I’m experimenting with ways to allow backend scripting for a web app. Lua seemed like an obvious choice and I found Lua (an Elixir package with a semi-confusing name) which is built off of Robert Virding’s luerl . Lua (the package) is quite nice in that it’s not just a wrapper. It has a nice API f…

I think that you should consider using Dune with a separate node setup. For example, you can start a separate node where the user scripts are running and these scripts will communicate with main node through some API (REST or maybe just some erlang terms over TCP/socket)

Thanks for the reply! I’m aware of Dune but the idea is to have a more general scripting language for use in a hypothetical product used by mere mortals who would be offended by having to learn a valuable skill like Elixir or FP :slight_smile:

Dave Lucia has talked about extensively using luerl for his product at tvlabs.ai to enable customer scripting. I was present for the codeBEAM talk given by Dave and Robert and the approach is compelling. My takeaway is that it is a good solution.

That makes sense since Dave Lucia is the author of Lua (the package). Thanks! Unfortunately the talk doesn’t seem to be on YouTube, but I’m still looking there. There is one by Robert about luerl which I’m about to watch. Thanks!

Latest elixirpodcast talked about a company making a safe ast thing that let them let people write elixir without fear of getting pwned. I am not sure I would trust that myself tbf, but I think they have published some of that as open source. However a key takeaway they mentioned in the podcast wa…

The talk is codebeam berlin last year about tvlabs. I dont think luerl or lua was in the title.

[image] olivermt: I dont think luerl or lua was in the title. Ah thank you, found it! And thanks, that’s all good info! I should have mentioned that I played with Lua (the package) a bunch before posting and yes, it’s reallllllly easy to pass variables and functions to scripts, sandbox, an…

I think there is academic proof that luerl is unpwnable? I feel that was mentioned somewhere

I’ll seek that out, thank you!

One thing to be on the lookout for luerl’s max_reductions and max_time options. Not only do you want to sandbox certain capabilities, but you likely want to protect against infinite loops and unbounded memory growth, or any other resources that could be exploited. https://github.com/rvirding/luerl/…