5 ms·
Oj – Optimized JSON in Ruby
- Cieplak 9y agoThis is interesting: http://www.ohler.com/oj/doc/file.Security.html http://www.ohler.com/oj/doc/file.Security.html
- viraptor 9y agoThat's pretty much the same as in case of Yaml, isn't it?
- regularfry 9y agoNot so much. With YAML it's a feature baked into the syntax that you have to go to extra effort to avoid. With JSON, it's just a specific data schema you opt in to, so a non-aware decoder will just give you a Hash with some odd data in it.
- jerf 9y agoIf you are referring to the Ruby YAML vulnerability, the problem is that the deserializer ends up calling methods on the deserialized object. This says it doesn't, it merely warns you against doing it yourself, or at least doing it carelessly.
- noway421 9y agoIndeed >Taking an arbitrary String from a user and evaluating it is never a good idea from an unsecure source In that case, how it is possible to implement JSON post on that for example?
- mbell 9y agoThe warnings, other than symbol GC in MRI <= 2.1, refer to using Oj in `object` mode: marshallings arbitrary Ruby object graphs to/from JSON. This is similar to pickle in python. This mode isn't what you would be using at the boundary of something like a http/json api.
- deleted 9y ago[deleted]
- didibus 9y agoFaster then msgpack in Ruby only I'm guessing.
- deleted 9y ago[deleted]
- thesmallestcat 9y agoHow does this have 71 upvotes in such a short time and two comments. It's a Ruby C extension for JSON, nothing more. Something fishy here, especially given that a link on the homepage is "Vote on Hacker News."
- rubyn00bie 9y agoBecause it's a known piece of software in the Ruby community, one that actually kicks ass. His work isn't new, this is probably being voted up by people who know of it... and what's really to comment on? I read the page, upvoted because I like the gem, and moved on.
- thesmallestcat 9y agoOne hour after submission, it's in the top 10 in the past 24 hours. Come on. I'm not doubting there are Rubyists here, but something is clearly up. Submission of same project by OP (project author) yesterday got one vote: https://news.ycombinator.com/item?id=14178676 https://news.ycombinator.com/item?id=14178676
- rubyn00bie 9y agoGetting to the front page of hackernews is more about timing than content. I've had submissions get no votes only to see the same article on the front page a few hours or days later. There's a lot of luck that goes into who is viewing and voting.
- mountaineer 9y agoVersion 3.0 is being announced which is compatible with Ruby 2.4 and Rails 5. With this being a popular gem in the Ruby community, I'm guessing those are important milestones many folks are happy with.
- deleted 9y ago[deleted]
- 9y ago
- theemathas 9y agoWTF is the "function programming approach"?
- deleted 9y ago[deleted]
- anderscarling 9y agoI remember testing Oj a few years back and finding that yajl where still faster for some cases, I believe it was very large arrays of thousands of objects. I did some impromptu benchmarking now, and couldn't find a case where Oj performed worse than yajl. Impressive!