Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is JSON so popular? Developers want out of the syntax business

blog.mongolab.com

Post reply on HN
Print view View original

121–130 of 133 posts

Re: Why is JSON so popular? Developers want out of the syntax business

#121

Post by prewett »

geebee wrote: post #116
RyanMcGreal wrote: post #99

Earlier quoted context omitted.

In fairness, I pared down the example for clarity (and to protect the guilty).

Oh, it wasn't meant as a criticism. I think my original misperception just strengthens your point. XML written as simply as possible is still more complicated than JSON. That said, I feel about XML much the same way I feel about Java. They are typcially more complicated and verbose than the alternatives, but I don't think you can pin the horrendous level of complexity on the languages themselves. There seems to be a…

> but there's no reason you can't describe data in XML in a way that is concise, reasonably, simple, and easy to read (both for people and computers)

Yes, there is. Each item in XML requires 5 + len(tag) extra characters, minimally: asdf. Unless you make everything a property (e.g. ), in which case you only need 5 extra characters () per parent item. JSON is minimal: you need no extra characters (or, arguably, 2 extra characters for strings with no spaces)

That's for people. It's even worse for machines, because they have to be able to parse asdf and and ... and then be able to verify it using a schema external to the XML in question.

What I don't understand is why people ever thought XML was a good idea. I took one look at in back in '98 when it came out (or whenever it was) and said "this isn't human readable (unless maybe you like writing your HTML by hand)" and proceeded to successfully ignore it unless I have to use it.

Re: Why is JSON so popular? Developers want out of the syntax business

#122

Post by RyanMcGreal »

geebee wrote: post #116
RyanMcGreal wrote: post #99

Earlier quoted context omitted.

In fairness, I pared down the example for clarity (and to protect the guilty).

Oh, it wasn't meant as a criticism. I think my original misperception just strengthens your point. XML written as simply as possible is still more complicated than JSON. That said, I feel about XML much the same way I feel about Java. They are typcially more complicated and verbose than the alternatives, but I don't think you can pin the horrendous level of complexity on the languages themselves. There seems to be a…

> I feel about XML much the same way I feel about Java.

Heh. The SOAP WSDL I'm dealing with was generated by a Java application, and it has the Java cultural stamp all over it.

Re: Why is JSON so popular? Developers want out of the syntax business

#123

Post by natural219 »

lazylland wrote: post #118

I recall having an easy time de/serializing XML in C# ... you don't HAVE to get into the syntax business if you don't want to. And I think the Java also has something analogous in the JAXB library

If you work with any data that's remotely complicated (i.e. practically any relational data), then you get into some pretty hefty messes with C#'s and JAXB's serializers. Unless you know XML schemas thoroughly, trying to map pointers in serialized XML is a mess.

Re: Why is JSON so popular? Developers want out of the syntax business

#124

Post by jasonlotito »

RyanMcGreal wrote: post #100
jasonlotito wrote: post #74

Earlier quoted context omitted.

Are you really having to deal with the SOAP protocol yourself? I mean, their are libraries that handle all this for you. Just read in the WSDL, and call the methods as you need them. No need to muck around with XML.

Afraid not. The WSDL is so baroque, so deeply nested with objects inside objects inside objects, that no SOAP client is capable of parsing it. To write requests, I've had to resort to building templates manually. To read responses, I've had to resort to walking the DOM tree to hunt-and-peck for the fields I need.

Would a JSON implementation be better then? I mean, it sounds like the design is just painful, and regardless of the implementation it would be horrible.

Or do you think JSON encourages simplicity enough to overcome these issues? That the person who created his interface would have created something cleaner?

I guess what I'm asking is, is it the API that sucks, or the implementation (or both)?

* I've never had issues with XML-RPC or SOAP implementation. I prefer JSON because it can use it from JavaScript easily. But having consumed SOAP and XML-RPC API's (mostly with banks), I've never had problems that I'd blame on the implementation.

Re: Why is JSON so popular? Developers want out of the syntax business

#125

Post by Goladus »

RyanMcGreal wrote: post #20

The best way I've encountered to construct XML: first-name John last-name Smith I kid you not. That's what I'm dealing with at work right now. Thank you, enterprise SOAP solutions.

I can't fairly evaluate that without understanding why it was done that way. It looks to me like something that might have been dumped from a database table named "person" with two columns one called "name" the other called "value."

It might be a lazy way to dump the database but that's not XML's fault.

Re: Why is JSON so popular? Developers want out of the syntax business

#126

Post by olliej »

ajross wrote: post #40
olliej wrote: post #4

The post actually appears to endorse using eval to parse JSON. Not only does that allow invalid JSON through, it disallows some valid JSON, and of course is a huge security hole. If you want to handle JSON data in JavaScript use JSON.parse -- it's the safest, fastest, and most correct path to having your data available to you. [update: edited to remove bizarre use of whole vs hole... boggles ]

I gotta ask: that just sounds wrong to me. The fact that it used a built-in parser was supposed to have been a feature of JSON. Have we pedantricized that into a bad thing now too? What's the disadvantage of "allowing invalid JSON" in an application protocol you control? Likewise, what's the value of valid JSON (I honestly don't know what the example here is) that can't be parsed by a Javascript interpreter? And wher…

The moment you use eval to parse "JSON" data you _are_ trusting content from the client. eval _executes_ javascript, JSON just happens to be mostly compatible with JS object and array literal syntax so it "Just Works".

Because eval is executing the data it is using the full JS parser. That means that while '{"name":"bill"}' works as expected '{"name": window.location = "myevildownload.com"}' does too.

JSON.parse is built into the language. It enforces strict JSON conformance so you can't end up accidentally having invalid content that won't be parsed by other JSON libraries, and it does not execute data -- it creates the object graph and nothing else. If there's anything that is not valid JSON it fails and has no side effects. When constructing the object graph it uses the real Object and Array constructors, so nothing can be injected that way. When setting properties on objects it sets them directly and does not call setters.

If you use JSON.parse to parse your JSON data, it is not possible for an attacker to either run or inject code in your site.

And it's faster than eval.

Re: Why is JSON so popular? Developers want out of the syntax business

#128

Post by olavk »

cheez wrote: post #113
olavk wrote: post #68

Earlier quoted context omitted.

I think it is the other way around. XML is explicitly designed to be writable and editable by hand, which is also the reason for some of it's syntactic redundancy.

If you think XML is writable, you are a bigger man than me.

You need to understand the initial use case for XML. It was invented for document-oriented markup languages like HTML, MathML, Docbook etc. You can definitely write XHTML by hand, and a JSON-based syntax for the same kind of documents (which mixed content and so on) would be a lot harder to read and write.

Re: Why is JSON so popular? Developers want out of the syntax business

#129

Post by majmun »

olliej wrote: post #126
ajross wrote: post #40

Earlier quoted context omitted.

I gotta ask: that just sounds wrong to me. The fact that it used a built-in parser was supposed to have been a feature of JSON. Have we pedantricized that into a bad thing now too? What's the disadvantage of "allowing invalid JSON" in an application protocol you control? Likewise, what's the value of valid JSON (I honestly don't know what the example here is) that can't be parsed by a Javascript interpreter? And wher…

The moment you use eval to parse "JSON" data you _are_ trusting content from the client. eval _executes_ javascript, JSON just happens to be mostly compatible with JS object and array literal syntax so it "Just Works". Because eval is executing the data it is using the full JS parser. That means that while '{"name":"bill"}' works as expected '{"name": window.location = "myevildownload.com"}' does too. JSON.parse is b…

> The moment you use eval to parse "JSON" data you _are_ trusting content from the client. eval _executes_ javascript, JSON just happens to be mostly compatible with JS object and array literal syntax so it "Just Works".

not nesseserily , this attack could be easily mitigated if supposed JSON string is first parsed and validated on server. and only then send back to eval() on browser.

so it is therefore not inherently unsafe to use eval() on JSON.

Post reply on HN