One purpose for making Swift was because Objective C is dynamic, and they thought they could get a speed boost by going fully static. The other is because they were having a hard time evolving a C-based language because C is full of plot holes. Swift is meant to be efficient but still allow abstractions, which C is really bad at. (The best you can get with C is leaky abstractions.)

This should be dynamic, but it shouldn't be LUA. It should be something like JSON. Although Lua is sandboxed, so it's safer that way, it is still an easier and bigger attack vector for hackers than JSON would be.

Do you really believe that if Apple wrote their own interpreter for their own custom language that serializes into JSON it would be safer than using one of the battle-tested LUA implementations?

Lua, not LUA. It's Portugese for moon.

I was suggesting that they don't have executable code at all, that they use static configuration. But it may not be possible within their problem domain, I don't know. I always prefer static solutions until dynamic becomes necessary.

Between code signing and sandboxing, this probably isn’t any more dangerous than the JS that Safari downloads and runs every time you open a webpage.

C gives you technically perfect abstractions, but it's a pita: you have to mess around with unimplemented structs (`typedef struct Bla Bla`, but never actually define Bla in the public interface, and then have functions taking Bla*), and void pointers, which generally makes it significantly less comfortable than in higher-level-languages.

Swift has a lot of goals, but having a small compiler isn't one of them as far as I'm aware. Swift has always leaned heavily on compiler heroics :)

To be fair ...

For any given programming task, there is a fixed (minimum) amount of work to do to solve it correctly, and the programmer's design choices merely decide the distribution of that work among the environment, the compiler, the standard library, the third-party libraries, and the programmer herself.

Meaning, that in order to use the programmer's time most effectively per unit of task difficulty, the language itself should be such that the compiler does as much work as it possibly can. Such a compiler simply won't be small, and probably won't be fast either. (imho the best it can or should do in the face of a syntactically-valid non-program, is to give as many errors at once as are applicable, so that the programmer can fix them all in one go)

Rust, of course, in the grandly oversimplified view, takes this tradeoff in the same direction as Swift, and I'm sure you're familiar with all the ways that Rust is better for it ... and even a few ways that Rust is worse for doing the opposite. :)

(Though, then again, there's miri, for those that value correctness over performance. Unless it too has changed names.)

Or they could do what Google have done, and separate more OS components into applications delivered out of band via the app store, like the browser (Chrome), the keyboard (Gboard), etc.

Behavior changes of the os should not be quiet and magical, they should be intentional and the user should be notified (if they care).

Apple's goal is to have as many people as possible on the latest version of the OS. It makes support, etc. easier and therefore less expensive. In order to do that, people need to be enticed to update regularly. This comes in the form of updates to Maps, Safari, Emoji, etc.

Swift is more like the next C++ than the next javascript. But is supposed to be easy enough to use that you could use it for a shell script. And the 'shell interpreter' is just compiling and executing your code.

Or JavaScript.

Presumably both of these have more overhead than Apple wanted in this case, but it does seem odd.

lua is much easier to execute and much easier to sandbox than JS.

I don't see how Lua is easier to sandbox.

I'm a bit surprised at the use of Lua, given that JavaScriptCore is already there. But I wouldn't be surprised if Lua was just something that the team was already familiar with. Lua is tiny, so it's not like it adds a significant dependency.

As you said Luna is tiny, which makes it easier to sandbox. A smaller system with a more limited set of behaviours and features is much easier to test and verify.

I guess, but (1) JavaScript is already there, so using it adds no new attack surface; (2) JS engines get more scrutiny; (3) sandboxing isn't as important anyway since the interpreter only runs trusted code.

There was a topic a few months ago about running JavaScript code in ring 0. People used similar arguments to claim it was safe enough. A v8 engineer chimed in to explain the reality of JavaScript engines.

https://news.ycombinator.com/item?id=17186842

JavaScriptCore has a huge surface area. It is measured in tens of megabytes, whereas Lua is measured in hundreds of kilobytes. Wikipedia chose Lua because it was small enough that they were able to audit every line of code for security. Verisign approached Lua the same way for their high-reliability servers.

Consider the complexity of JavaScriptCore. Their new-ish "FTL" optimization engine stands for "Fourth Tier LLVM", which means there are at least 4 levels of runtime optimizations JSCore performs on code, which is a lot of non-trivial complexity. And JIT means they cannot utilize no-execute bits in hardware.

Then there is the memory and power-consumption. Lua's footprint for a VM instance is tiny. It is also a very efficient language, even in interpreted form. JavaScriptCore is comparatively heavy in both regards.

Remember that Apple Watch still does not have Safari and JavaScriptCore is not available for watchOS developers. Presumably this decision is partly influenced by memory and performance constraints. Lua is trivial to get working well on watchOS.

For a core feature, it makes sense to have minimal dependencies with a minimal footprint so plenty of room is left for user applications. Remember that Apple probably has a bunch of skunkworks devices in their labs they hope to productize someday. And many of these might be tiny portable devices with minimal hardware capabilities, like Apple Watch (or remember all the different iPods?).

Lua's tiny implementation and extreme portability (written in pure ANSI C) make it well suited for this role. Apple won't have to port Lua to every new experimental CPU architecture they try, whereas JavaScriptCore has a lot of platform specific #ifdefs which have to be dealt with for every new platform.

> There was a topic a few months ago about running JavaScript code in ring 0. People used similar arguments to claim it was safe enough. A v8 engineer chimed in to explain the reality of JavaScript engines.

I've worked with SpiderMonkey and have known the team for about a decade now. I'm aware of the complexity :)

> Consider the complexity of JavaScriptCore. Their new-ish "FTL" optimization engine stands for "Fourth Tier LLVM", which means there are at least 4 levels of runtime optimizations JSCore performs on code, which is a lot of non-trivial complexity. And JIT means they cannot utilize no-execute bits in hardware.

FTL is gone, I believe. But anyway, JSC is not just a JIT. If you're worried about the JIT, just use an interpreter.

> Then there is the memory and power-consumption. Lua's footprint for a VM instance is tiny. It is also a very efficient language, even in interpreted form. JavaScriptCore is comparatively heavy in both regards.

JSC uses a hand-written assembly interpreter. I would be shocked if it beat Lua in performance.

> For a core feature, it makes sense to have minimal dependencies with a minimal footprint so plenty of room is left for user applications.

JSC has been shipping since the first version of iOS in 2007. Tons of apps use embedded WebKit already.

> Remember that Apple Watch still does not have Safari and JavaScriptCore is not available for watchOS developers.

This may well be the reason.