I'm a big fan of Lua, and a big fan of correctness via simplicity, but I worry the author is a little too confident for his own good. Take his sample webserver: http://lua4everything.dyndns.org/ and the accompanying blog post: http://blog.luaos.net/
That particular example is simple and doesn't permit much room for nefarious actions, but as soon as he adds support for a wider selection of files, POST (and other verbs), caching, templating, authentication and access control, etc, the code will grow in complexity and the advantages of Lua will recede.
For instance, remove the line "isin(path, sources)" and there is a arbitrary file read. White lists are more secure, but they don't scale.
After this spectacle what interest I had in the project when it was first announced waned. Community around an open-source project is very important, and this is not how to build it. I'd rather see the project forked than deal with someone like this.
That particular example is simple and doesn't permit much room for nefarious actions, but as soon as he adds support for a wider selection of files, POST (and other verbs), caching, templating, authentication and access control, etc, the code will grow in complexity and the advantages of Lua will recede.
For instance, remove the line "isin(path, sources)" and there is a arbitrary file read. White lists are more secure, but they don't scale.