4 ms·

Any more details? A quick googling doesn’t find many talking about comparative performance and security of Jackson vs jsonb vs gson? Have seen Jackson in part

Any more details? A quick googling doesn’t find many talking about comparative performance and security of Jackson vs jsonb vs gson? Have seen Jackson in parts of my code base (internal, but still)

jillesvangurp 6y ago
These 3 issues basically. https://www.cvedetails.com/vulnerability-list.php?vendor_id=15866&product_id=34008&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=3&sha=0b83cc9c136be1365ed375c86d44c64feaea0002 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... As Jackson is used in Spring, you can assume most banks, big corporations, etc. use it. So, update your dependencies and it's fine. Gson is kind of to be avoided for the simple reason that it seems to be no longer maintained by Google. I've used it in the past and its fine but wouldn't pick it for something new because of this. If you are using Kotlin, kotlinx serialization is worth a look. I've been using that recently. One of the nice things is that it relies on compiler plugins and code generation rather than a lot of reflective magic at runtime. From a security and performance point of view, that's a good thing.
- listenallyall 6y ago
  kotlinx.serialization has a learning curve, but it is quite flexible and very fast. I've only used it on the JVM but obviously its cross-platform nature is a big plus as well. It could use some simplified syntax (similar to how Kotson improved on Gson), perhaps a JPath parser. But for something that just went 1.0 very recently, it is terrific.
  - jillesvangurp 6y ago
    We are using kotlinx serialization in a multiplatform project where we use the same model classes in a cross platform API client and our Spring server. Tested this on Javascript and JVM so far and will likely add IOS there soonish.

Any more details? A quick googling doesn’t find many talking about comparative performance and security of Jackson vs jsonb vs gson? Have seen Jackson in parts of my code base (internal, but still)

jillesvangurp 6y ago

These 3 issues basically. https://www.cvedetails.com/vulnerability-list.php?vendor_id=15866&product_id=34008&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=3&sha=0b83cc9c136be1365ed375c86d44c64feaea0002 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... As Jackson is used in Spring, you can assume most banks, big corporations, etc. use it. So, update your dependencies and it's fine. Gson is kind of to be avoided for the simple reason that it seems to be no longer maintained by Google. I've used it in the past and its fine but wouldn't pick it for something new because of this. If you are using Kotlin, kotlinx serialization is worth a look. I've been using that recently. One of the nice things is that it relies on compiler plugins and code generation rather than a lot of reflective magic at runtime. From a security and performance point of view, that's a good thing.

listenallyall 6y ago
kotlinx.serialization has a learning curve, but it is quite flexible and very fast. I've only used it on the JVM but obviously its cross-platform nature is a big plus as well. It could use some simplified syntax (similar to how Kotson improved on Gson), perhaps a JPath parser. But for something that just went 1.0 very recently, it is terrific.
- jillesvangurp 6y ago
  We are using kotlinx serialization in a multiplatform project where we use the same model classes in a cross platform API client and our Spring server. Tested this on Javascript and JVM so far and will likely add IOS there soonish.