News for hackers. Stuff that matters.
Re:Parsing JSON Is a Minefield (2016) by kortex on Monday October 11, 2021 @09:27AM (#28828058)
> I highly encourage any greenfield project to look into well designed and better specified alternatives.

Like what?

Re:Parsing JSON Is a Minefield (2016) by jerf on Monday October 11, 2021 @09:31AM (#28828108)
Part of the problem is that there's at least half-a-dozen high quality answers out of the gate (gRPC, FlatBuffers, Protocol Buffers, XML in some cases, Thrift), and an even-longer long tail after that. It's made harder when four different teams who deeply loathe JSON and independently decide to use something "better" can legitimately use four completely different technologies if they don't communicate with each other.
Re:Parsing JSON Is a Minefield (2016) by 35fbe7d3d5b9 on Monday October 11, 2021 @09:40AM (#28828185)
To your comment above – you can bodge around interop problems with JSON in ways that you cannot with some of these other technologies.

I like to joke that I invented ndjson over a decade ago when I accidentally forgot to put things in an array before `json.dumps`, I just wasn't smart enough to call it a standard. But when you do end up with ndjson when you wanted an array of results, or vice versa, JSON makes it easy to munge things to where you need.

Compare that to something like protobuf: it's not a self-synchronizing stream, so if you send someone multiple messages without framing them (prefix by length or delimited are popular approaches), they're going to decode a single message that doesn't make much sense on the other end. And they won't be able to fix it at all.

So I guess JSON is New Jersey style design[1].

[1]: https://dreamsongs.com/RiseOfWorseIsBetter.html

Re:Parsing JSON Is a Minefield (2016) by q3k on Monday October 11, 2021 @11:50AM (#28829681)
> Compare that to something like protobuf: it's not a self-synchronizing stream, so if you send someone multiple messages without framing them (prefix by length or delimited are popular approaches), they're going to decode a single message that doesn't make much sense on the other end. And they won't be able to fix it at all.

FWIW, this is a conscious design decision with Protobuf: it allows for easy upsert operations on serialized messages by appending another message with the updated field values. This is very useful for middleware that wants to either just add its own context to a message it doesn't even parse [1], or for middleware that might handle protobuf messages serialized with unknown fields.

On the other hand, 'newline delimited protobuf' is much less useful day-to-day than ndjson, as gRPC provides message streaming, which solves the issue of wanting to stream small elements of a long response (which is the general usecase of ndjson from my experience). For on-disk storage of sequential protobufs (or any other data, really), you should be using something like riegeli [2], as it provides critical features like seek offsets, compression and corruption resiliency.

[1] - eg. passing a Request message from some web server frontend, through request routers, logging, ACL and ratelimit systems up to the actual service handling the request.

[2] - https://github.com/google/riegeli

Re:Parsing JSON Is a Minefield (2016) by kortex on Monday October 11, 2021 @11:37AM (#28829544)
Well, you invented one of the best things since sliced bread! I love NDjson, being able to parse a sequence of {} objects as an array is just frankly more natural. A coworker got some absurd speedup going from some massive json array to ndjson.

Honestly if json had as part of its spec line-delimited arrays, and accepting NaN, it'd be close to perfect. Oh and native ints, but that is JS's problem.

Well, and a single, canonical spec. And a hard limit (however high) on nesting depth. And some other things. Ok, maybe it's far from perfect.

Re:Parsing JSON Is a Minefield (2016) by syncsynchalt on Monday October 11, 2021 @11:53AM (#28829723)
> teams who deeply loathe JSON

In the current world this seems like a lifestyle choice that sets yourself up for constant self-punishment.

I might be a curmudgeon but I'll take JSON for data interop any day over anything that _requires_ tooling (protobuf, gRPC). And I'll take it over the XML ecosystem too.

The faults of JSON seem, in practice, to be less harmful than the faults of other formats.

Re:Parsing JSON Is a Minefield (2016) by q3k on Monday October 11, 2021 @09:37AM (#28828160)
My preference is Protobuf, but really anything that's not JSON and which also comes with some IDL gets my approval.
Re:Parsing JSON Is a Minefield (2016) by kortex on Monday October 11, 2021 @09:43AM (#28828209)
I like protobuf for some use-casess (namely grpc) but a) it's a binary format and sometimes (often times) it's nice to have a text protocol

b) protobuf libraries and protoc have given me way more grief overall than json (python, js, c++)

If your workflow already supports it, I can see it being useful, but it's got a pretty steep learning curve to be honest, certainly more than json, despite the ill-implemented libs out there. If I wanted a binary format, IMHO I'd go for msgpack first, and reach for protobuf if that didn't work for me.

Re:Parsing JSON Is a Minefield (2016) by elteto on Monday October 11, 2021 @11:00AM (#28829073)
> I like protobuf for some use-casess (namely grpc) but a) it's a binary format and sometimes (often times) it's nice to have a text protocol

Protobuf (and flatbuffers) supports parsing messages from JSON instead of a binary blob. Best of both worlds IMO.

Re:Parsing JSON Is a Minefield (2016) by avmich on Monday October 11, 2021 @11:20AM (#28829331)
Can you use JSON Schema? Generating classes from it, if you want native objects?
Re:Parsing JSON Is a Minefield (2016) by q3k on Monday October 11, 2021 @12:37PM (#28830172)
You can use whatever you want :).

I personally would rather still go with Protobuf if I'm going to put in the effort to add a schema and codegen. It gives me other nice-to-have features (faster [de]serialization, smaller messages, field numbers and schema evolution, nicer IDL [not JSON!], gRPC, ...) and does away with some problems intrinsic to JSON that no schema system will fix (terrible number type, lack of binary type, slow parsing). It also has some interop with JSON in the rare case you absolutely positively need to convert to/from it (which is IMO the only upside of using JSON Schema in case you need that interop).

Re:Parsing JSON Is a Minefield (2016) by NavinF on Monday October 11, 2021 @01:11PM (#28830544)
Re:Parsing JSON Is a Minefield (2016) by 0xbadcafebee on Monday October 11, 2021 @10:13AM (#28828525)
YAML. Of course implementations of this go all over the place too, but you could say the same of XML parsers to a certain extent.

I still pine for binary-only data formats. They're easier to program, and nobody makes the mistake of trying to edit them manually or compose them in a shell script. Parsing data shouldn't be hard, but it also shouldn't be so easy that people hang themselves by accident.

Of course, the reason why we largely have text data formats is because it's insanely simpler to troubleshoot systems that use them. Some things should just be easier to manipulate. But for general purpose work, I miss binary data formats.

Zip is probably my favorite general-purpose binary data format. It's old, well defined, works with any kind of data, and you can immediately seek to data in very large archives rather than having to parse the entire thing first. And then there's that whole compression thing. If you wanted to distribute a thousand tiny blobs of CSV, JSON, YAML, and XML, all in one container, you could do much worse than Zip.

Re:Parsing JSON Is a Minefield (2016) by rjh29 on Monday October 11, 2021 @10:34AM (#28828766)
I've had a number of negative experiences with yaml, enough to put me off using it. For example the implicit parsing of 'yes' and 'no' into bools rather than strings (including the NO country code for Norway) <https://hitchdev.com/strictyaml/why/implicit-typing-removed/>, the no-quote rules allowing accidental creation of inline hashes/arrays <https://hitchdev.com/strictyaml/why/flow-style-removed/>, multiline string syntax so complex that it needs a helper tool <http://yaml-multiline.info/>, and powerful extensions that invite your program to be exploited <https://www.sitepoint.com/anatomy-of-an-exploit-an-in-depth-...>

It manages to be both a poor data interchange language compared to JSON, and also a bad human-friendly langage due to the above ambiguities.

Unfortunately it's still the best human-friendly configuration language in wide use, so I use strictyaml (https://hitchdev.com/strictyaml/) instead.

Re:Parsing JSON Is a Minefield (2016) by kortex on Monday October 11, 2021 @11:13AM (#28829253)
NO is not even the worst of it. `on`, like in github actions, is interpreted as True by PyYaml by default. You have to either quote it, "on", or set certain configs I haven't bothered with just yet.

I fully agree YAML is just...not good as a transport/interchange serde.

Personally, I actually really like HCL as a human-friendly config language, but it's got challenges in writing it, and thus support in most languages, if even present, is read-only.

Will look into strictyaml!

Re:Parsing JSON Is a Minefield (2016) by 0xbadcafebee on Tuesday October 12, 2021 @11:19AM (#28840801)
Sorry, I should have been more explicit: YAML should never, ever, be edited by a human. Neither should JSON. But they can be read by a human, and copy+pasted, which makes them easier to troubleshoot.

All of the problems you list of YAML are due to humans making assumptions, rather than having a program do all of the serialization/deserialization. YAML has a ton of useful data structures and they do not cause problems when you use a real parser to populate or interpret them. It's also a superset of JSON, so it's clearly not poor in comparison to JSON.

It's also not a configuration language. It's a data serialization format.

Re:Parsing JSON Is a Minefield (2016) by rjh29 on Friday October 15, 2021 @04:50AM (#28875722)
That might be what the authors want (the 1.0 spec mentioned configuration, the 1.2 spec mostly mentions data serialization) but in terms of actual use, it's pretty widely used as a configuration language. There would be no need for optional quote rules, inline hashes/lists or multiple flow styles (all of which YAML supports) if it was purely a serialization language.

If you make something human-readable, humans will edit it. The only reliable way to prevent that is to make the serialisation format binary, IMO.

YAML also supports a number of really powerful features like you point out (tags, anchors etc.) but I don't see them widely used due to security risks with untrusted input, and interlanguage compatibilty problems. So personally I don't think it's a super good data serialisation language either, despite its power, at least compared to something like Protobuf.

Re:Parsing JSON Is a Minefield (2016) by richardwhiuk on Monday October 11, 2021 @03:08PM (#28831796)
YAML has all of the problems of JSON with some of the problems of XML, and some new ones thrown in. Avoid.
Re:Parsing JSON Is a Minefield (2016) by kortex on Monday October 11, 2021 @11:21AM (#28829350)
Zip isn't a binary data structure protocol though, it just provides a compression protocol. I'd argue that while zip is technically older than gzip (3 years, 89 vs 92), it was proprietary for much of its history, and thus gz is an older "standard".
Re:Parsing JSON Is a Minefield (2016) by 0xbadcafebee on Tuesday October 12, 2021 @11:23AM (#28840854)
None of these are protocols. Zip is an archive format for files (including binaries), not a 'compression protocol'. It doesn't even have to use compression.

As far as 'standards' go, literally nothing uses Gzip/DEFLATE outside of Linux machines and HTTP clients/servers. Gzip isn't even an archive format.

Re:Parsing JSON Is a Minefield (2016) by prionassembly on Monday October 11, 2021 @11:07AM (#28829165)
Is anyone sending sqlite binary blobs over the wire? Foreign keys as a replacement for recursive arrays sounds like a win...
Re:Parsing JSON Is a Minefield (2016) by BerislavLopac on Monday October 11, 2021 @11:46AM (#28829642)
TOML?