Hacker News Reader

Comment by hyperhello | Hacker News Reader

What’s nice about JSON is that it’s actually valid JavaScript, with some formal specification to avoid any nasty circles or injections.

Why can’t your protocol just be valid JavaScript too? this.name = “string”; instead of mixing so many metaphors?

View on HN

Because that would require consumers to have a Javascript interpreter to use it.

Because that would require consumers to have an interpreter for the most widely deployed language, ever, and by far.

FTFY

security nightmare; sometimes you don't want consumers to execute code arbitrarily

Not true. Google, Meta, ... do it at a massive scale, no issues.

It's not really hard to protect yourself against that.

Any (competent) security guy can give you like 4 ways to implement it properly.

Do you mean the ads they serve that contain malware?

I am a (hopefully competent) security guy, please don't run arbitrary code if you can help it. Especially for something as trivial as JSON patching.

This is what makes Tcl great as a data interchange format. It comes with a safe mode for untrusted code and you can further restrict it to have no control flow commands to be non-Turing.

Ok hear me out, what if my API accepts WASM fragments that I run against my database but in a sandbox!

Nah, in that case Python would be a better option as it's already installed everywhere.

That is so derangedly untrue.

Starlark is a nice embeddable scripting language, though. Java, Go, and Rust implementations: https://github.com/bazelbuild/starlark/blob/master/users.md#...

But what's your point? Would you truly want consumers of JSON Patch data to embed a JS interpreter?

My point is that the JS interpreter is likely already there.

only if you think of JSON in the context of a browser. JSON is used as serialized representation of objects in embedded systems, config files, etc. where a JS interpreter is unnecessary, absent or unwanted (size, security, platform preferences, ...)

> Why can’t your protocol just be valid JavaScript too?

It is.

It’s delivered in JSON, but you need an interpreter. But the actions are just JS assignment statements and a little glue. Your interpreter could as easily handle that, and with far less bytes. Why call a member variable /name when it’s already .name?

Reply on news.ycombinator.com