When I was a teenager I wrote my first "CMS" and was very proud. A few months later someone called my parents and asked for me. He said he was a developer and found some issues with security. He gave me a few tipps and suggested me some books and left for good. Never talked to hm again but this was so kind and I learned a lot about secure coding after that.
I wrote a "CMS" in college as a project in PHP (really hot then) so you could drag txt files and images into whatever directories and it would create web pages based on that. Professors were not impressed: "why you would want such thing, a MS Access would be better". I was disappointed, but hey, that's life.
I used PHP for so much stuff in the past. Really gave me a good start in large company but in school they teached us Microsoft FrontPage as the way to go tool for websites. Strange days. Hope you went on with your ideas and don't let anyone tell you otherwise.
GET /hello/:world
|> jq: `{ world: .params.world }`
|> handlebars: `<p>hello, {{world}}</p>`
describe "hello, world"
it "calls the route"
when calling GET /hello/world
then status is 200
and output equals `<p>hello, world</p>`
Every headline when I was in college was "App J Sold for a Gizzillion Dollars." So, I figured I would learn programming and join the club. Easier said than done. Nevertheless, I started watching YouTube videos titled "Make a Clone of J."
In hindsight, it was a horrible way to learn. Most YouTubers probably benefited more from clickbait teaching than from actual fundamental teaching. Eventually, I was able to navigate the internet and land on an actual structured curriculum, whose lectures and courses were long and boring but taught you the fundamentals of programming.
I am picking up a similar pattern with Vibe Coding. Beginners are more excited about having a launched product wrapped with a band-aid rather than having deep knowledge.
yep. What makes it good is that it's an easy concept to imagine the use cases, but contains subtle details that covers the breadth and depth to gain the experience you need/want. Getting it wrong is not a death sentence (as long as you quarantine the project to it's own, rather than make it part of your home setup...).
I keep thinking a nice client app that is mostly working against a directory of markdown files that "publishes" to an option of fastly/denoland/cloudflare as mostly-static content would be a pretty nice option.
The blog/data directory can be backed up or even using a github repository for long term raw storage.
I'm not a fan of having the same site/application for rendering as editing the blog as it tends to become too much of a big/easy target... ie: Wordpress, how much internet traffic is script bots trying WP exploits?
Everything web-facing, if it's not a static website delivered by a well-tested web server, happens in a high-risk environment. And doubly so, if, like in this case, stuff like custom cgi libraries are involved. One has to be either very confident in their skills to do that or very, very brave.
My point here is that if someone breaks your blog, they've broken your blog. The blast radius of that should be strictly limited.
Obviously don't go rolling your custom CGI scripts on a server that also hosts your personal email - but these days we are spoiled for choice in terms of isolated hosting strategies for a blog.
Heroku, Vercel, Cloudflare Workers, Fly.io, GitHub Pages, a $5/month VPS...
But "broken your blog" could mean "shell access to your blog server" -- is there no risk of illegal activities happening on that server that put the owner at risk? Like, I don't know, drug trade or child porn or whatever?
Ok. I'll bite. What are the risks? As I see it, if you screw up and someone get root access on your server, it's the worse that may happens and then shut down the whole thing is a click away.
If they do it for money they will install something else and run it in parallel with the blog of the owner of the server. If they are good they'll be lean with resources and not get noticed for months or years. Example: I don't run ps -ef on my server very often and even if I did there are things that can be hidden from ps. It can get complicated.
In any web application all data that comes from the outside world is potentially hostile. A decent web framework takes care of basic security measures, does input sanitation, provides referer checking and csrf for forms, etc. When you roll your own, your _are_ on your own to do that all properly yourself, if you even know all the potential pitfalls. And if you write your own cgi library like the op even more so. I'm not advocating for using WordPress either. I'm advocating for either having a static blog or using a decent, tested web framework or the the very least cgi module that provides tested implementations of common security features that in my experience are typically missed in self-made cgi scripts.
Nah. There are ways to mitigate the blast radius of experiments like this.
You can't utterly wrap developers up in cotton wool. Ultimately, people learn strong lessons from screwing up. You can at least make sure they're doing this learning within a sandbox in which the damage is contained. Like, maybe containerising it so it has limited access to anything that could do any real damage. If somebody builds a blogging app and the worst thing that happens is that they learn the value of sanitising your input, preventing SQL injection, that spam is an unfortunate fact of life, and that you should be very careful with how you manage cookies, I would consider that a _very_ big win for that novice developer.
I am not exactly sure about using containers (most likely you mean docker/podman) as sandboxes...
Please correct me wrong but for a better form of sandboxing, I would recommend something like microvm and the bottlefire thing which was recently shared if that might pique your interest as I found it to be interesting and then using it with something like https://github.com/Zouuup/landrun
There is also tinykvm and other projects too which can simply take a binary and run it and I think that maybe developers should also try out all the different sandboxes and different things just for understanding as well I suppose too. To me, I really like playing with different form of sandboxes or such technologies in general.
Also do note that I am not sure if bottlefire provides sandbox/isolation by default as they mention Sandbox with Landlock seperately so I am now a bit confused if they provide sandbox by default or not as I previously thought it might have.
Sure, there are many ways to achieve the same end of limiting blast radius, but that's not really the point here: the point is that we should dismiss projects like this solely because something might go wrong, especially when there are ways to mitigate against real damage.
Lua 5.1 to 5.2 was a fairly significant breaking change; one that has forked the community to this day with luaJIT never coming on board. 5.2 to 5.3 also broke things with the introduction of integers but mostly at the level of bindings. There is also very little included in terms of standard library and while luarocks exists many significant packages go abandoned. There are breaking language changes in the upcoming 5.5 as well though they are relatively minor.[1]
All to say I think if long term compatibility is the primary goal there are probably better languages.
Sure that's an option, most distros continue to include every lua version back to at least 5.1; and since luaJIT stayed there a lot of the rest of the community did too.
I guess I'm not sure what advantage lua has in that regard: you could stick to an old version of any language, including node, which was called out as being hard to keep up with.
The simple interpreter seems worth a lot. The official one is under 20k lines. There are reimplementations in many other host language (Go,Rust,JS, etc). Meaning it should be possible run Lua code forever without maintaining a full legacy virtual machine OS. I am not sure I can compile Node today, let alone N years from now as compilers and platforms shift.
IIRC Mike Pall (LuaJIT’s “BDFL”, and also the only person who’s ever really worked on it) dislikes some features of newer Lua versions, particularly 5.2’s _ENV.
Fennel looks quite great! And I love Lisp so there is definitely some allure there. I don't use it for mostly the reasons mentioned in OP:
* to minimize dependencies. Lua < Lua + Fennel. I'm more extreme than OP in that I don't even use LuaRocks. When I need a library I copy it in, and I pick a library that won't change often so that is a reasonable approach. I try to avoid native libraries.
* for even greater stability. Fennel is pretty stable, but I use Lua 5.1 for the most part which hasn't changed since 2008 or so. I'm more extreme than OP in even avoiding later versions of Lua.
Bottomline: the reasons I like Lua have nothing to do with syntax and are much more about these operational meta characteristics of the language. If I cared more about syntax I'd be on Fennel in a heartbeat.
I use Lua the same way, without LuaRocks. I use a Makefile to run my programs on Lua 5.1~5.4 and LuaJIT and compare the output files, to ensure portability across versions.
I tried it in the early days but couldn't get it to work on my mac. Also, I'm very familiar with Lua source code and LuaRocks so I chose comfort. Redbean is amazing though and I really want to take it for a spin some day.
I am not sure why one would have to use an engine for this. A blog consist of mostly repetitive list of posts made from a single identical template. Any 10y old kid could just master it enough to write them in html directly. And pandoc is just installed in seconds from any package manager if one wants to use an even easier different markup language. Heck in age of microblogging and social medias most blogs aren't even seeing a new post every week, barely anyone is on dialup anymore[1] and those who do probably won't load images automatically, one could have all their posts in a year on a single html page and just anchor tags. This is certainly the case from the blog linked here.
A shell function is enough to call pandoc, update any kind of index (date or tag based) and an rss page really. I would hardly call that an engine, it is just an helper to not forget to update indexes and feeds.
[1] loading speed was the main reason blog engines used to split posts in single pages
The reason it has an engine is because it also has an interface for me to post and admin stuff. The previous version was generated by scripts (using Racket and not Pandoc) and that made it harder for me to post from devices that were not my own main computer where the source lived. For example, I like posting from my phone.
I use perl for the same reasons. The few dynamic scripts that I need I want to write and forget them for years. Odds are with perl they'll still work 20 years from now.
>I often see wisdom in websites such as Hacker News and Lobsters around the idea of "choosing boring" because it is proven, safe, easier to maintain. I think that boring is not necessarily applicable to my case. I don't find Lua boring at all, but all that those blog posts talk about that kind of mindset are all applicable to my own choices here.
I think what is really meant by choosing boring technology is that it be simple, proven, reliable.
That's the key part. Minimize cognitive load, maximize peace of mind.
Some ecosystems are "boring" in the sense that developers are not excited about them, but they also maximize your blood pressure and chance of shipping defects. That's the wrong kind of boring!
I spend a lot of time blogging but all I use is a ~50 line Python file that converts my markdown pages to HTML, adds my template, and generates the ToC page. Then I push to GitHub Pages.
I can't imagine needing more than that. Why are these blog stacks so complex?
Speaking for myself at least, after you've been blogging for a quarter century or more there are some nice features you might want like pagination of your table-of-contents, RSS feeds (do it, everyone should do it), support for redirects so that ancient links mostly work across those decades (I've kept redirects from like three or four blogging systems now), tags pages for finding lost treasures and silly things. I been on both sides of "needing" comments tools over the decades, similar with things like WebMentions. With so much of blogging on social media WebMentions don't seem that big a deal this decade as it was in the one where every other person (in college) had at least one Blogger.com Blog or LiveJournal and a lot of discussions were cross-links between blogs.
Admittedly most of my blogging history has been something of a path towards simplification from hand-rolled PHP+MySQL, with custom "forum code" markup language, stuff before "blogging" was even an agreed upon term for it (and before Markdown was anywhere near as pervasive), to complex third-party beasts like Drupal, to homegrown Python (and reStructuredText), to very simple SSG tools (these days still Jekyll, but I don't like working in Ruby much, so I keep debating a switch to Lume but I don't think its Redirects plugin is yet compatible enough with GitHub Pages for my liking and I haven't tested its RSS support yet, both of which are personal hard requirements).
I had a similar setup in the past. The current stack can be explained by:
1. I don't want to rely on any external SaaS but my VPS. No github action to rebuild the site or anything like that.
2. I want to be able to post from multiple devices, which means that SSGs add more friction cause I'd need to make sure the source is up to date on all machines I am trying to post. It is not a hard problem, but opening an editor online and posting is much easier. The key to blogging is reducing friction.
I had that thought too. My own blogging engine is ~100 lines of lua that accomplishes the same as you describe, plus RSS, with one additional library for markdown parsing. The author mentions Mustache templates and WebMentions, but ten dependencies still seems like a lot; I wonder what they are.
Many of the dependencies are there to support the posts that are legacy posts coming from my previous SSG. I imported them into the database and they require Yaml and other dynamic features. Some dependencies like gumbo, http, multipart are all there to support indieweb features such as webmentions and micropub.
Why would you build your blog to fail if some article on it ever gets popular? The fact that the most hits you ever received was 50k in a week isn't relevant; a single important post could receive that in seconds.
It basically costs nothing to pre-render a static site, which then serves several orders of magnitude faster. I'm confused why anyone would do it this way in this day and age.
By large I agree, its just common best practices these days. Or at least have some components statically generated like the rss feed.
I know some will go 'oh well I want a web interface to create or edit posts in', nothing says you cant just implement that part dynamic and have it update static components on modification of posts.
I don't have a background in web development and have a genuine question.
> Your blog is your place to experiment and program how you want it
I 100% agree with your statement and people don't need to justify their hobbies. I've done really pointless things simply for lolz and because I wanted.
My question arises because I was surprised in how ... architected and (dare I say) complex the tech stack in your blog is. In my blogging days I wrote my own HTML/CSS and published it on a Internet facing server. Later, I've used CSS templates and Markdown-to-HTML to generate the static content. What is the purpose of Lua and having a database and all the other complexity for what seems like a static blog? Again, "because I wanted to experiment" or "sharpen my skills" is a totally valid answer but seeing I don't have a background in web development I am inquiring to see if there is a technical reason for doing this. Would be curious to learn what, if any, technical problem warrants such a set up :)
Thanks for the questions, let me see if I can address them:
The stack doesn't feel as complex to me because I know it well. Familiarity doesn't make it less complex but make it comfortable. The reason for the database is that it allows me to run queries. It makes it easier for creating "recent posts" and "posts with this tag" pages.
Lua is the glue that ties it all together. Yes, HTML/CSS can be used to create a full site but writing posts in HTML gets tiresome fast when typing on a phone for example. The way it is it has an admin interface that allows me to write markdown on my phone or edit a post. It is handy.
For my own personal projects it is less about technical reasons and more about what will make me happy. What brings the joy on and less about what is the optimal solution.
Why not choose Hugo (https://gohugo.io) or Zola (https://www.getzola.org ?. Both are pretty well-supported by communities and have tonnes of blog themes. (Hugo has a truckload and is the top-3 widely deployed SSG's)
I have used Hugo in the past. I decided against SSG (the previous Racket version was a SSG) because I wanted dynamic features such as having an admin interface that allowed me to post and edit from my phone.
What are your thoughts on something like arturo which I know is quite recent but it has a lot of features for scripting and an argument might in fact be made that it is in fact it might have too many batteries but it was an absolute pleasure to learn and I had a lot of aha moments in their discord server and the community was really pleasant to follow through actually.
I know its definitely smaller but I just want your opinions on it and what you might think of the language and I may be a bit sorry if this comes across as a little off topic but your blog really reminded me of arturo and my attempts on creating something like hugo in arturo but the project was abandoned mid way but if I remember correctly it was just some 50 lines of code to convert from markdown to complete website or even less since arturo's battery include markdown syntax as well as well as a web server and its written in nim which I cherish too.
I am genuinely interested in your opinions about it!
Never heard of Arturo before. Went to their page after reading your comments. Omg, it looks so cute and good. Defo up my alley. I love functional and minimalist languages. Thanks for sharing that.
I might play with it for some project in the future.
I currently run a blog generator I wrote in fennel and have been considering switching to pollen haha. Slightly surprised you didn’t pick fennel over lua since you used racket before. Is there a reason you didn’t?
I absolutely love Pollen. Do it! I switched away from Racket because I wanted less moving parts. With Lua (a language I know better than Racket) I feel I have a better grasp of all the parts. The main reason to switch away was to make the codebase smaller and easier to tinker with, but the pollen version was great.
Fennel is absolutelly amazing, I love it. I just didn't had the need. I like Lua the way it is. I was a student at PUC Rio for a while, I fell in love with it there and am very familiar with it.
I don't know man, every time I tried to learn Lua (to write nvim plugins and HammerSpoon spoons) I disliked the ergonomics of the language. I don't understand why people say it's an easy language—
Perhaps people's tastes vary? I find Lua an easy to use language. Easy to embed into C/C++ projects for scripting purposes. Also great when you can only spare 100 kB or so for an interpreter. (Arguably that was more important in the past.)
Again, tastes. I found Erlang to be one of the easiest languages I ever used. I just immediately "got" it. Unfortunately I've had very few professional opportunities to use it.
There are languages that compile to Lua. Have you investigated those? For example, you can use a TypeScript syntax and pick up free typechecking along the way: https://typescripttolua.github.io/
It all depends on what you been exposed to in the past, right? I find Lua simple because it is a minimalist language in which there are very few things to learn. You can buy "Programming in Lua" for the version you want to use and with a single book you learn about basically all of the language and its internals. That is not the same with some other languages.
>> I don't understand why people say it's an easy language
> I find Lua simple
The comment you've replied to is correct: "easy ≠ simple". Lua is indeed simple, but it chooses simplicity over ease-of-use. For example, even printing the contents of a table requires explicit logic.
OTOH Python, for example, prioritises ease-of-use: `l = [1, 2, 3]; print(l)` does what you'd expect. But Python only achieves this ease at the expense of simplicity: not only does the implementation of `print` need to be more complex, its output can be complex and unpredictable as well - for example, in the case where `l` refers to itself.
Agree, I find it a PITA. I think the good reviews are in contrast to C++ and vimscript. Fine for a small embedded script, but I hope WASM or some better language ecosystem starts to fill this niche.
The 1 indexes are only a difference from what you're used to. Lua was made by mathematicians, who of course wanted to address the first element as 1, the second element as 2, etc.
0-indexing makes sense in the context of C where the index operator is syntactic sugar for pointer arithmetic. In higher-level languages like C# and Python and others, it's pretty much just a leftover habit from C devs that we all got used to.
You are correct that 1-based indexing is the norm among mathematicians, but none of the creators of Lua is a mathematician, AFAIK. You can read about the early history of Lua here:
> The 1 indexes are only a difference from what you're used to
The left handed scissors are only a difference from what you're used to.
> Lua was made by mathematicians
The default value is nil and using nil as an index on a table returns nil. Yet nil + number is not valid and results in a runtime error.
> it's pretty much just a leftover habit from C devs
It's reflective of the fact that these languages are either intended to work with C APIs or are implemented in C itself. This makes writing FFI and extensions _far_ easier than it would be otherwise.
Lua is the scripting language of [Recoil]. I've been writing some fairly complex game code on it for a few years now, I lost a lot of prejudice over time on 1-indexing.
In fact, at least for this application I've come to enjoy its practicality!
I like 1 based indexes and the globals don't hurt me on my projects. It is like JS, it has its own bits that are different than other languages, once you learn them you see that it is mostly fine.
Speaking of unconventional languages for web development, there's also Wt, for people who are used to building things using C++.
I found it surprisingly good and considering how little I know on how to use HTML/CSS/JS/PHP, the usual web stack, it would have taken me months or more to learn how to build an equivalent site using the standard stack (and then have to maintain it).
Of course, if you're already familiar with web development, that's the best way I guess, but for those who aren't and don't have the necessary time to learn, there are probably alternatives using languages they're familiar with.
Mine’s in Python. I took that route when it was a relatively obscure thing and PHP was gaining ground over CGI in Apache (at the time having a Python web server was downright weird) and stuck with it for a long time. These days it’s a purely static site generator and a bit too funky to release (there’s a variant over on https://github.com/rcarmo/sushy) but I really enjoyed maintaining it while it was a small, batteries included environment.
I considered switching to Lua (actually Fennel) but luarocks can be fiddly to use across platforms (I now run everything on ARM servers) and that pretty much was the end of that. So I’m curious as to how maintainable a Lua back-end is over time.
I liked this post, and I can totally understand where you’re coming from…
But couldn’t anything you say about Lua also be said about JS? You mentioned how Lua wasn’t batteries included, so you try to limit your libraries. Couldn’t you say the same for JS? JS itself doesn’t change much, it’s the ecosystem. Couldn’t you just pick out some small and stable libraries the same way you could with Lua?
For me, it isn't 100% language warts. It is the customer experience that matters the most for me. Can I compile and ship my products to my customers without having them to install a VMs, container runtime or a language runtime? That the question that is critical for me.
I agree, I think that you must really like golang and how easy it can make cross compilation and how fast it is to build.
Golang has one of the best developer experiences and there are only very very few minor nitpicks I might have of the language but the whole ecosystem on packaging software and what not is just so easy and I love golang.
I love JS, don't get me wrong, I absolutelly love Javascript. But I love the JS that the browser runs and understands. I hate the current ecosystem of bundlers, transpilers, typescript, npm modules and so on.
Yes, I could have picked a js runtime and done the same thing. The same thing could also have been done with literally any other language.
It is less of a "Only Lua Can Do This" situation and more of a "I Like Working with Lua" situation.
I love the Lua language, has all the nice to have data structures, no need to think about memory management, is straightforward (keep the whole thing in your head easily) and will go forever without changes. Just stick with v5.1.
It’s so cool to take the interpreter source, type make and be using it in one minute.
As a a javascript dev I kinda feel you and agree that the tools are moving faster than most codebases. The thing is though, you don't really have to use that many tools unless you really want to.
You can spin up a node server yourself and use web components and it will run fine probably just as long as the lua code will. It's also way easier today to just use web components and not any framework since LLMs can help you speed up the development.
I am extremelly biased against LLMs so take my opinion with a grain of salt. I opted to run a CGI script instead of spinning my own webserver cause webservers are tricky. I'd rather run something like nginx or caddy. I like nodejs (my preferred JS engine will always be Mozilla's and for the terminal I been favouring Bun) but part of using Lua on my own blog is cause of JS fatigue. I'm exhausted with the JS workflow these days.
I've been thinking of how to make a blog simple recently, and I came across xslt. It looks really cool and seems pretty set in stone, so I thought I'd ask, what are the advantages/drawbacks of making your own tech stack versus xslt? At first glance, it seems perfectly able to handle rss and other simple linking patterns, and pretty much anything can easily be turned into an xml then xslt could be used to generate an html (server-side, or rather writer-side, not like the blog is gonna change) that you serve?
XSL is neat, and it is a functional language, but between XSL and XPath, it is quite verbose. Here's a small section of XSL I use to generate my website (not my blog):
And yes, there is other code I've omitted for brevity. This is used to generate the navigation links for the site. I initially write this ... prior to 2009 (that's when I moved it into git). There have been some minor fixes to the XSL over the years, but it's largely unchanged (for a reason that I hope is obvious). Yes, I still use it, because it still works, and it's for a static website.
I do the same, but I use turboLua to host, because it has great signals support and I have my private web server wired up to all kinds of devices in my environment. TurboLua is one of those under-acknowledged tools that can do so much. Pretty good mustache support too.
I manage to embed lua into my project. https://rapidforge.io its incredible language I don't understand why would you need dsl if you have something like lua to use
LuaJIT bucks the trend of slow-warmup JITs. It is extremely quick to compile and load, and its interpreter is very fast -- faster than the JIT-compiled code from LuaJIT v1 IIRC, and certainly faster than the interpreter of Lua.
It wasn't until LuaJIT that I realized that JIT didn't inherently have to be these slow lumbering beasts that take hundreds of milliseconds just to wake from their slumber.
Yet I've witnessed Lua 5.1 launching faster than luajit for some of my use cases.
My point still stands though. Don't just use LuaJIT thinking it will magically make things faster in all cases. If you are embedding, LuaJIT is a no-brainer. If you are using a stand-alone interpreter, measure if you care about reality.
I'll tell you what, it's a hell of a lot faster starting up than Bash is, but I hear you.
You know what the new interesting hotness might be? Getting the LLM to write wasm (via wat, its textual analog), and running that with https://wazero.io/ , which is astonishingly fast (although still not as fast as luajit for some reason, despite being lower-level), but also gaining multiplatform without recompile in the process
^^ the above combined with caddy git fs to have your md files cloned in memory and refresh every X interval is kind of magical. Git push a new md file and wait X minutes and your website updates.
I'm curious what the rationale is for so many blogs and even some websites these days limiting their content width to this tall-skinny column of text; the OP takes about 1/5 to 1/6 of the screen width on my (4k) display.
A large proportion of users may very well be on mobile, but do we just not do flexible layouts in 2025?
Love the author's mentality. While I would almost definitely not pick Lua (I'd probably pick Go), I like how they arrived at their decision. Nicely done.
I guess it provides less freedom/flexibility on the dev side. You're forced to use LuaJIT, and you're forced to buy into OpenResty's coroutine paradigm where global variables act weird, and stuff like that. Also I bet it doesn't play super nice with LuaRocks.
Totally valid choice to make, but in my opinion OP is missing out. OpenResty is state of the art and has a ton of great libraries embedded in it. It's "batteries included" so to speak, and the batteries are well designed. Yichun Zhang is one of the GOATs, along with Mike Pall. And Roberto, obviously.
While everything you said there is true, it is a matter of taste for me. I prefer working with PUC Lua over LuaJIT. The speed improvement of LuaJIT doesn't matter for me, the only thing I miss from it is the FFI. I wish PUC Lua had the same FFI interface tbh.
Always glad to read histories of Lua in the wild, it certainly is kind of an odd language but its simplicity and embedability makes it for a great choice for a lot of use cases.
I used to like moonscript coffescript-like syntax, but nowadays I mostly like plain lua, though Fennel looks appealing.
You very seldon need to deal with it, most of your iterators are `pairs()` or `ipairs()` anyway. I like 1-based indexing and can deal with 0-based ones without any wart. I don't really get it why people make so much fuss, but then again if you feel it is a big problem, then there are plenty of other options that will suit you better.
You'd get used to it eventually. Many of us had to go the other way. I grew up with BASIC and Wirth languages (Pascal, Modula-2, etc) that were 1-indexed and to this day even after 25, 30 years of working professionally in 0-based indexed languages I still catch myself here and there having to adjust (and whiteboard coding can sometimes throw me off under pressure), but clearly operate just fine.
I worked briefly professionally in Julia a couple years ago, which is 1-indexed, and I found it an easy transition, really. Many scientific computing things are 1-indexed, as Fortran was, too, among other reasons.
My own project is a rewrite / defibrilation of the 1990s LambdaMOO server (https://codeberg.org/timbran/moor/), which had its own OO programming language that was 1-indexed.
It's just not as "weird" as people think, I think it's just a generation of people grew up with C-derived languages and have grown to expect 0 as "normal" when it's really just "accident of history/popularity". I don't think it's objectionable that Lua chose 1-indexing, it is actually more "friendly" to newcomers to programming.
Yeah fair enough. I was speaking more about historic influence. Fortran is still extensively used, but it was more influential 40 years ago than it is now.
I'd argue that you could make the same argument for (almost) every other language instead of Lua and still have the same advantages.
For example, take Javascript. With a runtime like Bun, you would have the primitives to serve some HTTP and talk to SQLite right there in the core. And here's the good news, if you carefully implement only the things that you need for your project, you probably don't need NPM. You can write it all on your own, you can peek at how NPM authors solved the problems you run into, but you still can make it all your own. This would leave you with this amazing retrocompatible language with lots of mindshare to boot.
Really, you don't need that whole ecosystem if you're solving your own problems and are not required to interface with someone else's library. And no one is forcing you to use it.
Or you could take Python, and it has a few single-file web frameworks. You can go with one of them and the standard library a very long way. No one tells you you must use any of FastAPI, Jinja, Flask, Django (anyone remembering Pyramid?), SQLAlchemy...
Or you could write it in Go, SQLite module being your only external dependency. You can even pin your go.mod to a particular version of the compiler so you're not bothered with incompatible changes, or changes at all.
Or, you could whip up Perl... but yeah. CGI.pm and DBD::SQLite are not in the core. And anything else has a litany of CPAN dependencies with their quirks. No, don't whip up Perl.
All I'm saying there's nothing that makes Lua somehow inherently more suited to your philosophy than any other mainstream language. Except maybe to be different. And you're still pulling in 29 luarocks, aren't you?
I miss the days when "implement your own blogging engine" was one of the most popular learning projects for engineers.
We should bring that back! Its such a great way to play around with client- and server-side development options in an almost zero-risk environment.
When I was a teenager I wrote my first "CMS" and was very proud. A few months later someone called my parents and asked for me. He said he was a developer and found some issues with security. He gave me a few tipps and suggested me some books and left for good. Never talked to hm again but this was so kind and I learned a lot about secure coding after that.
I wrote a "CMS" in college as a project in PHP (really hot then) so you could drag txt files and images into whatever directories and it would create web pages based on that. Professors were not impressed: "why you would want such thing, a MS Access would be better". I was disappointed, but hey, that's life.
I used PHP for so much stuff in the past. Really gave me a good start in large company but in school they teached us Microsoft FrontPage as the way to go tool for websites. Strange days. Hope you went on with your ideas and don't let anyone tell you otherwise.
I wrote my own DSL to write my own blogging engine with embedded Lua, jq, mustache, and more:
https://github.com/williamcotton/webpipe
My blog code:
https://github.com/williamcotton/williamcotton.com/blob/mast...
I suppose it's because fewer people have personal web sites these days?
What is the typical learning project these days for beginners of a programming language?
Every headline when I was in college was "App J Sold for a Gizzillion Dollars." So, I figured I would learn programming and join the club. Easier said than done. Nevertheless, I started watching YouTube videos titled "Make a Clone of J."
In hindsight, it was a horrible way to learn. Most YouTubers probably benefited more from clickbait teaching than from actual fundamental teaching. Eventually, I was able to navigate the internet and land on an actual structured curriculum, whose lectures and courses were long and boring but taught you the fundamentals of programming.
I am picking up a similar pattern with Vibe Coding. Beginners are more excited about having a launched product wrapped with a band-aid rather than having deep knowledge.
Maybe the ubiquitous "to do list" app?
Any simple CRUD app should do.
I vote for inventory apps. Books, movies, games, whatever.
Still a good project when one learns a new programming language.
yep. What makes it good is that it's an easy concept to imagine the use cases, but contains subtle details that covers the breadth and depth to gain the experience you need/want. Getting it wrong is not a death sentence (as long as you quarantine the project to it's own, rather than make it part of your home setup...).
I keep thinking a nice client app that is mostly working against a directory of markdown files that "publishes" to an option of fastly/denoland/cloudflare as mostly-static content would be a pretty nice option.
The blog/data directory can be backed up or even using a github repository for long term raw storage.
I'm not a fan of having the same site/application for rendering as editing the blog as it tends to become too much of a big/easy target... ie: Wordpress, how much internet traffic is script bots trying WP exploits?
Everything web-facing, if it's not a static website delivered by a well-tested web server, happens in a high-risk environment. And doubly so, if, like in this case, stuff like custom cgi libraries are involved. One has to be either very confident in their skills to do that or very, very brave.
My point here is that if someone breaks your blog, they've broken your blog. The blast radius of that should be strictly limited.
Obviously don't go rolling your custom CGI scripts on a server that also hosts your personal email - but these days we are spoiled for choice in terms of isolated hosting strategies for a blog.
Heroku, Vercel, Cloudflare Workers, Fly.io, GitHub Pages, a $5/month VPS...
But "broken your blog" could mean "shell access to your blog server" -- is there no risk of illegal activities happening on that server that put the owner at risk? Like, I don't know, drug trade or child porn or whatever?
Anecdotally, I can't remember ever hearing about someone getting in real trouble because their server got popped and someone else used it for crime.
Philosophically: L'État, c'est moi, build your crappy cgi scripts with nginx or apache all from the CLI and all in vim and you will understand.
Practically: Ports 22, 80, and 443 open and directly accessible from 0.0.0.0/0 is extremely manageable.
Why would anyone today leave port 80 open? I do https by default even for my blog.
For me personally it's just old configs I have that redirect from port 80 to 443. You're right though - probably unnecessary in this day and age.
Ok. I'll bite. What are the risks? As I see it, if you screw up and someone get root access on your server, it's the worse that may happens and then shut down the whole thing is a click away.
Yes, if they do it for fun.
If they do it for money they will install something else and run it in parallel with the blog of the owner of the server. If they are good they'll be lean with resources and not get noticed for months or years. Example: I don't run ps -ef on my server very often and even if I did there are things that can be hidden from ps. It can get complicated.
What? Are you serious?
If you roll your own little cgi-bin perl script behind Apache you're far from vulnerable compared to, say, a WordPress website.
In any web application all data that comes from the outside world is potentially hostile. A decent web framework takes care of basic security measures, does input sanitation, provides referer checking and csrf for forms, etc. When you roll your own, your _are_ on your own to do that all properly yourself, if you even know all the potential pitfalls. And if you write your own cgi library like the op even more so. I'm not advocating for using WordPress either. I'm advocating for either having a static blog or using a decent, tested web framework or the the very least cgi module that provides tested implementations of common security features that in my experience are typically missed in self-made cgi scripts.
Nah. There are ways to mitigate the blast radius of experiments like this.
You can't utterly wrap developers up in cotton wool. Ultimately, people learn strong lessons from screwing up. You can at least make sure they're doing this learning within a sandbox in which the damage is contained. Like, maybe containerising it so it has limited access to anything that could do any real damage. If somebody builds a blogging app and the worst thing that happens is that they learn the value of sanitising your input, preventing SQL injection, that spam is an unfortunate fact of life, and that you should be very careful with how you manage cookies, I would consider that a _very_ big win for that novice developer.
Because we're talking about _developers_ here.
I am not exactly sure about using containers (most likely you mean docker/podman) as sandboxes...
Please correct me wrong but for a better form of sandboxing, I would recommend something like microvm and the bottlefire thing which was recently shared if that might pique your interest as I found it to be interesting and then using it with something like https://github.com/Zouuup/landrun
There is also tinykvm and other projects too which can simply take a binary and run it and I think that maybe developers should also try out all the different sandboxes and different things just for understanding as well I suppose too. To me, I really like playing with different form of sandboxes or such technologies in general.
Also do note that I am not sure if bottlefire provides sandbox/isolation by default as they mention Sandbox with Landlock seperately so I am now a bit confused if they provide sandbox by default or not as I previously thought it might have.
Sure, there are many ways to achieve the same end of limiting blast radius, but that's not really the point here: the point is that we should dismiss projects like this solely because something might go wrong, especially when there are ways to mitigate against real damage.
oh my gosh someone got root on your php personal home page
1. nobody cares 2. its not that complicated to write a dynamic web page that isn't going to get pwned
Lua 5.1 to 5.2 was a fairly significant breaking change; one that has forked the community to this day with luaJIT never coming on board. 5.2 to 5.3 also broke things with the introduction of integers but mostly at the level of bindings. There is also very little included in terms of standard library and while luarocks exists many significant packages go abandoned. There are breaking language changes in the upcoming 5.5 as well though they are relatively minor.[1]
All to say I think if long term compatibility is the primary goal there are probably better languages.
Have you already discounted php or perl?
[1] https://www.lua.org/work/doc/manual.html#8
Why stay on the upgrade treadmill? For such a minimal language, are the updates really that compelling?
NeoVim is committing to 5.1 and leaving it at that.
Sure that's an option, most distros continue to include every lua version back to at least 5.1; and since luaJIT stayed there a lot of the rest of the community did too.
I guess I'm not sure what advantage lua has in that regard: you could stick to an old version of any language, including node, which was called out as being hard to keep up with.
The simple interpreter seems worth a lot. The official one is under 20k lines. There are reimplementations in many other host language (Go,Rust,JS, etc). Meaning it should be possible run Lua code forever without maintaining a full legacy virtual machine OS. I am not sure I can compile Node today, let alone N years from now as compilers and platforms shift.
Be aware that Lua doesn't use semver and that versions take many years to be ready. In this page:
https://www.lua.org/versions.html
You can see that between 5.3 and 5.4 there were five years. 5.2 to 5.3 was also a five years gap.
Breaking changes are well documented and we see them years before they happen and nothing requires you to upgrade.
Most code runs on 5.1 forward.
What’s their reason for not using semvar?
Because Lua was created before semver was invented.
Why couldn't LuaJIT support both? Feels like a needless limitation imposed on all its users. I noticed this problem when making plugins for neovim.
IIRC Mike Pall (LuaJIT’s “BDFL”, and also the only person who’s ever really worked on it) dislikes some features of newer Lua versions, particularly 5.2’s _ENV.
I use Lua for almost all my custom tools these days.
https://akkartik.name/freewheeling-apps
https://git.sr.ht/~akkartik/gen_site
Why not Fennel?
Fennel looks quite great! And I love Lisp so there is definitely some allure there. I don't use it for mostly the reasons mentioned in OP:
* to minimize dependencies. Lua < Lua + Fennel. I'm more extreme than OP in that I don't even use LuaRocks. When I need a library I copy it in, and I pick a library that won't change often so that is a reasonable approach. I try to avoid native libraries.
* for even greater stability. Fennel is pretty stable, but I use Lua 5.1 for the most part which hasn't changed since 2008 or so. I'm more extreme than OP in even avoiding later versions of Lua.
Bottomline: the reasons I like Lua have nothing to do with syntax and are much more about these operational meta characteristics of the language. If I cared more about syntax I'd be on Fennel in a heartbeat.
I use Lua the same way, without LuaRocks. I use a Makefile to run my programs on Lua 5.1~5.4 and LuaJIT and compare the output files, to ensure portability across versions.
https://redbean.dev/ could be just perfect fit for you
I tried it in the early days but couldn't get it to work on my mac. Also, I'm very familiar with Lua source code and LuaRocks so I chose comfort. Redbean is amazing though and I really want to take it for a spin some day.
I am not sure why one would have to use an engine for this. A blog consist of mostly repetitive list of posts made from a single identical template. Any 10y old kid could just master it enough to write them in html directly. And pandoc is just installed in seconds from any package manager if one wants to use an even easier different markup language. Heck in age of microblogging and social medias most blogs aren't even seeing a new post every week, barely anyone is on dialup anymore[1] and those who do probably won't load images automatically, one could have all their posts in a year on a single html page and just anchor tags. This is certainly the case from the blog linked here.
A shell function is enough to call pandoc, update any kind of index (date or tag based) and an rss page really. I would hardly call that an engine, it is just an helper to not forget to update indexes and feeds.
[1] loading speed was the main reason blog engines used to split posts in single pages
The reason it has an engine is because it also has an interface for me to post and admin stuff. The previous version was generated by scripts (using Racket and not Pandoc) and that made it harder for me to post from devices that were not my own main computer where the source lived. For example, I like posting from my phone.
PS: I'm the author.
Termux and gitnex have been my friends for posting from my smartphone.
If you want to do inter-page linking and some forms of templating, pandoc can be a complete pain, though.
I use perl for the same reasons. The few dynamic scripts that I need I want to write and forget them for years. Odds are with perl they'll still work 20 years from now.
This. I'm still sitting on some almost core code that's written on an over enthusiastic teenagers idea of a plan.
>I often see wisdom in websites such as Hacker News and Lobsters around the idea of "choosing boring" because it is proven, safe, easier to maintain. I think that boring is not necessarily applicable to my case. I don't find Lua boring at all, but all that those blog posts talk about that kind of mindset are all applicable to my own choices here.
I think what is really meant by choosing boring technology is that it be simple, proven, reliable.
That's the key part. Minimize cognitive load, maximize peace of mind.
Some ecosystems are "boring" in the sense that developers are not excited about them, but they also maximize your blood pressure and chance of shipping defects. That's the wrong kind of boring!
I spend a lot of time blogging but all I use is a ~50 line Python file that converts my markdown pages to HTML, adds my template, and generates the ToC page. Then I push to GitHub Pages.
I can't imagine needing more than that. Why are these blog stacks so complex?
Speaking for myself at least, after you've been blogging for a quarter century or more there are some nice features you might want like pagination of your table-of-contents, RSS feeds (do it, everyone should do it), support for redirects so that ancient links mostly work across those decades (I've kept redirects from like three or four blogging systems now), tags pages for finding lost treasures and silly things. I been on both sides of "needing" comments tools over the decades, similar with things like WebMentions. With so much of blogging on social media WebMentions don't seem that big a deal this decade as it was in the one where every other person (in college) had at least one Blogger.com Blog or LiveJournal and a lot of discussions were cross-links between blogs.
Admittedly most of my blogging history has been something of a path towards simplification from hand-rolled PHP+MySQL, with custom "forum code" markup language, stuff before "blogging" was even an agreed upon term for it (and before Markdown was anywhere near as pervasive), to complex third-party beasts like Drupal, to homegrown Python (and reStructuredText), to very simple SSG tools (these days still Jekyll, but I don't like working in Ruby much, so I keep debating a switch to Lume but I don't think its Redirects plugin is yet compatible enough with GitHub Pages for my liking and I haven't tested its RSS support yet, both of which are personal hard requirements).
TBH RSS feed on a blog should be table stakes.
Preferably with full content unless you're doing some Substack personal branding "subscribe to my paid newsletter" -crap.
I had a similar setup in the past. The current stack can be explained by:
1. I don't want to rely on any external SaaS but my VPS. No github action to rebuild the site or anything like that.
2. I want to be able to post from multiple devices, which means that SSGs add more friction cause I'd need to make sure the source is up to date on all machines I am trying to post. It is not a hard problem, but opening an editor online and posting is much easier. The key to blogging is reducing friction.
Sometimes people just want to have fun
I just write HTML directly (and use GitHub pages)
I had that thought too. My own blogging engine is ~100 lines of lua that accomplishes the same as you describe, plus RSS, with one additional library for markdown parsing. The author mentions Mustache templates and WebMentions, but ten dependencies still seems like a lot; I wonder what they are.
The dependencies are
Many of the dependencies are there to support the posts that are legacy posts coming from my previous SSG. I imported them into the database and they require Yaml and other dynamic features. Some dependencies like gumbo, http, multipart are all there to support indieweb features such as webmentions and micropub.Author of the blog here in case anyone has questions.
Why would you build your blog to fail if some article on it ever gets popular? The fact that the most hits you ever received was 50k in a week isn't relevant; a single important post could receive that in seconds.
It basically costs nothing to pre-render a static site, which then serves several orders of magnitude faster. I'm confused why anyone would do it this way in this day and age.
By large I agree, its just common best practices these days. Or at least have some components statically generated like the rss feed.
I know some will go 'oh well I want a web interface to create or edit posts in', nothing says you cant just implement that part dynamic and have it update static components on modification of posts.
People like to tinker. It's fine. If it blows up one time, then decide what to do from there.
I don't have a background in web development and have a genuine question.
> Your blog is your place to experiment and program how you want it
I 100% agree with your statement and people don't need to justify their hobbies. I've done really pointless things simply for lolz and because I wanted.
My question arises because I was surprised in how ... architected and (dare I say) complex the tech stack in your blog is. In my blogging days I wrote my own HTML/CSS and published it on a Internet facing server. Later, I've used CSS templates and Markdown-to-HTML to generate the static content. What is the purpose of Lua and having a database and all the other complexity for what seems like a static blog? Again, "because I wanted to experiment" or "sharpen my skills" is a totally valid answer but seeing I don't have a background in web development I am inquiring to see if there is a technical reason for doing this. Would be curious to learn what, if any, technical problem warrants such a set up :)
Thanks for the questions, let me see if I can address them:
The stack doesn't feel as complex to me because I know it well. Familiarity doesn't make it less complex but make it comfortable. The reason for the database is that it allows me to run queries. It makes it easier for creating "recent posts" and "posts with this tag" pages.
Lua is the glue that ties it all together. Yes, HTML/CSS can be used to create a full site but writing posts in HTML gets tiresome fast when typing on a phone for example. The way it is it has an admin interface that allows me to write markdown on my phone or edit a post. It is handy.
For my own personal projects it is less about technical reasons and more about what will make me happy. What brings the joy on and less about what is the optimal solution.
Does that makes sense?
Absolutely! Thank you for taking time and replying.
Why not choose Hugo (https://gohugo.io) or Zola (https://www.getzola.org ?. Both are pretty well-supported by communities and have tonnes of blog themes. (Hugo has a truckload and is the top-3 widely deployed SSG's)
I have used Hugo in the past. I decided against SSG (the previous Racket version was a SSG) because I wanted dynamic features such as having an admin interface that allowed me to post and edit from my phone.
What are your thoughts on something like arturo which I know is quite recent but it has a lot of features for scripting and an argument might in fact be made that it is in fact it might have too many batteries but it was an absolute pleasure to learn and I had a lot of aha moments in their discord server and the community was really pleasant to follow through actually.
I know its definitely smaller but I just want your opinions on it and what you might think of the language and I may be a bit sorry if this comes across as a little off topic but your blog really reminded me of arturo and my attempts on creating something like hugo in arturo but the project was abandoned mid way but if I remember correctly it was just some 50 lines of code to convert from markdown to complete website or even less since arturo's battery include markdown syntax as well as well as a web server and its written in nim which I cherish too.
I am genuinely interested in your opinions about it!
https://arturo-lang.io/
Took a while to find examples:
https://arturo-lang.io/documentation/in-a-nutshell/
It looks interesting.
Never heard of Arturo before. Went to their page after reading your comments. Omg, it looks so cute and good. Defo up my alley. I love functional and minimalist languages. Thanks for sharing that.
I might play with it for some project in the future.
I currently run a blog generator I wrote in fennel and have been considering switching to pollen haha. Slightly surprised you didn’t pick fennel over lua since you used racket before. Is there a reason you didn’t?
I absolutely love Pollen. Do it! I switched away from Racket because I wanted less moving parts. With Lua (a language I know better than Racket) I feel I have a better grasp of all the parts. The main reason to switch away was to make the codebase smaller and easier to tinker with, but the pollen version was great.
Fennel is absolutelly amazing, I love it. I just didn't had the need. I like Lua the way it is. I was a student at PUC Rio for a while, I fell in love with it there and am very familiar with it.
I don't know man, every time I tried to learn Lua (to write nvim plugins and HammerSpoon spoons) I disliked the ergonomics of the language. I don't understand why people say it's an easy language—
Perhaps people's tastes vary? I find Lua an easy to use language. Easy to embed into C/C++ projects for scripting purposes. Also great when you can only spare 100 kB or so for an interpreter. (Arguably that was more important in the past.)
For me it is a much easier language than, say, Erlang.
Again, tastes. I found Erlang to be one of the easiest languages I ever used. I just immediately "got" it. Unfortunately I've had very few professional opportunities to use it.
Erlang has multiple higher level barrier of entries than other languages. For starting, its syntax.
but Erlang isn't a scripting language, it's a full-blown language with a rich ecosystem and framework (BEAM).
Lua is also a full blown language, with an ecosystem as well.
Perhaps the road block that you've run into is because you've been treating it as just a scripting language.
There are languages that compile to Lua. Have you investigated those? For example, you can use a TypeScript syntax and pick up free typechecking along the way: https://typescripttolua.github.io/
There's also the venerable MoonScript: https://moonscript.org/
And YueScript, a personal fave: https://yuescript.org/doc/
A whole list: https://github.com/hengestone/lua-languages
Don't forget Fennel, if you are a Lisp lover!
I would suggest using it to add scripting functionality to your own C or C++ project. That's when it really clicked for me.
When you're doing stuff in nvim or HammerSpoon, you're dealing with someone else's interface and the decisions that they've made.
It all depends on what you been exposed to in the past, right? I find Lua simple because it is a minimalist language in which there are very few things to learn. You can buy "Programming in Lua" for the version you want to use and with a single book you learn about basically all of the language and its internals. That is not the same with some other languages.
>> I don't understand why people say it's an easy language
> I find Lua simple
The comment you've replied to is correct: "easy ≠ simple". Lua is indeed simple, but it chooses simplicity over ease-of-use. For example, even printing the contents of a table requires explicit logic.
OTOH Python, for example, prioritises ease-of-use: `l = [1, 2, 3]; print(l)` does what you'd expect. But Python only achieves this ease at the expense of simplicity: not only does the implementation of `print` need to be more complex, its output can be complex and unpredictable as well - for example, in the case where `l` refers to itself.
Agree, I find it a PITA. I think the good reviews are in contrast to C++ and vimscript. Fine for a small embedded script, but I hope WASM or some better language ecosystem starts to fill this niche.
I absolutely love Lua. It’s like scheme without the ((())((((()(((())))( noise.
It really depends. I learned Lua in order to contribute to kulala plugin for neovim and found the language nice and easy to learn.
Of course it has its warts, but given the topic, almost everything is better than a vimscript imho.
The thing that always sticks out to me with Lua is the and/or operators. It's such a minor thing but the way they are used drives me absolutely nuts.
it's easy, but the 1 indexes and global by default suck
The 1 indexes are only a difference from what you're used to. Lua was made by mathematicians, who of course wanted to address the first element as 1, the second element as 2, etc.
0-indexing makes sense in the context of C where the index operator is syntactic sugar for pointer arithmetic. In higher-level languages like C# and Python and others, it's pretty much just a leftover habit from C devs that we all got used to.
Global by default is a perpetual issue, agreed.
You are correct that 1-based indexing is the norm among mathematicians, but none of the creators of Lua is a mathematician, AFAIK. You can read about the early history of Lua here:
https://www.lua.org/history.html
> The 1 indexes are only a difference from what you're used to
The left handed scissors are only a difference from what you're used to.
> Lua was made by mathematicians
The default value is nil and using nil as an index on a table returns nil. Yet nil + number is not valid and results in a runtime error.
> it's pretty much just a leftover habit from C devs
It's reflective of the fact that these languages are either intended to work with C APIs or are implemented in C itself. This makes writing FFI and extensions _far_ easier than it would be otherwise.
And a lot of the time it makes the syntax more compact than it would be with 0-indexing.
I don't feel that strongly for or against either way of indexing though, they both have their pros and cons.Perl is usually used with the first element being zero and the same loop would be
Whatever you're feeling is not in starting at one.Lua is the scripting language of [Recoil]. I've been writing some fairly complex game code on it for a few years now, I lost a lot of prejudice over time on 1-indexing.
In fact, at least for this application I've come to enjoy its practicality!
Recoil: https://beyond-all-reason.github.io/RecoilEngine
I wrote about this in:
https://andregarzia.com/2021/01/lua-a-misunderstood-language...
I like 1 based indexes and the globals don't hurt me on my projects. It is like JS, it has its own bits that are different than other languages, once you learn them you see that it is mostly fine.
Lua 5.5 will change the way global variables work: AFAICT you’ll be able to opt out of global-by-default
Too bad the Lua ecosystem is split between 5.4 and 5.1 due to LuaJIT.
I’ve never understood what people like about it
Speaking of unconventional languages for web development, there's also Wt, for people who are used to building things using C++.
I found it surprisingly good and considering how little I know on how to use HTML/CSS/JS/PHP, the usual web stack, it would have taken me months or more to learn how to build an equivalent site using the standard stack (and then have to maintain it).
Of course, if you're already familiar with web development, that's the best way I guess, but for those who aren't and don't have the necessary time to learn, there are probably alternatives using languages they're familiar with.
Mine’s in Python. I took that route when it was a relatively obscure thing and PHP was gaining ground over CGI in Apache (at the time having a Python web server was downright weird) and stuck with it for a long time. These days it’s a purely static site generator and a bit too funky to release (there’s a variant over on https://github.com/rcarmo/sushy) but I really enjoyed maintaining it while it was a small, batteries included environment.
I considered switching to Lua (actually Fennel) but luarocks can be fiddly to use across platforms (I now run everything on ARM servers) and that pretty much was the end of that. So I’m curious as to how maintainable a Lua back-end is over time.
Having run Lua on a GameBoy Advance, not that fiddly. At worst, compile it all yourself.
Targeting a specific platform is easy. Making sure your luarocks builds work across different Linux distros and architectures, not so much...
Absolutely agree.
But... For dev work on my own server? I am targeting a specific platform.
Yes, but if you develop on one arch/distro and deploy in another...
I liked this post, and I can totally understand where you’re coming from…
But couldn’t anything you say about Lua also be said about JS? You mentioned how Lua wasn’t batteries included, so you try to limit your libraries. Couldn’t you say the same for JS? JS itself doesn’t change much, it’s the ecosystem. Couldn’t you just pick out some small and stable libraries the same way you could with Lua?
For me, it isn't 100% language warts. It is the customer experience that matters the most for me. Can I compile and ship my products to my customers without having them to install a VMs, container runtime or a language runtime? That the question that is critical for me.
I agree, I think that you must really like golang and how easy it can make cross compilation and how fast it is to build.
Golang has one of the best developer experiences and there are only very very few minor nitpicks I might have of the language but the whole ecosystem on packaging software and what not is just so easy and I love golang.
This is the primary reason Lua is interesting to me. As high level as JS/Python but embeddable.
Only problem is I have language ADHD. I use way too many to pick up another like Lua.
I love JS, don't get me wrong, I absolutelly love Javascript. But I love the JS that the browser runs and understands. I hate the current ecosystem of bundlers, transpilers, typescript, npm modules and so on.
Yes, I could have picked a js runtime and done the same thing. The same thing could also have been done with literally any other language.
It is less of a "Only Lua Can Do This" situation and more of a "I Like Working with Lua" situation.
I love the Lua language, has all the nice to have data structures, no need to think about memory management, is straightforward (keep the whole thing in your head easily) and will go forever without changes. Just stick with v5.1.
It’s so cool to take the interpreter source, type make and be using it in one minute.
Just write the blog.
(For years now I publish with Hugo/Bunny CDN ($1/month))
I from time to time wonder if I should write my own engine. Then I laugh and write a blog post.
As a a javascript dev I kinda feel you and agree that the tools are moving faster than most codebases. The thing is though, you don't really have to use that many tools unless you really want to.
You can spin up a node server yourself and use web components and it will run fine probably just as long as the lua code will. It's also way easier today to just use web components and not any framework since LLMs can help you speed up the development.
I am extremelly biased against LLMs so take my opinion with a grain of salt. I opted to run a CGI script instead of spinning my own webserver cause webservers are tricky. I'd rather run something like nginx or caddy. I like nodejs (my preferred JS engine will always be Mozilla's and for the terminal I been favouring Bun) but part of using Lua on my own blog is cause of JS fatigue. I'm exhausted with the JS workflow these days.
I've been thinking of how to make a blog simple recently, and I came across xslt. It looks really cool and seems pretty set in stone, so I thought I'd ask, what are the advantages/drawbacks of making your own tech stack versus xslt? At first glance, it seems perfectly able to handle rss and other simple linking patterns, and pretty much anything can easily be turned into an xml then xslt could be used to generate an html (server-side, or rather writer-side, not like the blog is gonna change) that you serve?
XSLT might be removed from the HTML spec soon, see discussion here: https://news.ycombinator.com/item?id=44952185
that would be client side if it happens, though, I'm talking about server side generation
xsltproc was preinstalled on my machine actually, the fact I could just run it without installing anything is pretty cool
XSL is neat, and it is a functional language, but between XSL and XPath, it is quite verbose. Here's a small section of XSL I use to generate my website (not my blog):
And yes, there is other code I've omitted for brevity. This is used to generate the navigation links for the site. I initially write this ... prior to 2009 (that's when I moved it into git). There have been some minor fixes to the XSL over the years, but it's largely unchanged (for a reason that I hope is obvious). Yes, I still use it, because it still works, and it's for a static website.I do the same, but I use turboLua to host, because it has great signals support and I have my private web server wired up to all kinds of devices in my environment. TurboLua is one of those under-acknowledged tools that can do so much. Pretty good mustache support too.
I manage to embed lua into my project. https://rapidforge.io its incredible language I don't understand why would you need dsl if you have something like lua to use
LuaJIT is awesome.
I've been converting my Bash scripts/functions to it, with much success thus far.
You may want to benchmark lua versus luajit if you are writing scripts or other short-lived programs.
JIT-compiled languages aren't generally faster in starting up, they generally are used to speed up long-lived programs that have hot sections.
LuaJIT bucks the trend of slow-warmup JITs. It is extremely quick to compile and load, and its interpreter is very fast -- faster than the JIT-compiled code from LuaJIT v1 IIRC, and certainly faster than the interpreter of Lua.
It wasn't until LuaJIT that I realized that JIT didn't inherently have to be these slow lumbering beasts that take hundreds of milliseconds just to wake from their slumber.
Yet I've witnessed Lua 5.1 launching faster than luajit for some of my use cases.
My point still stands though. Don't just use LuaJIT thinking it will magically make things faster in all cases. If you are embedding, LuaJIT is a no-brainer. If you are using a stand-alone interpreter, measure if you care about reality.
> If you are embedding, LuaJIT is a no-brainer. If you are using a stand-alone interpreter, measure if you care about reality.
This seems backwards. Lua is easier to embed and luajit is just as easy to install standalone and has zero downsides.
> zero downsides
I just said that I have measured it being slower in at least some use cases.
JIT gains better when already compiled paths run repeatedly. Most long running programs embedding Lua will choose luajit for this reason.
I don't care what people use, the point is that JIT compilation isn't magic that makes everything faster. The way to know is measure.
I'll tell you what, it's a hell of a lot faster starting up than Bash is, but I hear you.
You know what the new interesting hotness might be? Getting the LLM to write wasm (via wat, its textual analog), and running that with https://wazero.io/ , which is astonishingly fast (although still not as fast as luajit for some reason, despite being lower-level), but also gaining multiplatform without recompile in the process
You could also do something like this, have Caddy webserver parse your md files through a template
https://github.com/dbohdan/caddy-markdown-site/blob/master/C...
^^ the above combined with caddy git fs to have your md files cloned in memory and refresh every X interval is kind of magical. Git push a new md file and wait X minutes and your website updates.
https://github.com/mohammed90/caddy-git-fs
====
Or a one-file FastHTML (python web framework) solution:
https://gist.github.com/simonMoisselin/f63c52f087704c99b6a62...
I'm curious what the rationale is for so many blogs and even some websites these days limiting their content width to this tall-skinny column of text; the OP takes about 1/5 to 1/6 of the screen width on my (4k) display.
A large proportion of users may very well be on mobile, but do we just not do flexible layouts in 2025?
> Your blog is your place to experiment and program how you want it.
I guess this is his why ;-)
Love the author's mentality. While I would almost definitely not pick Lua (I'd probably pick Go), I like how they arrived at their decision. Nicely done.
thank you! Go is such a nice language (but then again, I love Pascal so Go feels quite familiar).
glad to see cgi being loved again
Kinda curious why you did not go with OpenResty?
I guess it provides less freedom/flexibility on the dev side. You're forced to use LuaJIT, and you're forced to buy into OpenResty's coroutine paradigm where global variables act weird, and stuff like that. Also I bet it doesn't play super nice with LuaRocks.
Totally valid choice to make, but in my opinion OP is missing out. OpenResty is state of the art and has a ton of great libraries embedded in it. It's "batteries included" so to speak, and the batteries are well designed. Yichun Zhang is one of the GOATs, along with Mike Pall. And Roberto, obviously.
While everything you said there is true, it is a matter of taste for me. I prefer working with PUC Lua over LuaJIT. The speed improvement of LuaJIT doesn't matter for me, the only thing I miss from it is the FFI. I wish PUC Lua had the same FFI interface tbh.
It does. https://github.com/q66/cffi-lua
One of these days I'll port OpenResty to use PUC Lua and this FFI.
Why not go with redbean?
on the very early releases, I couldn't get it work well. I know it works well now and may take it for a spin again.
Can the redbean webserver dynamically parse markdown?
I am more familiar with Caddy and The way OpenResty uses Lua was never very clear to me in my cursory 40 minutes attempt to use it.
waldium can be good for blogs if you dont want to do a custom build. its geo-specific though
ha - I'm well behind you trying to get my blog from Mullenweg hell to pure Raku
Always glad to read histories of Lua in the wild, it certainly is kind of an odd language but its simplicity and embedability makes it for a great choice for a lot of use cases.
I used to like moonscript coffescript-like syntax, but nowadays I mostly like plain lua, though Fennel looks appealing.
I worked with Lua for awhile but never got over the 1-based indexing.
You very seldon need to deal with it, most of your iterators are `pairs()` or `ipairs()` anyway. I like 1-based indexing and can deal with 0-based ones without any wart. I don't really get it why people make so much fuss, but then again if you feel it is a big problem, then there are plenty of other options that will suit you better.
You'd get used to it eventually. Many of us had to go the other way. I grew up with BASIC and Wirth languages (Pascal, Modula-2, etc) that were 1-indexed and to this day even after 25, 30 years of working professionally in 0-based indexed languages I still catch myself here and there having to adjust (and whiteboard coding can sometimes throw me off under pressure), but clearly operate just fine.
I worked briefly professionally in Julia a couple years ago, which is 1-indexed, and I found it an easy transition, really. Many scientific computing things are 1-indexed, as Fortran was, too, among other reasons.
My own project is a rewrite / defibrilation of the 1990s LambdaMOO server (https://codeberg.org/timbran/moor/), which had its own OO programming language that was 1-indexed.
It's just not as "weird" as people think, I think it's just a generation of people grew up with C-derived languages and have grown to expect 0 as "normal" when it's really just "accident of history/popularity". I don't think it's objectionable that Lua chose 1-indexing, it is actually more "friendly" to newcomers to programming.
As Fortran is, not was.
Yeah fair enough. I was speaking more about historic influence. Fortran is still extensively used, but it was more influential 40 years ago than it is now.
I'd argue that you could make the same argument for (almost) every other language instead of Lua and still have the same advantages.
For example, take Javascript. With a runtime like Bun, you would have the primitives to serve some HTTP and talk to SQLite right there in the core. And here's the good news, if you carefully implement only the things that you need for your project, you probably don't need NPM. You can write it all on your own, you can peek at how NPM authors solved the problems you run into, but you still can make it all your own. This would leave you with this amazing retrocompatible language with lots of mindshare to boot.
Really, you don't need that whole ecosystem if you're solving your own problems and are not required to interface with someone else's library. And no one is forcing you to use it.
Or you could take Python, and it has a few single-file web frameworks. You can go with one of them and the standard library a very long way. No one tells you you must use any of FastAPI, Jinja, Flask, Django (anyone remembering Pyramid?), SQLAlchemy...
Or you could write it in Go, SQLite module being your only external dependency. You can even pin your go.mod to a particular version of the compiler so you're not bothered with incompatible changes, or changes at all.
Or, you could whip up Perl... but yeah. CGI.pm and DBD::SQLite are not in the core. And anything else has a litany of CPAN dependencies with their quirks. No, don't whip up Perl.
All I'm saying there's nothing that makes Lua somehow inherently more suited to your philosophy than any other mainstream language. Except maybe to be different. And you're still pulling in 29 luarocks, aren't you?
[dead]
tl;dr: because no one uses Lua
That’s obviously not true.