3 ms·

And XML is a very battle-tested alternative that supports every conceivable edge case and arbitrary depths of strictness and validation. There was soooo much en

by tootie 5y ago

And XML is a very battle-tested alternative that supports every conceivable edge case and arbitrary depths of strictness and validation. There was soooo much energy poured in to making XML the One Format To Rule Them All. It has so many advanced features like strict definitions, includes syntax, support for mixed content, entities and references, comment syntax. But it turns out that 99% of users never needed any of that and just wanted nested key-value pairs.

kevinmgranger 5y ago
That and any serialization format that has security implications is doomed to fail (or at least be derided).
- mindless_solips 5y ago
  What?!? BREH, read Effective Java on Serialization. Every serialization format has security implications. Some try to make this explicit and probably fail in capturing all conceivable holes. Some leave this implicit to give you "fun surprises."
  - kevinmgranger 5y ago
    What "fun surprises" does JSON have, aside from "the object could be arbitrarily big" ?
    - mindless_solips 5y ago
      A serialization format is more than just how things are described on the wire. It's also about how both sides are expected to receive and transmit it. Naive processing of JSON in certain situations can run into sharp edges like this: https://rules.sonarsource.com/java/RSPEC-4544 https://rules.sonarsource.com/java/RSPEC-4544 Serialization formats are a part of Protocols, which essentially form the software equivalent of a spoken language between two people. Like words, the bytes can have a general syntax and expected semantic, but still be open to problematic interpretation. Like the conceptual difference between a language like English and Ithkuil. (http://www.newyorker.com/magazine/2012/12/24/utopian-for-beginners http://www.newyorker.com/magazine/2012/12/24/utopian-for-beg...) Like Ithkuil, some formats can specify "a little more" in a way that tries to prescribe semantic meaning and syntax such that implementing according to spec limits the opportunities for issues like this to happen.

by tootie 5y ago

kevinmgranger 5y ago

That and any serialization format that has security implications is doomed to fail (or at least be derided).

mindless_solips 5y ago
What?!? BREH, read Effective Java on Serialization. Every serialization format has security implications. Some try to make this explicit and probably fail in capturing all conceivable holes. Some leave this implicit to give you "fun surprises."
- kevinmgranger 5y ago
  What "fun surprises" does JSON have, aside from "the object could be arbitrarily big" ?
  - mindless_solips 5y ago
    A serialization format is more than just how things are described on the wire. It's also about how both sides are expected to receive and transmit it. Naive processing of JSON in certain situations can run into sharp edges like this: https://rules.sonarsource.com/java/RSPEC-4544 https://rules.sonarsource.com/java/RSPEC-4544 Serialization formats are a part of Protocols, which essentially form the software equivalent of a spoken language between two people. Like words, the bytes can have a general syntax and expected semantic, but still be open to problematic interpretation. Like the conceptual difference between a language like English and Ithkuil. (http://www.newyorker.com/magazine/2012/12/24/utopian-for-beginners http://www.newyorker.com/magazine/2012/12/24/utopian-for-beg...) Like Ithkuil, some formats can specify "a little more" in a way that tries to prescribe semantic meaning and syntax such that implementing according to spec limits the opportunities for issues like this to happen.