News for hackers. Stuff that matters.
Re:Connect-Web: TypeScript library for calling RPC servers f... by dathinab on Thursday August 04, 2022 @06:04PM (#32348892)
the idea of protobuf is "init to default value and then incremental merge message fragments".

Which is even more crazy then missing parts have default value, when you consider how that behaves in some cases of mismatching schemas (it also can introduce annoying limitations when trying to create idiomatic libraries in some languages, especially such with "type-safety").

And then add in some of the "automatic type conversions it does".

And to top if of some edge cases tend to very often diverge in implementations of different languages, no matter what the original intention was.

And the result is uh, just uh, very very uh.

I understand why google uses them, it fits them. It probably a good idea given google scale problems, company and team structure and "skill level" of each member.

But that doesn't mean it's a good fit for everyone.

Re:Connect-Web: TypeScript library for calling RPC servers f... by jeffbee on Thursday August 04, 2022 @06:09PM (#32348940)
To be fair to protobuf, its own docs make no claims about "safe". That is projected upon it by people who do not understand it.
Re:Connect-Web: TypeScript library for calling RPC servers f... by xyzzy_plugh on Thursday August 04, 2022 @09:53PM (#32350566)
protobuf can certainly be type safe, but "protobuf" means many things, which is confusing. My understanding is that type safety comes in the form of generated clients/servers.

> That is projected upon it by people who do not understand it.

This is the the most Googley response possible. If it's so hard to understand, maybe Google should have done a better job of explaining it?

Re:Connect-Web: TypeScript library for calling RPC servers f... by jeffbee on Thursday August 04, 2022 @11:18PM (#32351134)
One peer has no reason to believe that the other is using compatible generated code. I can encode AreCatsCuteRequest and you can decode NukeRussiaRequest. There is no safety in it, anywhere. Confusion about with whom you are communicating has caused real, notorious outages, even at Google.
Re:Connect-Web: TypeScript library for calling RPC servers f... by xyzzy_plugh on Thursday August 04, 2022 @11:35PM (#32351249)
Isn't this much of the point of gRPC? To generate clients/servers so that sending the wrong request to the wrong endpoint is much more difficult and inconvenient?

This property doesn't seem unique to protobuf nor does it seem relevant to type safety. If you're referring to protobuf's binary encoding as being problematic due to field numbers and default values, then sure, I agree that's a weakness, but again that's not what most people refer to when taking about type safety. It's perfectly reasonable to use protobuf as an IDL and not as an encoding.

> Confusion about with whom you are communicating has caused real, notorious outages, even at Google.

What does this have to do with type safety? This is authentication. mTLS and to a lesser extent TLS practically solve this.