Regarding security: entity expansion bugs have been fixed long ago. In the other hand: people still use eval() on json objects to parse them. So i don't get that. Json schema: which one? Afaik it's not there and there is no single json schema with the tooling depth and breadth of xsd. Protobuf: nice but unreadable for humans. Might as well use corba or asn.1 coding.