6 ms·

It’s nice that Apple isn’t tying this functionality to OS updates. It was pretty bad a few months back when typing prediction went haywire and we had to wait we

It’s nice that Apple isn’t tying this functionality to OS updates. It was pretty bad a few months back when typing prediction went haywire and we had to wait weeks for a fix. Separately, I’m surprised Apple didn’t do this with Swift. I thought one of the goals of Swift was to be a good language for low level code up to high level scripting.

zepto 8y ago
Or JavaScript. Presumably both of these have more overhead than Apple wanted in this case, but it does seem odd.
- vorpalhex 8y ago
  lua is much easier to execute and much easier to sandbox than JS.
  - pcwalton 8y ago
    I don't see how Lua is easier to sandbox. I'm a bit surprised at the use of Lua, given that JavaScriptCore is already there. But I wouldn't be surprised if Lua was just something that the team was already familiar with. Lua is tiny, so it's not like it adds a significant dependency.
    - simonh 8y ago
      As you said Luna is tiny, which makes it easier to sandbox. A smaller system with a more limited set of behaviours and features is much easier to test and verify.
      - pcwalton 8y ago
        I guess, but (1) JavaScript is already there, so using it adds no new attack surface; (2) JS engines get more scrutiny; (3) sandboxing isn't as important anyway since the interpreter only runs trusted code.
        dottrap 8y ago
        There was a topic a few months ago about running JavaScript code in ring 0. People used similar arguments to claim it was safe enough. A v8 engineer chimed in to explain the reality of JavaScript engines. https://news.ycombinator.com/item?id=17186842 https://news.ycombinator.com/item?id=17186842 JavaScriptCore has a huge surface area. It is measured in tens of megabytes, whereas Lua is measured in hundreds of kilobytes. Wikipedia chose Lua because it was small enough that they were able to audit every line of code for security. Verisign approached Lua the same way for their high-reliability servers. Consider the complexity of JavaScriptCore. Their new-ish "FTL" optimization engine stands for "Fourth Tier LLVM", which means there are at least 4 levels of runtime optimizations JSCore performs on code, which is a lot of non-trivial complexity. And JIT means they cannot utilize no-execute bits in hardware. Then there is the memory and power-consumption. Lua's footprint for a VM instance is tiny. It is also a very efficient language, even in interpreted form. JavaScriptCore is comparatively heavy in both regards. Remember that Apple Watch still does not have Safari and JavaScriptCore is not available for watchOS developers. Presumably this decision is partly influenced by memory and performance constraints. Lua is trivial to get working well on watchOS. For a core feature, it makes sense to have minimal dependencies with a minimal footprint so plenty of room is left for user applications. Remember that Apple probably has a bunch of skunkworks devices in their labs they hope to productize someday. And many of these might be tiny portable devices with minimal hardware capabilities, like Apple Watch (or remember all the different iPods?). Lua's tiny implementation and extreme portability (written in pure ANSI C) make it well suited for this role. Apple won't have to port Lua to every new experimental CPU architecture they try, whereas JavaScriptCore has a lot of platform specific #ifdefs which have to be dealt with for every new platform.
        pcwalton 8y ago
        > There was a topic a few months ago about running JavaScript code in ring 0. People used similar arguments to claim it was safe enough. A v8 engineer chimed in to explain the reality of JavaScript engines. I've worked with SpiderMonkey and have known the team for about a decade now. I'm aware of the complexity :) > Consider the complexity of JavaScriptCore. Their new-ish "FTL" optimization engine stands for "Fourth Tier LLVM", which means there are at least 4 levels of runtime optimizations JSCore performs on code, which is a lot of non-trivial complexity. And JIT means they cannot utilize no-execute bits in hardware. FTL is gone, I believe. But anyway, JSC is not just a JIT. If you're worried about the JIT, just use an interpreter. > Then there is the memory and power-consumption. Lua's footprint for a VM instance is tiny. It is also a very efficient language, even in interpreted form. JavaScriptCore is comparatively heavy in both regards. JSC uses a hand-written assembly interpreter. I would be shocked if it beat Lua in performance. > For a core feature, it makes sense to have minimal dependencies with a minimal footprint so plenty of room is left for user applications. JSC has been shipping since the first version of iOS in 2007. Tons of apps use embedded WebKit already. > Remember that Apple Watch still does not have Safari and JavaScriptCore is not available for watchOS developers. This may well be the reason.
sbjs 8y ago
One purpose for making Swift was because Objective C is dynamic, and they thought they could get a speed boost by going fully static. The other is because they were having a hard time evolving a C-based language because C is full of plot holes. Swift is meant to be efficient but still allow abstractions, which C is really bad at. (The best you can get with C is leaky abstractions.) This should be dynamic, but it shouldn't be LUA. It should be something like JSON. Although Lua is sandboxed, so it's safer that way, it is still an easier and bigger attack vector for hackers than JSON would be.
- wereHamster 8y ago
  Do you really believe that if Apple wrote their own interpreter for their own custom language that serializes into JSON it would be safer than using one of the battle-tested LUA implementations?
  - sbjs 8y ago
    I was suggesting that they don't have executable code at all, that they use static configuration. But it may not be possible within their problem domain, I don't know. I always prefer static solutions until dynamic becomes necessary.
    - crgwbr 8y ago
      Between code signing and sandboxing, this probably isn’t any more dangerous than the JS that Safari downloads and runs every time you open a webpage.
  - stcredzero 8y ago
    Lua, not LUA. It's Portugese for moon.
- earenndil 8y ago
  C gives you technically perfect abstractions, but it's a pita: you have to mess around with unimplemented structs (`typedef struct Bla Bla`, but never actually define Bla in the public interface, and then have functions taking Bla*), and void pointers, which generally makes it significantly less comfortable than in higher-level-languages.
pcwalton 8y ago
Swift has a lot of goals, but having a small compiler isn't one of them as far as I'm aware. Swift has always leaned heavily on compiler heroics :)
- mmirate 8y ago
  To be fair ... For any given programming task, there is a fixed (minimum) amount of work to do to solve it correctly, and the programmer's design choices merely decide the distribution of that work among the environment, the compiler, the standard library, the third-party libraries, and the programmer herself. Meaning, that in order to use the programmer's time most effectively per unit of task difficulty, the language itself should be such that the compiler does as much work as it possibly can. Such a compiler simply won't be small, and probably won't be fast either. (imho the best it can or should do in the face of a syntactically-valid non-program, is to give as many errors at once as are applicable, so that the programmer can fix them all in one go) Rust, of course, in the grandly oversimplified view, takes this tradeoff in the same direction as Swift, and I'm sure you're familiar with all the ways that Rust is better for it ... and even a few ways that Rust is worse for doing the opposite. :) (Though, then again, there's miri, for those that value correctness over performance. Unless it too has changed names.)
  - deleted 8y ago
    [deleted]
woolvalley 8y ago
Swift is more like the next C++ than the next javascript. But is supposed to be easy enough to use that you could use it for a shell script. And the 'shell interpreter' is just compiling and executing your code.
robbyt 8y ago
Or they could do what Google have done, and separate more OS components into applications delivered out of band via the app store, like the browser (Chrome), the keyboard (Gboard), etc. Behavior changes of the os should not be quiet and magical, they should be intentional and the user should be notified (if they care).
- JustSomeNobody 8y ago
  Apple's goal is to have as many people as possible on the latest version of the OS. It makes support, etc. easier and therefore less expensive. In order to do that, people need to be enticed to update regularly. This comes in the form of updates to Maps, Safari, Emoji, etc.

zepto 8y ago

Or JavaScript. Presumably both of these have more overhead than Apple wanted in this case, but it does seem odd.

vorpalhex 8y ago
lua is much easier to execute and much easier to sandbox than JS.
- pcwalton 8y ago
  I don't see how Lua is easier to sandbox. I'm a bit surprised at the use of Lua, given that JavaScriptCore is already there. But I wouldn't be surprised if Lua was just something that the team was already familiar with. Lua is tiny, so it's not like it adds a significant dependency.
  - simonh 8y ago
    As you said Luna is tiny, which makes it easier to sandbox. A smaller system with a more limited set of behaviours and features is much easier to test and verify.
    - pcwalton 8y ago
      I guess, but (1) JavaScript is already there, so using it adds no new attack surface; (2) JS engines get more scrutiny; (3) sandboxing isn't as important anyway since the interpreter only runs trusted code.
      - dottrap 8y ago
        There was a topic a few months ago about running JavaScript code in ring 0. People used similar arguments to claim it was safe enough. A v8 engineer chimed in to explain the reality of JavaScript engines. https://news.ycombinator.com/item?id=17186842 https://news.ycombinator.com/item?id=17186842 JavaScriptCore has a huge surface area. It is measured in tens of megabytes, whereas Lua is measured in hundreds of kilobytes. Wikipedia chose Lua because it was small enough that they were able to audit every line of code for security. Verisign approached Lua the same way for their high-reliability servers. Consider the complexity of JavaScriptCore. Their new-ish "FTL" optimization engine stands for "Fourth Tier LLVM", which means there are at least 4 levels of runtime optimizations JSCore performs on code, which is a lot of non-trivial complexity. And JIT means they cannot utilize no-execute bits in hardware. Then there is the memory and power-consumption. Lua's footprint for a VM instance is tiny. It is also a very efficient language, even in interpreted form. JavaScriptCore is comparatively heavy in both regards. Remember that Apple Watch still does not have Safari and JavaScriptCore is not available for watchOS developers. Presumably this decision is partly influenced by memory and performance constraints. Lua is trivial to get working well on watchOS. For a core feature, it makes sense to have minimal dependencies with a minimal footprint so plenty of room is left for user applications. Remember that Apple probably has a bunch of skunkworks devices in their labs they hope to productize someday. And many of these might be tiny portable devices with minimal hardware capabilities, like Apple Watch (or remember all the different iPods?). Lua's tiny implementation and extreme portability (written in pure ANSI C) make it well suited for this role. Apple won't have to port Lua to every new experimental CPU architecture they try, whereas JavaScriptCore has a lot of platform specific #ifdefs which have to be dealt with for every new platform.
        pcwalton 8y ago
        > There was a topic a few months ago about running JavaScript code in ring 0. People used similar arguments to claim it was safe enough. A v8 engineer chimed in to explain the reality of JavaScript engines. I've worked with SpiderMonkey and have known the team for about a decade now. I'm aware of the complexity :) > Consider the complexity of JavaScriptCore. Their new-ish "FTL" optimization engine stands for "Fourth Tier LLVM", which means there are at least 4 levels of runtime optimizations JSCore performs on code, which is a lot of non-trivial complexity. And JIT means they cannot utilize no-execute bits in hardware. FTL is gone, I believe. But anyway, JSC is not just a JIT. If you're worried about the JIT, just use an interpreter. > Then there is the memory and power-consumption. Lua's footprint for a VM instance is tiny. It is also a very efficient language, even in interpreted form. JavaScriptCore is comparatively heavy in both regards. JSC uses a hand-written assembly interpreter. I would be shocked if it beat Lua in performance. > For a core feature, it makes sense to have minimal dependencies with a minimal footprint so plenty of room is left for user applications. JSC has been shipping since the first version of iOS in 2007. Tons of apps use embedded WebKit already. > Remember that Apple Watch still does not have Safari and JavaScriptCore is not available for watchOS developers. This may well be the reason.

sbjs 8y ago

One purpose for making Swift was because Objective C is dynamic, and they thought they could get a speed boost by going fully static. The other is because they were having a hard time evolving a C-based language because C is full of plot holes. Swift is meant to be efficient but still allow abstractions, which C is really bad at. (The best you can get with C is leaky abstractions.) This should be dynamic, but it shouldn't be LUA. It should be something like JSON. Although Lua is sandboxed, so it's safer that way, it is still an easier and bigger attack vector for hackers than JSON would be.

wereHamster 8y ago
Do you really believe that if Apple wrote their own interpreter for their own custom language that serializes into JSON it would be safer than using one of the battle-tested LUA implementations?
- sbjs 8y ago
  I was suggesting that they don't have executable code at all, that they use static configuration. But it may not be possible within their problem domain, I don't know. I always prefer static solutions until dynamic becomes necessary.
  - crgwbr 8y ago
    Between code signing and sandboxing, this probably isn’t any more dangerous than the JS that Safari downloads and runs every time you open a webpage.
- stcredzero 8y ago
  Lua, not LUA. It's Portugese for moon.
earenndil 8y ago
C gives you technically perfect abstractions, but it's a pita: you have to mess around with unimplemented structs (`typedef struct Bla Bla`, but never actually define Bla in the public interface, and then have functions taking Bla*), and void pointers, which generally makes it significantly less comfortable than in higher-level-languages.

pcwalton 8y ago

Swift has a lot of goals, but having a small compiler isn't one of them as far as I'm aware. Swift has always leaned heavily on compiler heroics :)

mmirate 8y ago
To be fair ... For any given programming task, there is a fixed (minimum) amount of work to do to solve it correctly, and the programmer's design choices merely decide the distribution of that work among the environment, the compiler, the standard library, the third-party libraries, and the programmer herself. Meaning, that in order to use the programmer's time most effectively per unit of task difficulty, the language itself should be such that the compiler does as much work as it possibly can. Such a compiler simply won't be small, and probably won't be fast either. (imho the best it can or should do in the face of a syntactically-valid non-program, is to give as many errors at once as are applicable, so that the programmer can fix them all in one go) Rust, of course, in the grandly oversimplified view, takes this tradeoff in the same direction as Swift, and I'm sure you're familiar with all the ways that Rust is better for it ... and even a few ways that Rust is worse for doing the opposite. :) (Though, then again, there's miri, for those that value correctness over performance. Unless it too has changed names.)
- deleted 8y ago
  [deleted]

woolvalley 8y ago

Swift is more like the next C++ than the next javascript. But is supposed to be easy enough to use that you could use it for a shell script. And the 'shell interpreter' is just compiling and executing your code.

robbyt 8y ago

Or they could do what Google have done, and separate more OS components into applications delivered out of band via the app store, like the browser (Chrome), the keyboard (Gboard), etc. Behavior changes of the os should not be quiet and magical, they should be intentional and the user should be notified (if they care).

JustSomeNobody 8y ago
Apple's goal is to have as many people as possible on the latest version of the OS. It makes support, etc. easier and therefore less expensive. In order to do that, people need to be enticed to update regularly. This comes in the form of updates to Maps, Safari, Emoji, etc.