4 ms·
I'm a big fan of Lua, and a big fan of correctness via simplicity, but I worry the author is a little too confident for his own good. Take his sample webserver:
by sharkbot 14y ago
I'm a big fan of Lua, and a big fan of correctness via simplicity, but I worry the author is a little too confident for his own good. Take his sample webserver: http://lua4everything.dyndns.org/ http://lua4everything.dyndns.org/ and the accompanying blog post: http://blog.luaos.net/ http://blog.luaos.net/
That particular example is simple and doesn't permit much room for nefarious actions, but as soon as he adds support for a wider selection of files, POST (and other verbs), caching, templating, authentication and access control, etc, the code will grow in complexity and the advantages of Lua will recede.
For instance, remove the line "isin(path, sources)" and there is a arbitrary file read. White lists are more secure, but they don't scale.
- 32362 14y ago[Whilst I believe the project itself should in general stand based on its own merits, in the spirit of openness...] Also by the same author: - http://article.gmane.org/gmane.comp.lang.lua.general/85887/ http://article.gmane.org/gmane.comp.lang.lua.general/85887/ - http://article.gmane.org/gmane.comp.lang.lua.general/85891/ http://article.gmane.org/gmane.comp.lang.lua.general/85891/ - http://article.gmane.org/gmane.comp.lang.lua.general/85896/ http://article.gmane.org/gmane.comp.lang.lua.general/85896/ - http://article.gmane.org/gmane.comp.lang.lua.general/85886/ http://article.gmane.org/gmane.comp.lang.lua.general/85886/ (I don't want it to seem like I'm cherry-picking stuff out of context, thread: http://thread.gmane.org/gmane.comp.lang.lua.general/85850/ http://thread.gmane.org/gmane.comp.lang.lua.general/85850/ ) - http://article.gmane.org/gmane.comp.lang.lua.general/85938/ http://article.gmane.org/gmane.comp.lang.lua.general/85938/ After this spectacle what interest I had in the project when it was first announced waned. Community around an open-source project is very important, and this is not how to build it. I'd rather see the project forked than deal with someone like this.