Re: Survey of lua sandboxes?

[hollyrosella@...]

Thanks, Patrick.  Yes, that's very helpfu.  I found the talk: http://lambda-the-ultimate.org/node/3894

He says about 4 minutes in that lua is not good for numerical computation, which gives me pause.  (I'm checking out numlua.)

He mentions the banking application about 16m51s in.  Is this thread talking about the same application?  http://mail.python.org/pipermail/pypy-dev/2007-February/003558.html  ("I'm currently building a distributing financial trading application that allows users to write trading models in python and lua. I had to introduce lua, since there is no way to completely "secure" user models written in cPython.")

Holly.

On 12/26/2011 at 8:06 PM, Patrick <patrick@spellingbeewinnars.org> wrote:

On 11-12-26 02:44 PM, hollyrosella@hushmail.com wrote:

Hi, everyone.  Is lua used in any applications as a sandbox for untrusted code?  I'm trying to justify my own choice of lua for this purpose, so especially cases where people would really like to break out of the sandbox would be nice to know about .

Holly

Hi Holly

I don't know very much about this myself but I do know that this is one important feature of the language. For instance in this talk:
http://www.stanford.edu/class/ee380/Abstracts/100310.html ( I can't find the video now)

Roberto(Lua's cheif architect) mentioned that python does not have this facility and a bank used Lua to prevent some of the bank programmer's from having deeper access to the system then they should.

Page 49 of Programming in Lua also covers sandboxes

Hope this helps-Patrick