10 ms·
Why is JSON so popular? Developers want out of the syntax business
- TomasSedovic 17y agoHe nailed it: XML should be used for markup, JSON or YAML for structured data.
- Qz 17y agoIsn't YAML a subset of JSON? or vice versa?
- masterj 17y agoMy understanding is that YAML is a superset of JSON.
- blasdel 17y agoYAML had a fuckton of sugar, where JSON has as little as possible, but the biggest differentiator is that YAML has references — you can express cyclic graphs. That's why it's a natural fit for fixtures and seed data in Rails: it natively handles relational data.
- euroclydon 17y agoThere are so many cool things you can do with JSON. I just created a boolean logical statement builder on a web page by using free form open and close parenthesis, and and/or radio buttons. A little regex to change the parenthesis into square brackets, then an eval(), and I can walk the whole statement recursively.
- stcredzero 17y agoeval() strikes me as a dangerous thing, security-wise.
- euroclydon 17y agoHow? I'm evaluating strings that are built with my javascript code or from my server code, not arbitrary user input from other users. Yes the user is able to enter parenthesis into a textbox, and those become part of the evaluated string, but I regex replace out everything but the actual parenthesis.
- giardini 17y agoRather than "regex replace out" problematic elements, you should immediately toss the data back to the user for correction. Trying to "correct" a potential hacker's string is often a losing proposition.
- tptacek 17y agoEvery security assessor's favorite answer to a threat: "but I regex out everything unsafe".
- euroclydon 17y agoHow is building an intermediate portion of a nested logical statement, using eval() dangerous? Here is the regex for what I allow (only '[' & ']'): value.replace(/[^(]/g, '').replace(/\(/g, '[') value.replace(/[^)]/g, '').replace(/\)/g, '],') I guess the point you all are trying to make is that some javascript text could have been maliciously inserted into the page somehow, and accidentally get eval'd simply because eval is in use, but the page below says that one of the only times eval should be used is to build up complex mathematical expressions. Is there a safe way to build up such expressions? Send it to the server, and invoke a JS engine there? The reason I made my original comment was because I found the eval function to be so helpful in this scenario, b/c I didn't need to use any type of syntax parsing. http://blogs.msdn.com/ericlippert/archive/2003/11/01/53329.aspx http://blogs.msdn.com/ericlippert/archive/2003/11/01/53329.a...
- tptacek 17y agoIf you are confident about charsets and you whitelist down to known-good characters ([A-Za-z0-9_ \t]) I have nothing snarky to say about the design. Otherwise, try reading this very short thread: http://www.webappsec.org/lists/websecurity/archive/2010-03/msg00044.html http://www.webappsec.org/lists/websecurity/archive/2010-03/m... (It's not exactly your problem but you'll get the flavor.)
- anamax 17y agoAs one of the earlier commenters pointed out, lisp welcomes you to the 1960s.
- patio11 17y agoSorry we were late to the party, guys, we just got so wrapped up in writing software that people actually use.
- pilif 17y ago... while the lispers where still counting the closing parens needed to finally get their code running SCNR
- stcredzero 17y agoOnly the ones too clueless to use Emacs or another editor that does it for you.
- nuclear_eclipse 17y agoFor some reason, every time I let an editor automatically insert a closing parenthesis, quotation, or brace, I almost always end up with extras at the end, which is just as frustrating, if not harder to debug, as not enough. Maybe it's the way I tend to backstep as I think my way through the code flow, but it never ceases to happen whenever I step foot into Eclipse or Visual Studio...
- stcredzero 17y agoFor some reason, every time I let an editor automatically insert a closing parenthesis, quotation, or brace, I almost always end up with extras at the end User issue here. I never have the problem you refer to. Don't have the editor/IDE insert the parens/brackets. Have it check them for you. Emacs can do a momentary highlight of the opening paren/bracket whenever you type the close of the pair. I used to use that to make sure I'm writing exactly what I thought I was writing. If my code is too convoluted for me to know that I'm correct in a split second when seeing the open paren highlight, then I know it's time for me to refactor/rewrite the method. In my present project, I use a similar facility in the Smalltalk browser.
- stanleydrew 17y agoWell JSON also lets you get around browsers' same-domain policy without having to set up a proxy, which I think might be more important.
- pilif 17y agoif you are talking about JSONp: JSON is by no means required to do that. You could in theory easily pass a string containing XML to the callback function.
- stanleydrew 17y agoYes, good point.
- frognibble 17y agoJSON is popular because there is a straightforward mapping from JSON to native types in many programming languages.
- stcredzero 17y agoLanguage designers take note: there is tremendous utility in making entities in your language isomorphic to entities expressed in previous languages. I am actually using such isomorphisms in my current porting project. I'm literally getting a couple of orders of magnitude more productivity out of this over porting by hand. Also note: less syntax makes this easier.
- sketerpot 17y agoI recently wrote a program to do Threefish encryption which I deliberately wrote to look as much like the mathematical notation in the spec as possible. That made things so much easier that it was almost ridiculous, even if it made the resulting program very peculiar-looking.
- blasdel 17y agoYou'll love what Alan Kay has been working on: http://vpri.org/pdf/tr2007008_steps.pdf http://vpri.org/pdf/tr2007008_steps.pdf You'll be especially enamored of their 200-line TCP/IP implementation, introduced on p17 and reproduced with documentation starting on p44. It's implemented as a grammar in their meta-language that parses the ASCII-art diagrams in the RFCs and executes them.
- deleted 17y ago[deleted]
- andreyf 17y agoMore fundamentally, JSON embodies some fundamental metaphors we use in data types - numbers, strings, lists, and maps. Those are a lot more intuitive/familiar than whatever metaphors XML comes up with.
- ntownsend 17y agoThe argument that XML can have various different structures for storing a person's name, while JSON provides one simple solution, doesn't fly. You could run into something like { "Person": { "property": { "type": "first-name", "value": "John" }, "property": { "type": "last-name", "value": "Smith" } } } This begs the question, "Why would you do something that convoluted?" Well, you can ask the same of the XML examples, and the answer probably boils down to requirements (or incompetence?).
- wlievens 17y agoOr library defaults. X-Stream, for instance, will by default use subtags rather than attributes, for primitive properties.
- arockwell 17y agoMy gut feeling on this is that almost anyone can recognize that writing JSON like that is wrong. However, trying to determine if <person first-name="John" last-Name="Smith" /> is better than <person> <first-name>John</first-name> <last-name>Smith</last-name> </person> is often very difficult. In the wild, I've seen both strategies used depending on the situation.
- yread 17y agoActually it's very simple. If you don't need children don't make them. I measured it once and storing stuff in attributes had ~10 times faster parsing in MSXML.
- JeremyStein 17y agoPlease don't write "begs the question" when you mean "raises the question". http://begthequestion.info/ http://begthequestion.info/
- dasil003 17y agoI respect the difference, but I'm afraid there's not much point in trying to educate people. This has already been an utterly lost cause for decades (at least).
- lenni 17y agoI can't really understand all the XML-bashing. Of course it isn't the right tool for any job, but I like it for its schema and validation features.
- rgoddard 17y agoMostly it is a reaction to the over use of XML and how and why in many situations using something other then XML is beneficial. If a large swath of people of start using JSON without thinking about you will probably start seeing a similar reaction extolling the virtues of another format over JSON.
- lincolnq 17y agoYes, those are good features. The trouble was that it was the all-purpose data exchange tool for a long time, and everyone has seen XML put to all sorts of ungodly purposes. If it were invented today, nobody would be bashing it, because it would be less widely used -- the few people who did decide to use it would be putting it to good use, so they would love it. Everyone else would be using something else that was simpler.
- Luyt 17y agoIsn't it dangerous to eval()? Suppose someone put some malicious code in the JSON data?
- wlievens 17y agojQuery includes a proper parser
- Hexstream 17y agoI think it was even being incorporated in browsers natively for maximum performance. It might be available already.
- enomar 17y agohttp://ejohn.org/blog/the-state-of-json/ http://ejohn.org/blog/the-state-of-json/
- euroclydon 17y agoWhere?
- DrJokepu 17y agoThe question to ask is: is the JSON coming from a trusted source (e.g. generated by your server and you can reasonably sure that you have no funny XSS holes)? If the answer is yes, eval()-ing JSON is perfectly safe. If the answer no, you need to parse it without the help of the JS interpreter.
- eru 17y agoAnd you should probably err on the safe side.
- sp332 17y agoFirefox has a native JSON parser. http://blog.mozilla.com/webdev/2009/02/12/native-json-in-firefox-31/ http://blog.mozilla.com/webdev/2009/02/12/native-json-in-fir...
- njharman 17y agoIt's easy, it works.
- tptacek 17y agoThe "XML requires you to build your own parse tree" argument isn't valid; XML libraries are fully capable of handing you a DOM-style tree, and of allowing you to pull things out of the tree without writing your own traversal code. JSON just assumes messages are going to trivially fit into naive data structures, and so provides fewer options.
- jbooth 17y agoYeah, but the downside to doing that with XML is it's frickin crazy. I have to parse this whole thing into memory and then pull out the part I want? The CPU is spending more time dealing with XML than it is doing useful work. If it's a big file, this is very significant. In JSON, you get the same expressiveness without the hassle.
- tptacek 17y agoI'm not sure what you think your JSON parser is doing.
- axod 17y agoCome on. Any one of us could write a JSON parser in a page of code. An XML parser is significantly more work due to the overcomplexness of XML. Both to write, and for the CPU to run. And it's larger. In fact I'm struggling to think of something XML has that is good. (And please no one respond with "it's extensible" or I may explode). An XML parser has to track open tag names, with JSON it doesn't matter. XML has all stupid entities like & which look ugly and need to be parsed. I think "time to write a parser" should be a good metric on how sane a data format is. The fact that writing an XML parser that covers all bases/eventualities is a major undertaking says alot about the data format.
- tptacek 17y agoYou know, I know we're just geeking out here so please don't read too much into me taking the devil's advocate position, but: yes, XML is harder to parse, but the underlying data that gets encoded in JSON and XML isn't substantially different. In both cases --- and let's take the C implementation case --- you're still building a poorly specified buggy implementation of Tcl to actually hold the data and answer questions about it. That's the point I'm trying to make.
- DanielBMarkham 17y agoObserving the industry over the last couple of decades, I'm left with the feeling that sometime in the last ten years or so we all went XML crazy. The popularity of JSON is just the pendulum starting to swing the other way. So count me in. I'll use JSON over XML for server-webclient data exchange whenever I can. It's just much easier.
- andrewvc 17y agoThe funny thing is, we all knew we were going XML crazy while it was happening. I can remember anti-XML bloat articles going way back. The thing with XML was, it DID solve some problems, it just tried too hard. The good thing about XML was it was a standard interchange format that every language had at least a couple parsers for. That said, I'm not sure if it was worth the annoyance and irritation of using stuff like XML Schema, DTDs, SOAP, or XSLT.
- charlesju 17y agoOn a similar token, I'm so happy REST won over WSDL.
- eplanit 17y agoThe argument is always the same, and the JSON crowd always assert "superiority" derived from sheer simplicity. XML is too hard for them, and they're part of some bizarre quasi-political movement that trashes object-oriented principles. Thus, 'simple' trumps validation via type, version control (and hence interoperability over time without breakage and maintenance), robustness. The weakness in the Javascript "eco-system" is it's quasi (the 'quasi' qualifier applies frequently in this eco-system) support of objects. XSD/XML is powerful when used in an object paradigm, and object paradigms have proven (not just via community claims) to be very effective. The question is, when will the JS community step up to the plate (i.e. mature)? So much energy is wasted now on making JSON work -- just in order to make Javascript easy. Wrong priorities.
- tomkinstinch 17y agoI prefer JSON over XML for most applications, but one advantage of XML is that its strict structure aides parsers. With XML it's easy to see if you've closed all of your tags, etc.; it's all about the parser. Conversions between XML and JSON can be a challenge (defining namespaces,etc.). The Google Data API handles this very well. Check out their nice side-by-side example: http://code.google.com/apis/gdata/docs/json.html http://code.google.com/apis/gdata/docs/json.html