Ah yes, I read about this in a post about Lua sandboxing but have not yet looked into if Elixir Lua has it out of the box or not. Thanks for pointing me to right place in the luerl docs!
sodapopcan
pawoc50825
AndyL
olivermt
olivermt
Its also worth noting that sandboxing io out of luerl (as it can potentially read disk) is trivial with overwriting one single table that holds the io module.
It is a bit weird how Sequin handwaves over this. It is literally a few lines of code vs something they must have sunk hundreds of engineering hours into (and frankly after reading their summary I would still go with luerl I think 
).
At 100microsecs per invocation they would support everything trivially but not have to own the security posture of whitelisted AST. The sandboxing guarantees of luerl seems MUCH stronger than what they write out of their own lib in the article imo.
That said I am not a low level hacker or security expert, so I might also be wrong.
3
sodapopcan
Ugh, you made me realize I’m That Guy who doesn’t post stuff they claimed to have found. On top of it, I’m Extra That Guy because it turns out I only thought I found it. I was watching Robert’s talk while searching and found and interview with Dave L about TV Labs and there was a result for a CodeBEAM duo talk with Robert and not-Dave. So sorry about that. I was just trying to find to actually find it with no luck. If anyone knows how to find it please let us know!
Lua er, I’m just going to call it Lua.ex because luex is actually a thing as well has a quite well-covered module blocklist for its sandbox. I would think you’d probably want to block the os module altogether for a web app as well as coroutine, though I’m not totally sure. I actually don’t know Lua very well. I read the entire book a couple of years ago without doing any of the exercises 
2
davydog187
Thanks for the interest in Lua! Apologies for the confusing name, I wanted it to be easy to write, and it kind of stuck.
I’m happy to answer any questions you may have. I note this in my blog post from yesterday, but Luerl is certainly lacking in the error message and stacktrace department. That is certainly something I hope to improve in the coming months with the help of Robert.
As for sandboxing goes, the underlying implementation of Luerl is still Erlang, so even doing string concatenation via "hello" .. "world" may cause a binary to be allocated. As far as I’m aware, this happens on the heap and is not local to the process, so sandboxing this particular behavior is difficult. One idea I’ve had here is for Luerl to inject tracing instructions into its own VM for measuring these allocations and tracking them in the runtime. There are currently no plans to do this, but I think it would be an interesting path to explore.
As for my conference talk from Code BEAM EU 2024 with Robert, that has not been posted yet.
4
davydog187
One other thing worth mentioning, is that Robert has expressed interest in merging my library into Luerl. I have a few things that I want to agree on with him before this happens, but I am certainly interested in doing so.
As for Dune and Mini-Elixir, I think these are really interesting projects! I’ve chatted with Anthony at Sequin at length about Mini-Elixir, and I am quite interested in experimenting with them.
However, for my use case of using Lua as a compilation target, there are a lot of shortcuts I can take with outputting a object-oriented, mutable language. My hunch is that outputting Elixir would be a much more challenging task due to needing to track variables and propagating state, where with Lua, this can be hidden with method calls, etc.
To that end, I would love to have a different sandboxed language that was readable, an easy compilation target, and had great error messages. I’m not married to Lua, so I’m open to the possibility of switching.
With that being said, I get personal joy out of working on both Lua and Luerl, and I hope to see those libraries improve and grow!
6
sodapopcan
It totally makes sense but a little hard to talk about, lol. Though I joined the discord and read through a bit and it seems like you all don’t have to much trouble there.
This is very good to know and definitely something that would be needed to be solved (within Lua or otherwise) before being used in a web app. Or are they web apps at TV Labs?
I think Lua makes the most sense for an embedded language to be used by anyone, especially people with limited programming knowedlge. There are also like 8 million languages that transpile to Lua. A couple of the most popular ones (fenel and moonscript) are written in Lua, so there would be potentially to allow using those with luerl. I think I saw some talk about that. I was reading all this a couple of nights ago and my memory is fuzzy.
1
