I'll reply in reversed order.
Twisol said:
The big one for me is that it's extremely easy to sandbox.
Well, sandboxing, if done well, is secure... But I really don't like the idea. You reduce danger of executing harmful code, but at the same time you greatly reduce functionality available in scripts. I just checked, out of curiosity, and this code worked:
import win32api
world.Note( win32api.GetComputerName() )
It means that almost all WinAPI calls are directly accessible from my python scripts. I could create new window (threading works to some extent - just accessing "world" object crashes MUSHClient, so I could really create another system-level window and do anything with it!), paint on the desktop, register (with pyHook) callback to intercept mouse and keyboard messages - system-wide (which is good, sometimes - and bad, if I want to write keylogger and convince someone to use my script...). And many, many more cool things, if I felt like refreshing my WinAPI skills.
If Python was properly sandboxed, this would (or at least should) be impossible. I'm not sure I really want to trade this functionality for security, especially considering that NOW it works that way and no one complains ;P
Twisol said:
I think MUSHclient is the only program I've ever seen to support multiple languages
I think so too. And that's one of many reasons why I use MUSHClient, and why I think it's simply the best client out there. Please don't talk about dropping support for other languages. Pretty please :)
David Haley said:
I think the WSH approach here is good enough for Python [...] unless somebody really really wanted Python -- in which case they should provide the binding themselves. ;)
I agree. Absolutely. I might - some time in future - give it a try, but - generally speaking - the way it works now is sufficient for me. So maybe some day as an exercise, but not anytime soon.
Nick Gammon said:
And then you need to handle differently things like arrays (which in the WSH end are done with Variant arrays) and convert them into the script equivalent (in the case of Lua it was tables). And booleans are done differently in Lua at least (the number zero being considered true, for example).
There are tools that automate part of the process. I know that they exist, but unfortunately I have no experience in using them... So as I said - maybe some day :)
Nick Gammon said:
Also MFC (the underlying library) also uses threads, in particular modal dialog boxes are not really modal dialogs, but MFC kicks off a new thread, and then locks the underlying window so you can't click on it.
I don't get it - why these dialogs are modal in the first place? My character once DIED! because of this! (It was over before I closed two dialogs that I had open...)
And Microsoft Foundation Classes are evil ;) I programmed some time with pure WinAPI in C, and then, fortunately, switched directly to QT and C++, so I was spared pleasure of working with MFC - but what I remember from quick overview is pure horror I felt. ;)
Nick Gammon said:
In my defense, that was long before I read about "threads are evil".
I really think that there is nothing to defend. Threads are just one of many tools you can use. They are not evil, neither they are some kind of super solution of "panacea". They have their weak points and advantages. Especially now, when mutlicore processors are so common, using threads is worth considering. Synchronization is an issue, but done right - poses no real threat to stability (but debugging is still hard). Threads are not evil. Their misuse - is.
David Haley said:
It's fine to embed, but not the right tool for embedding? ;)
Twisol explained later, but I think that embedding does not necessarily have to heavily restrict, or sandbox, embedded language. Twisol seems to have another opinion.
Twisol said:
You can use UdpListen() in MUSHclient to set up a UDP port to listen on, and run a standalone Python program that uses your thread to watch the file. Then when it sees a change, it can notify your MUSHclient script via the UDP port.
I thought about it for a brief moment, but that would be adding complexity instead of reducing it. If I had to script some kind of socket communication I'd do this with non-blockng socket using TCP from pure Python.
Twisol said:
Most of these languages come with extensive standard libraries already.
And, as I said earlier, I consider this an advantage. I understand your concerns, but really, sandboxing Python or Ruby or (I guess) PERL cuts their usability by half at least. Their main strength are huge standard libraries (yes, yes, elegant and pragmatic design, metaprogramming capabilities, beautiful syntax, etc. too, but if I could choose language based on syntax and design I'd pick haskell or ocaml ;) ).
If security is that big of the concern, you always can sandbox whole app or even system, like with BOCHS or the likes. It will be secure, no matter how inefficient.
On the other hand - I wrote my persistent data storage using SQLAlchemy and MySQL, effectively bypassing MUSHClient variables and never using them. I'd be very unhappy if I had to rewrite it and use variables (or built in sqlite) again... Miniwindows are sweet, but using them with WinAPI-like calls is painfully inefficient (in terms of code complexity) - I prefer generating image with PIL and then rendering it. I couldn't do it in heavily restricted environment...
Phiew. I wrote it all, thanks for reading :)
And one last thing - is it possible to register callback which will be called just before script engine restarts?
PS. Please correct any grammar or spelling mistakes I make. I read a lot in English and I have spell checker on, but I have very few opportunities to write, unfortunately.