5 ms·

What’s nice about JSON is that it’s actually valid JavaScript, with some formal specification to avoid any nasty circles or injections. Why can’t your protocol

What’s nice about JSON is that it’s actually valid JavaScript, with some formal specification to avoid any nasty circles or injections. Why can’t your protocol just be valid JavaScript too? this.name = “string”; instead of mixing so many metaphors?

royjacobs 2y ago
Because that would require consumers to have a Javascript interpreter to use it.
- moralestapia 2y ago
  Because that would require consumers to have an interpreter for the most widely deployed language, ever, and by far. FTFY
  - yawnxyz 2y ago
    security nightmare; sometimes you don't want consumers to execute code arbitrarily
    - moralestapia 2y ago
      Not true. Google, Meta, ... do it at a massive scale, no issues. It's not really hard to protect yourself against that. Any (competent) security guy can give you like 4 ways to implement it properly.
      - rererereferred 2y ago
        Do you mean the ads they serve that contain malware?
      - hifromwork 2y ago
        I am a (hopefully competent) security guy, please don't run arbitrary code if you can help it. Especially for something as trivial as JSON patching.
    - kevin_thibedeau 2y ago
      This is what makes Tcl great as a data interchange format. It comes with a safe mode for untrusted code and you can further restrict it to have no control flow commands to be non-Turing.
    - crabmusket 2y ago
      Ok hear me out, what if my API accepts WASM fragments that I run against my database but in a sandbox!
  - oguz-ismail 2y ago
    Nah, in that case Python would be a better option as it's already installed everywhere.
    - moralestapia 2y ago
      That is so derangedly untrue.
      - jrockway 2y ago
        Starlark is a nice embeddable scripting language, though. Java, Go, and Rust implementations: https://github.com/bazelbuild/starlark/blob/master/users.md#implementations https://github.com/bazelbuild/starlark/blob/master/users.md#...
  - sagacity 2y ago
    But what's your point? Would you truly want consumers of JSON Patch data to embed a JS interpreter?
    - moralestapia 2y ago
      My point is that the JS interpreter is likely already there.
      - _blk 2y ago
        only if you think of JSON in the context of a browser. JSON is used as serialized representation of objects in embedded systems, config files, etc. where a JS interpreter is unnecessary, absent or unwanted (size, security, platform preferences, ...)
tablatom 2y ago
> Why can’t your protocol just be valid JavaScript too? It is.
- hyperhello 2y ago
  It’s delivered in JSON, but you need an interpreter. But the actions are just JS assignment statements and a little glue. Your interpreter could as easily handle that, and with far less bytes. Why call a member variable /name when it’s already .name?

royjacobs 2y ago

Because that would require consumers to have a Javascript interpreter to use it.

moralestapia 2y ago
Because that would require consumers to have an interpreter for the most widely deployed language, ever, and by far. FTFY
- yawnxyz 2y ago
  security nightmare; sometimes you don't want consumers to execute code arbitrarily
  - moralestapia 2y ago
    Not true. Google, Meta, ... do it at a massive scale, no issues. It's not really hard to protect yourself against that. Any (competent) security guy can give you like 4 ways to implement it properly.
    - rererereferred 2y ago
      Do you mean the ads they serve that contain malware?
    - hifromwork 2y ago
      I am a (hopefully competent) security guy, please don't run arbitrary code if you can help it. Especially for something as trivial as JSON patching.
  - kevin_thibedeau 2y ago
    This is what makes Tcl great as a data interchange format. It comes with a safe mode for untrusted code and you can further restrict it to have no control flow commands to be non-Turing.
  - crabmusket 2y ago
    Ok hear me out, what if my API accepts WASM fragments that I run against my database but in a sandbox!
- oguz-ismail 2y ago
  Nah, in that case Python would be a better option as it's already installed everywhere.
  - moralestapia 2y ago
    That is so derangedly untrue.
    - jrockway 2y ago
      Starlark is a nice embeddable scripting language, though. Java, Go, and Rust implementations: https://github.com/bazelbuild/starlark/blob/master/users.md#implementations https://github.com/bazelbuild/starlark/blob/master/users.md#...
- sagacity 2y ago
  But what's your point? Would you truly want consumers of JSON Patch data to embed a JS interpreter?
  - moralestapia 2y ago
    My point is that the JS interpreter is likely already there.
    - _blk 2y ago
      only if you think of JSON in the context of a browser. JSON is used as serialized representation of objects in embedded systems, config files, etc. where a JS interpreter is unnecessary, absent or unwanted (size, security, platform preferences, ...)

tablatom 2y ago

> Why can’t your protocol just be valid JavaScript too? It is.

hyperhello 2y ago
It’s delivered in JSON, but you need an interpreter. But the actions are just JS assignment statements and a little glue. Your interpreter could as easily handle that, and with far less bytes. Why call a member variable /name when it’s already .name?