But with Lua many states aren't a problem and the simpler, more secure
and scalable Apache model can be used! And it is beginner-friendly!
If by "Apache model" you mean plugins loaded into the webserver that spin up separate script processors for every view, that is not simpler, nor more secure, nor more scalable.
If you're referring to the CGI model where each view is handled by a separate heavyweight process, that is indeed very simple and very secure, but it is notorious for its poor scaling. Any model that involves initializing a new interpreter for every request is going to have poor scaling because you have to reinitialize the application state for each page view. The problem isn't an issue of HAVING many states; the problem is in STARTING many states.
You claim that the NodeJS model is bad for scalability without "ugly hacks" -- this is completely false. It's true that there is a security risk involved in the app server model because of the shared memory space, but the app server model is the best possible model for scalability. This is because it allows for state to persist across requests without needing to serialize it and deserialize it with every request, and you don't have to reinitialize the entire application every time. There's a reason that EVERY major high-scalability service uses the app server model, whether Java, C#, Python, _javascript_, or whatever.
The "ugly hacks" you decry are what you have to do ANYWAY in order to scale past what can be handled by a single machine, regardless of what underlying model you're using.
Lua's lightweight states do work very nicely with the app server model. You can create a new state for every session, providing some level of isolation between users while maintaining persistent state. I've not done this with Lua before so I'm not familiar with any of the existing tools, but I know how I'd approach it if I were building such a thing from scratch.
/s/ Adam
