CChhoooossiinngg aann EEmmbbeeddddeedd LLaanngguuaaggee

Published April 16, 2022

I have projects written in large, powerful languages (Go, C, OCaml); call
them host languages. I want to embed inside these projects a small,
constrained language; call it the guest language. The guest language must
execute untrusted code without harmful side effects (file access, IO,
infinite loops). The guest must be able to call functions provided by the
host.

I surveyed a dozen languages. The ones below are the final candidates.
After completing this survey, I settled on a different architecture; one
that doesnʼt require an embedded language. Iʼm writing down these results
in case a similar need arises again.

SSttaarrllaarrkk

_S_t_a_r_l_a_r_k[1] was created in 2017. It has a pleasant, Python-like syntax.
Starlark was designed for running untrusted code. It has a thorough
_l_a_n_g_u_a_g_e _s_p_e_c_i_f_i_c_a_t_i_o_n[2]. It has solid implementations in Go, Rust, and
Java. Iʼd use the _G_o _i_m_p_l_e_m_e_n_t_a_t_i_o_n[3].

Between April 2021-2022, the Go implementation had 19 commits from 11
authors. That gives a _H_e_r_f_i_n_d_a_h_l _i_n_d_e_x[4] of 0.13. Thatʼs a pleasantly
diverse group of authors.

Although it isnʼt my subjective favorite, it seems to have learned
valuable lessons from the embeddable languages that came before it. That
made it the front runner in my objective considerations.

TTccll

_T_c_l[5] was created in 1988. Itʼs the oldest language on the list, and my
subjective favorite. I adore its semantic simplicity, and the way it
naturally supports domain-specific language. It has good support for
running untrusted code.

It has two solid implentations, both in C: _T_c_l[6] and _j_i_m_t_c_l[7]. Although
itʼs not production ready, the _P_i_c_o_l[8] implementation deserves an
honorable mention. Iʼd probably use jimtcl.

Between April 2021-2022, jimtcl had 36 commits from 4 authors. That gives a
Herfindahl index of 0.79. Thatʼs more concentration than Iʼd like. The
main Tcl implementation was more active and more diverse (1027 commits, 9
authors, Herfindahl 0.61). Itʼs nice to have two compatible
implementations in case one dies.

LLuuaa

_L_u_a[9] is the dominant language in this space. It was created in 1993.
Itʼs pleasantly simply and clean. It seems easy to run untrusted Lua code
safely. Unfortunately, Iʼve never been able to fall in love with Lua.

It has several solid implementations. Iʼd probably use _P_U_C _L_u_a[10] since
itʼs the main line of development.

Between April 2021-2022, PUC Lua had 42 commits from 1 author. That
doesnʼt seem right, but thatʼs what the repository says. That would give
a Herfindahl index of 1: as bad as it can get.

I thought that maybe _L_u_a_J_I_T[11] would be better. It had 144 commits from 1
author. Itʼs more active, but just as badly concentrated.

Based on its unhealthy levels of concentration and my inability to love it,
Lua ranked the lowest in my assessment.

WWrreenn

_W_r_e_n[12] was created in 2013. Itʼs the youngest of the languages, but the
implementation is tiny, clean, and fast. Itʼs not able to run untrusted
code, but Iʼm including it here because I think it has a promising future.
I donʼt like the Java-esque syntax or object-oriented focus, but every
benefit has its price.

Between April 2021-2022, Wren had 16 commits from 7 people. That gives a
Herfindahl index of 0.35. Thatʼs an impressive level of diversity for a
new, small project. Only Starlark outperformed Wren in diversity (not
surprising since Google pays its engineers to work on Starlark).

1: https://github.com/bazelbuild/starlark
2: https://github.com/bazelbuild/starlark/blob/master/spec.md
3: https://github.com/google/starlark-go/
4: https://en.wikipedia.org/wiki/Herfindahl%E2%80%93Hirschman_index
5: https://www.tcl-lang.org/
6: https://github.com/tcltk/tcl
7: https://github.com/msteveb/jimtcl
8: https://chiselapp.com/user/dbohdan/repository/picol/home
9: https://www.lua.org/
10: https://github.com/lua/lua
11: https://luajit.org/
12: https://github.com/wren-lang/wren.git