how the architecture works (mainly relevant to developers). It also has a super nice feature that's surprisingly rare: each file has a very short line at the top that describes what the file is, so you don't have to guess based on the filename alone. The API is documented in a single HTML file on the website that has both the high level descriptions of the language and architecture, as well as documentation for each public-facing function. The docs are maintained by hand, but the API is mostly stable, so the docs don't need to change very often.

This is using the Lua language and the Solar2d game framework