3 ms·
> JSON is still the only secure transportation protocol Ummm, canonical s-expressions[0] and ASN.1's various encoding rules[1] beg to differ. The one thing JS
by zeveb 9y ago
> JSON is still the only secure transportation protocol
Ummm, canonical s-expressions[0] and ASN.1's various encoding rules[1] beg to differ.
The one thing JSON has that canonical s-expressions don't is maps/hash tables/dicts, but after working with both for quite awhile I've come to the conclusion that maps in the core transport language are actually a mistake.
[0] http://people.csail.mit.edu/rivest/Sexp.txt http://people.csail.mit.edu/rivest/Sexp.txt
[1] https://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One#Octet_Encoding_Rules https://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One#O...
- rurban 9y agoS-expr are powerful, but too powerful. They do allow object deserialization, which is the insecure part.
- zeveb 9y ago> They do allow object deserialization, which is the insecure part. Only in the exact same sense that JSON allows insecure object deserialisation. Yes, if you process a JSON object or S-expression, your processor can do all sorts of insecure things. But a non-buggy S-expression parser can't do anything wrong with (foo bar "baz"), just as a non-buggy JSON parser can't do anything wrong with ["foo", "bar", "baz"].