njohnson41

Using HMAC'd tokens to authenticate requests is pretty common in the form of cookie-based session variables (at least in most non-PHP web frameworks, e.g. Flask). This is really the same technique, except for email requests, where the data is embedded in a URL instead of a cookie.

Not to say it's not useful, just that it's not really novel. You also still have to be careful of replay attacks, which the author briefly addresses.

Hopefully mandatory computer science education doesn't fall into the same trap as mathematics, where the "introductory" version taught in grade school becomes so simplified and rote that it loses all of the qualities that make it creative and interesting. There is definitely a systemic problem of kids thinking they are "no good at math", despite an early introduction, and I'm not sure why CS would be so different. Of course, that's still a lot better than not having mandatory math classes at all.

This is definitely a nice reference implementation of crypto algorithms in pure Lua, but please, please do not use it for production encryption. Anything written in an interpreted (or worse, JIT-ted) language will be almost definitely vulnerable to timing attacks. Lua already has bindings to C/C++ crypto libraries if you need to encrypt or create MACs.

The issue is with scoping, not the closure mechanism.

Python will by default shadow variables in an enclosing scope instead of overwriting them during assignment, to prevent accidental introduction of global state. You can use the "global" keyword to force overwriting the outer variable. The list hack also works because it is a mutable data structure, but I wouldn't recommend it.