5 ms·

Because that would require consumers to have a Javascript interpreter to use it.

moralestapia 2y ago
Because that would require consumers to have an interpreter for the most widely deployed language, ever, and by far. FTFY
- yawnxyz 2y ago
  security nightmare; sometimes you don't want consumers to execute code arbitrarily
  - moralestapia 2y ago
    Not true. Google, Meta, ... do it at a massive scale, no issues. It's not really hard to protect yourself against that. Any (competent) security guy can give you like 4 ways to implement it properly.
    - rererereferred 2y ago
      Do you mean the ads they serve that contain malware?
    - hifromwork 2y ago
      I am a (hopefully competent) security guy, please don't run arbitrary code if you can help it. Especially for something as trivial as JSON patching.
  - kevin_thibedeau 2y ago
    This is what makes Tcl great as a data interchange format. It comes with a safe mode for untrusted code and you can further restrict it to have no control flow commands to be non-Turing.
  - crabmusket 2y ago
    Ok hear me out, what if my API accepts WASM fragments that I run against my database but in a sandbox!
- oguz-ismail 2y ago
  Nah, in that case Python would be a better option as it's already installed everywhere.
  - moralestapia 2y ago
    That is so derangedly untrue.
    - jrockway 2y ago
      Starlark is a nice embeddable scripting language, though. Java, Go, and Rust implementations: https://github.com/bazelbuild/starlark/blob/master/users.md#implementations https://github.com/bazelbuild/starlark/blob/master/users.md#...
- sagacity 2y ago
  But what's your point? Would you truly want consumers of JSON Patch data to embed a JS interpreter?
  - moralestapia 2y ago
    My point is that the JS interpreter is likely already there.
    - _blk 2y ago
      only if you think of JSON in the context of a browser. JSON is used as serialized representation of objects in embedded systems, config files, etc. where a JS interpreter is unnecessary, absent or unwanted (size, security, platform preferences, ...)

Because that would require consumers to have an interpreter for the most widely deployed language, ever, and by far. FTFY

yawnxyz 2y ago
security nightmare; sometimes you don't want consumers to execute code arbitrarily
- moralestapia 2y ago
  Not true. Google, Meta, ... do it at a massive scale, no issues. It's not really hard to protect yourself against that. Any (competent) security guy can give you like 4 ways to implement it properly.
  - rererereferred 2y ago
    Do you mean the ads they serve that contain malware?
  - hifromwork 2y ago
    I am a (hopefully competent) security guy, please don't run arbitrary code if you can help it. Especially for something as trivial as JSON patching.
- kevin_thibedeau 2y ago
  This is what makes Tcl great as a data interchange format. It comes with a safe mode for untrusted code and you can further restrict it to have no control flow commands to be non-Turing.
- crabmusket 2y ago
  Ok hear me out, what if my API accepts WASM fragments that I run against my database but in a sandbox!
oguz-ismail 2y ago
Nah, in that case Python would be a better option as it's already installed everywhere.
- moralestapia 2y ago
  That is so derangedly untrue.
  - jrockway 2y ago
    Starlark is a nice embeddable scripting language, though. Java, Go, and Rust implementations: https://github.com/bazelbuild/starlark/blob/master/users.md#implementations https://github.com/bazelbuild/starlark/blob/master/users.md#...
sagacity 2y ago
But what's your point? Would you truly want consumers of JSON Patch data to embed a JS interpreter?
- moralestapia 2y ago
  My point is that the JS interpreter is likely already there.
  - _blk 2y ago
    only if you think of JSON in the context of a browser. JSON is used as serialized representation of objects in embedded systems, config files, etc. where a JS interpreter is unnecessary, absent or unwanted (size, security, platform preferences, ...)