I'm a big fan of Lua, and a big fan of correctness via simplicity, but I worry the author is a little too confident for his own good. Take his sample webserver: http://lua4everything.dyndns.org/ and the accompanying blog post: http://blog.luaos.net/
That particular example is simple and doesn't permit much room for nefarious actions, but as soon as he adds support for a wider selection of files, POST (and other verbs), caching, templating, authentication and access control, etc, the code will grow in complexity and the advantages of Lua will recede.
For instance, remove the line "isin(path, sources)" and there is a arbitrary file read. White lists are more secure, but they don't scale.
That particular example is simple and doesn't permit much room for nefarious actions, but as soon as he adds support for a wider selection of files, POST (and other verbs), caching, templating, authentication and access control, etc, the code will grow in complexity and the advantages of Lua will recede.
For instance, remove the line "isin(path, sources)" and there is a arbitrary file read. White lists are more secure, but they don't scale.