Stunt and Improvise are my answer to the question, “What would the Web be like if every user is a programmer who could interact with a web-site and change its presentation and behavior?”
Stunt is a fast, object-database with a simple but powerful programming language and provisions for managing untrusted code (with roles, fine-grained permissions and resources limits). It is an extension of the popular LambdaMOO Server – the extensions related to native HTTP support, JSON parsing/generation, a map datatype, modern crypto and multiple-inheritance.
Improvise is a modern web-application framework. It comprises a set of core libraries of objects and code that reside and run within a instance of the Stunt server, as well as supporting libraries of JavaScript and CSS for the browser.
All you need to get started is a Stunt server compiled from the latest sources and Improvise. If you want to see a simple application in action, take a look at the Stunt | Improvise sandbox (unless you know a little bit about Stunt and/or LambdaMOO, what you see probably won’t make much sense, however).
You can build almost anything inside of the Stunt server. Back in the day (and even today), people built entire text-based worlds accessible to users via telnet. However, the present and the future is the Web (specifically HTTP, HTML5, JavaScript, CSS and related standards). Improvise comes with a proper MVC web stack, implemented in MOOcode (the LambdaMOO/Stunt server’s built-in programming language). It provides an interface to HTTP functionality, routing, controllers/actions, and views written in the Mustache templating language. The integral Stunt object- database provides the models. Direct JSON-based access to the Stunt database is also available, if you prefer that kind of thing.
A purely server-side stack is rarely enough to build attractive, state-of-the-art applications. Improvise comes with a client-side framework built on top of tools like Backbone, Bootstrap, and jQuery. Seamless access to server-side objects is available via custom Backbone model/collection classes that know how to interact with the MOO object model.
Both the server-side and client-side frameworks were built with OWASP guidelines in mind. The effort is not 100% complete because the code is not 100% complete, but security is an ever-present goal. Assuming a security aware developer and a deployment that includes an SSL/TLS layer, Stunt | Improvise provides:
- secure storage of passwords using modern cryptography
- secure session management
- secure direct-object references
- XSS and CSRF protection
- URL-level access control
The vision “every user is a programmer” dramatically raises the bar for web application security, so research and development is ongoing!
The server-side core database includes integrated package management. Most/all existing LambdaMOO inspired core databases are monolithic chunks of code. Stunt embraces modern package-backed organization, management and deployment.
The Improvise core database comes with the following library packages already installed:
- kernel, 1.1.5 - Kernel Package
- primitive, 0.0.6 - Primitive Package
- core, 0.0.4 - Core Package
- text_tools, 0.0.1 - Text Tools
- plastic, 1.0.1 - Plastic, MOOcode Parser Toolkit Package
- blink, 0.0.1 - Blink, Structured Document Package
- alt, 0.0.4 - Alt, Player Package
- identity, 0.0.3 - Identity Package
- ask, 0.0.2 - Ask, Query Package
- persistent, 0.0.2 - Persistent Package
- model, 0.0.1 - Model Package
- dialog, 0.1.2 - Dialog, Web Server Package
- dialog_extras, 0.0.7 - Dialog, Extras
- mustache, 1.0.1 - Mustache Templating Language Package
And a starter package:
- application, 0.0.10 - Application Package
Other packages are available. The entirety of LambdaCore is available as a package if you want something a little more familiar to start with.
That depends on where you want to end up. If you want to learn more about Stunt, Improvise or LambdaMOO itself, check out the References, below.
If you want to run Stunt | Improvise, then you need to:
- clone the Stunt repo and build the server
- clone the Improvise repo and run the server
Generally:
cd <path-to-stunt-repo> ./configure make cd <path-to-improvise-repo> <path-to-stunt-repo>/moo Improvise.db Improvise.db.new 7777
With the most recent release of the Improvise core, it’s now possible to connect to the server via a web-based user interface. Of course, telnet is always an option, too.
In order to connect to a brand-new database you need to define bootstrap passkeys for the two default players (a wizard and a programmer). The default players and the passkeys should only be used in a trusted development environment.
The passkeys are set via environment variables.
export Stunt_Passkey_Wizard=<passkey> export Stunt_Passkey_Programmer=<passkey>
Once set, using telnet, connect to the running server and type
connect followed by the passkey. Ex:
connect <passkey>
If successful, you’ll be greeted by the string *** Connected ***.
To connect via the browser, surf to the local Stunt | Improvise homepage (something like http://localhost:8888/ should work) and type or paste the passkey into the text input and press “Connect”.
Log in as a wizardly player and type:
@list packages with $composed
$composed is the reference to the package manager. The command output
lists the packages that are installed, as well as additional packages
available at stunt.io.
Log in as a wizardly player. Assuming package dependencies are met (“autoport” depends on the package “lambdacore” being installed first, for example), type the following:
@install <package> with $composed
The web server should start when the server starts, however, if that’s not the case…
Assuming the “dialog” package is installed (it is by default), type the following as a wizardly player:
; #131:start(<port>)
#131 is the object number of the HTTP server object built from the
HTTP server prototype and a few objects from the “dialog_extras”
package. Stop the server with:
; #131:stop()
Test the server by opening http://localhost:<port>/ in a browser.
You’ll see the default home page. You can connect to an existing
user by typing their object number (not super-secure, I know) –
#5 and #6 are the built-in wizard and programmer players. Once
connected you can browse the database and send commands directly to
the server.
The GitHub source:
The Stunt site:
The LambdaMOO Programmer’s Manual:
Let me Google “LambdaMOO” for you: