It's sort of been the case on Wikipedia already, but until now via a pretty crufty, home-grown templating system. Most people thought of it as a mere templating system, but it had #if/#else constructs for conditional inclusion, and some similar features, so you could program in it, if you tried hard enough (and some people did).

The good thing about Lua is that you can sandbox it entirely and set hard limits on memory/CPU time, after which the process exits. You can just give an error message if RAM grows over a limit or if it takes longer than a few secs to execute. It's pretty safe.

Is it possible to run a program in 'steps,' between which the state is paused?

The debug lib lets you hook behaviors on line changes, entering a function and leaving it, but nothing for single bytecodes iirc.

The debug lib, allowing to take control of the whole program, is disabled in most sandboxed environments including wikipedia's.

However, bytecode instruction and line changes both are poor metrics to measure time, cpu or any other kind of resource usage. Measuring process time is relatively easy and much more accurate.

I don't think it's possible with the stock interpreter, but I'm guessing it's pretty simple to modify the interpreter to do it. Why do you ask?

Simple time sharing between low-priority, potentially long-running programs submitted by untrusted users.

Run a process per script and let the OS handle it, probably.

You don't even need to do that, you can run Lua in a multithreaded program, as long as no lua_State is accessed from multiple threads. You can spawn independent interpreter states, have them do their job and terminate. The whole Lua codebase as such is completely stateless (apart from the state that you keep for your code). The shorter the scripts actually run, the smaller overhead you get by this.

That isn't what I asked about and isn't really helpful

Don't read it, I guess? I don't know any other way to do it, unfortunately. I'm sorry I wasted your time.

Why not? Isn't that the whole purpose of coroutines in Lua?

No, quite the contrary: coroutines only yield explicitly, due to a call to coroutine.yield(). They let you control your scheduling deterministically (although multitasking is far from being their only use)

Note that GP didn't mention the means in which the yielding was to be invoked.

You can't yield if there is a C function lower down in the stack so I don't think you can always abuse the coroutine system to implement OS threads like that.

Are you sure about that? I thought that yields across C functions were added in Lua 5.2. Not to mention that in a controlled environment like the runtime that Wikipedia exposes to you, you can take care of avoiding exposing APIs that would allow people to code themselves into a corner like that (if the C calls are leaves, you're OK even in 5.1).

You are right that they could use a carefully crafted API to work around the problems. Its also true that yields across C were added in 5.2 but you need to code the C functions in continuation-passing-style using a special API to take advantage of that.

http://www.lua.org/manual/5.2/manual.html#4.7

Well, two other options for you are using the coco library with stock Lua 5.1.x, or simply using LuaJIT.

> Every Wikipedia article is now, effectively, an interactive application.

I don't think that's quite true. MediaWiki templates are now more powerful, but I'm not sure even that counts as interactive. This makes editing easier, but the reader isn't going to interact with a Wikipedia page any more than they did last week.

I'm not quite sure if this applies, but can't anyone currently write a Lua script for World of Warcraft? In which case the script could possibly be connecting to and interacting with the WoW servers?

If one thing can be said about Lua, it is that embedding Lua is a solved problem, and not something dangerous to be worried about.

It's similar, I suppose. Like the Wikimedia example, the Lua you write for WoW is tightly limited -- there's an API available [1], and you can request some extra data from the server sometimes. However, there's absolutely no loading of external modules, contacting any sort of outside server, or any direct file access. There's also large swaths of "what the player can do" which are blocked off from the API, in the name of not allowing people to automate core game elements.

[1]: http://wowprogramming.com/docs/api