Hacker News new | ask | show | jobs
by josephcsible 1565 days ago
While you're right about the binary loadstring issue, that lua-users page is way overly paranoid. The best Lua sandboxing implementation I know of is the one Wikipedia uses, and it allows a lot of what's "unsafe" there.
1 comments

Not really usually to call something "overly paranoid" without going into why you think their evaluation is wrong.
The page is trying to build a sandbox where a lua script can eval other untrusted lua code within the same lua execution environment. Many, even most?, people are only interested in isolating the host application from the lua environment.
Because there's ways to build safe sandboxes that allow untrusted code to use a bunch of things that it calls unsafe.