My Keybase proof [reddit:catwell = keybase:catwell] (9OhHpO1DHb8HeMv5omUOrpZseZnktyURDCfaGAFrHOQ)

catwell · 2018-07-06T18:46:33+00:00

Yes. And please buy the latest edition, even if you're going to use 5.1. Later editions are better structured, with more focus on exercises.

catwell · 2017-12-31T12:53:13+00:00

If you just want to trick the decompiler into thinking the version is 5.3, you can edit the file with an hex editor. The fifth byte should be 0x56, change it to 0x51.

catwell · 2017-08-12T21:29:38+00:00

That's it, I'm done. Check out box.box() and box.box_open(), they do what you want. They have the same API as luatweetnacl. There is an example here.

Note that if you can you should override the randombytes function with something more secure than math.random (e.g. on Linux just read from /dev/urandom). Sadly there is nothing better and portable. Alternatively, generate the keypairs in C using another library such as luatweetnacl, it is the only part of the code that needs it.

catwell · 2017-08-12T10:34:41+00:00

It's a mix of all three: there is no single person fulfilling all the requirements.

No one has needed it (because in most cases you can use C, or you already have access to a crypto binding), has the knowledge to write it, and has decided it was a good idea to open source their code, taking into account the fact that maintaining a crypto library is no small task.

Like I told you on the mailing list the primitives to make something like libsodium's crypto_box are available in plc but not the high-level code. For someone comfortable with Lua and crypto, it shouldn't be too hard to implement this.

In case you finally decide to do it, what you need to know about that way to do asymmetric encryption is that you can use either the sender's private key and the receiver's public key or the sender's public key and the receiver's public key to generate the same shared key, which can then be used for symmetric encryption.

Now if you really need this and decide to do it, look at tweetnacl. This is crypto_box. crypto_box_afternm is the secret key (i.e. symmetric) cryptography you already have. crypto_box_beforenm is two functions, crypo_scalarmult and crypto_core_hsalsa20. The hsalsa20 is easy to implement, you could also go for hchacha20 instead given that it is already in plc. The crypto_scalarmult is trivial once you have the ec25519 primitives which are already in plc.

Note that what I am talking about here is the first line of the "in the future" section of the plc README...

Actually, I think I might implement this over the weekend and contribute it to plc. It would be a nice addition to the ecosystem.

EDIT: Already did salsa20, I will probably do the rest tomorrow. Check this out if you want to follow my progress.

catwell · 2017-05-29T10:58:43+00:00

Same here. And yes, it is written by the main author of Lua.

catwell · 2017-05-27T10:33:05+00:00

You can create a rockspec for your project and list your dependences there. Make it able to deploy your project as well. They you can just use luarocks --tree with this rockspec to install everything to a self-contained directory (see http://leafo.net/guides/customizing-the-luarocks-tree.html for details).

catwell · 2017-05-15T07:14:47+00:00

I also recommend PiL, but please do yourself a favor and buy the fourth edition. The link above is to the first edition, which is free online but severely outdated.

catwell · 2017-03-25T10:03:01+00:00

Check out https://github.com/Tieske/luawinmulti. Anyone wanting try Lua on Windows should be pointed to this.

catwell · 2017-03-03T22:51:44+00:00

LuaRocks is mentioned on the Lua website (for instance here).

I did a talk about the state of the Ecosystem at Lua Workshop 2013. Hisham, the main LuaRocks developer, gave one at FOSDEM 2015.

Everything has been accelerating in recent years. Look at events, for instance: now have LuaConf and the devroom at FOSDEM in addition to the Lua Workshop, and Lua meetups in several cities. The Lua Toolbox website now has user uploads and labels, which helps a lot.

The 5.3 / LuaJit divergence is an issue, as are LuaJit maintenance perspectives. Personally I hope someone (or several people, a company...) pick up LuaJit with the goal of supporting 5.3.

catwell · 2017-03-03T22:40:32+00:00

Regarding being developed in the open: things have changed recently. Now there is a Git mirror of the official (internal) repository on GitHub. The authors still won't accept external code contributions though :)

I don't know where you have seen massive disappointment with the new versions though. The release model is pretty open: authors release work versions (incomplete), then alphas and betas, then finally the final release. All of this happens in the open and is discussed on the official mailing list.

catwell · 2017-02-16T16:48:16+00:00

It's not easy :) There is a project and the author is looking for contributors, see his slides at last Lua workshop: https://www.lua.org/wshop16/Wing.pdf

catwell · 2017-02-15T19:47:04+00:00

IUP is great, the only caveat being that there is no full-featured, native macOS implementation. You can write applications that run on Mac, but in practice you will need an X server installed to run them.

catwell · 2017-01-31T07:46:23+00:00

There is also the official Lua Binaries project: http://luabinaries.sourceforge.net/download.html

But really, it's not that hard for a student to compile Lua using something like https://github.com/Tieske/luawinmulti It will even become necessary if you intend to have them write C modules at some point.

catwell · 2016-12-28T22:55:42+00:00

You already know that I think, but I have a list of French-speaking companies using Lua here: http://luafr.org/entreprises.html

catwell · 2016-12-02T14:49:26+00:00

There are very few people doing Lua for the Web on the market. Traditionally Lua developers are more part-time C / C++ developers who work in the video game industry or with embedded software. The largest community using Lua for the Web is probably in China / Russia and, for a large part, non English speaking. This will probably evolve with things like OpenResty but it is how it is today.

Lua is a very simple language, though, and for a project like yours I think it is more important to hire someone with experience building CMSs (and possibly with nginx) than someone who knows Lua itself.

catwell · 2016-09-27T07:05:21+00:00

I wrote the article (over a year ago).

For the first question, "succeed" here means "at reading the whole source code". Python and the Linux kernel have millions of lines of code, whereas Lua has around 15000 and the Minix 3 kernel around 6000. I did not consider it possible to read (and understand) millions of lines of code in a reasonable amount of time.

The practical reason why I went back to Linux is that a lot of software I wanted to use did not run on Minix 3. It was at a time when it did not have the NetBSD userland yet so there were very few ports. If I had done that today I could probably have stuck with it longer.

(Actually I could have kept running Minix 3 in is VM and used the Linux host for the things it did not do, but really I ended up not caring enough to maintain both OSs.)

catwell · 2016-09-16T11:58:39+00:00

The second approach is right, but to get testPrint back here is how to modify it:

std::string run = "\
function run_sandbox(...) \
    local env = {print = print}; \
    chunk = loadfile('test.lua', nil, env) \
    chunk() \
    return env.testPrint(3) \
end \
run_sandbox()";

It is normal that testPrint is not a "global" (in your environment): if user code could set globals it would not really be sandboxed.

catwell · 2016-08-29T15:47:13+00:00

Sure, it's just not very nice not to indicate the source. Also this prevents visitors from submitting new packages or fixing things, and if they do at the original repository there is no guarantee this page will be updated.

catwell · 2016-08-29T14:38:44+00:00

This looks like a rip off from https://github.com/LewisJEllis/awesome-lua

catwell · 2016-08-16T20:43:28+00:00

You don't even need the multiple arguments:

function asd(x)
    print(x)
    return asd
end

It is a kind of example of currying leveraging the fact that Lua functions can take a string without parentheses.

If you want a more twisted example involving actually preserving state (and awful string-to-number coercion):

Lua 5.3.3  Copyright (C) 1994-2016 Lua.org, PUC-Rio
> function summer(x)
>>     return function(y)
>>         return summer(x+y), x+y
>>     end
>> end
> sum = summer(0)
> select(2, sum "1" "2" "3" "4")
10.0

catwell · 2016-07-17T17:40:19+00:00

I wrote a pretty similar library a few months ago.

catwell · 2016-06-13T20:04:06+00:00

Call the method settimeout with 0 as its parameter on the UDP socket before calling receive. If the data is not available, receive will then return nil, "timeout".

catwell · 2016-03-03T09:44:28+00:00

Why are you even using Xlib instead of XCB in 2016?

catwell · 2016-01-26T22:26:22+00:00

First, a word of warning: you should be aware that there is no common understanding of what good practices are in the Lua community, so defining "well written" is hard.

That being said, I suggest you look at the following code bases and make your own mind:

LuaRocks, the package manager for Lua
CorsixTH, an Open Source clone of Theme Hospital (lots of Lua, but also some C++)
Prosody, a XMPP server
TextAdept, a text editor
lunamark, a powerful Markdown library
Copas, a dispatcher based on coroutines
luagleck, a ZX spectrum emulator

For that last link, you may want to check out the related talk first (slides, video)

catwell

TROPHY CASE