In light of this info, I'm inclined to make MCServer explicitly remove the io.popen() API from its Lua engine, so that no plugins can use it - after all, it just messes the server up.
Anyone opposed?
I agree. We should mention it in the API docs as well.
It can't be mentioned in the API docs when the function is not present - there's no place for the documentation to go. We don't document the "built-in" Lua functions anyway.
Maybe add an article that mentions it? Although it is kinda overkill for just a single function :|