4 ms·

Not sure why you are downvoted, about 10% of the article addresses it's headline and I frankly do not get the point either. The proposed solution is in the firs

Not sure why you are downvoted, about 10% of the article addresses it's headline and I frankly do not get the point either. The proposed solution is in the first numbered list and between that and the conclusion list is a bunch of prose on non-JSON payload. The only slightly JSON related content in there is a constructed scenario for 'in-band' signatures (the regex thing) which can just as well be achieved by a bit of string processing. Any JSON object will start with {, end with } and have some more information between it. Replacing the initial curly brace with '{"hmac": "foo",' gives you a valid JSON document. You can remove that easily before parsing and place no restrictions on the object's keys. You can handle edge cases like JSON literals or arrays by wrapping the whole thing in {"hmac": "foo", "payload": yourstring} if you feel like it.

lvh 7y ago
> Not sure why you are downvoted, about 10% of the article addresses it's headline and I frankly do not get the point either. The proposed solution is in the first numbered list and between that and the conclusion list is a bunch of prose on non-JSON payload. The proposed solution is not in the numbered list. The numbered list describes how to sign a JSON blob from the outside. The rest of the doucment describes what you do if that's not an option, and you need to sign the blob in-line. The very next paragraph after said numbered list describes how to do that. (I'm the author.)
- pvg 7y ago
  (I'm the author.) Whee, I can stop rage-typing 'how not to self-attribute your comment about a thing you wrote' now!
  - lvh 7y ago
    Huh, sorry, I'm confused. What should I (not) be doing? I thought not disclosing being the author of the linked thing was poor form.
    - pvg 7y ago
      Oh it's nitpicker than that - you don't have to 'disclaim' being the author cause, you're, you know, the author and can just say you are.
      - lvh 7y ago
        Ah! So you're saying I should say "Full disclosure" and not "Disclaimer"? (Or nothing at all, as I do here, I suppose :-)) Yes, you're absolutely right and I'll try to do better in the future :)
        pvg 7y ago
        'Disclosure' is something journalists use to point out a potential external conflict/relationship the reader might unaware of. But you don't need it to point out authorship either. You're really saying 'I want you to be aware I wrote the thing we are discussing' not 'Please don't think I'm sockpuppetting for myself'. This is a bit like an even more persnickety version 'nation state' in that the trivial fix is just dropping the pointless ceremony.

lvh 7y ago

> Not sure why you are downvoted, about 10% of the article addresses it's headline and I frankly do not get the point either. The proposed solution is in the first numbered list and between that and the conclusion list is a bunch of prose on non-JSON payload. The proposed solution is not in the numbered list. The numbered list describes how to sign a JSON blob from the outside. The rest of the doucment describes what you do if that's not an option, and you need to sign the blob in-line. The very next paragraph after said numbered list describes how to do that. (I'm the author.)

pvg 7y ago
(I'm the author.) Whee, I can stop rage-typing 'how not to self-attribute your comment about a thing you wrote' now!
- lvh 7y ago
  Huh, sorry, I'm confused. What should I (not) be doing? I thought not disclosing being the author of the linked thing was poor form.
  - pvg 7y ago
    Oh it's nitpicker than that - you don't have to 'disclaim' being the author cause, you're, you know, the author and can just say you are.
    - lvh 7y ago
      Ah! So you're saying I should say "Full disclosure" and not "Disclaimer"? (Or nothing at all, as I do here, I suppose :-)) Yes, you're absolutely right and I'll try to do better in the future :)
      - pvg 7y ago
        'Disclosure' is something journalists use to point out a potential external conflict/relationship the reader might unaware of. But you don't need it to point out authorship either. You're really saying 'I want you to be aware I wrote the thing we are discussing' not 'Please don't think I'm sockpuppetting for myself'. This is a bit like an even more persnickety version 'nation state' in that the trivial fix is just dropping the pointless ceremony.