Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sj.h: A tiny little JSON parsing library in ~150 lines of C99

github.com

Post reply on HN
Print view View original

101–110 of 248 posts

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#101

Post by leptons »

boramalper wrote: post #78
leptons wrote: post #73

Earlier quoted context omitted.

JSON does not necessarily come from untrusted sources if you control the entire system. Not everything needs to be absolutely 100% secure so long as you control the system. If you are opening the system to the public, then sure, you should strive for security, but that isn't always necessary in projects that are not processing public input. Here's an example - I once coded a limited JSON parser in assembly language.…

Untrusted doesn’t always mean adversarial IMO, even a bitrot can invalidate your entire input and possibly also trigger undefined behaviour if you aren’t prepared to handle that.

I was using a checksum to protect against "bitrot" since this was over a very noisy serial transmission line (over a slip ring). So, no, there was no "undefined behavior" and it's quite easy to avoid.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#102

Post by klysm »

Brian_K_White wrote: post #79
klysm wrote: post #39

Earlier quoted context omitted.

Strongly disagree here because JSON can come from untrusted sources and this has security implications. It's not the same kind of problem that the bloat article discusses where you just have bad contracts on interfaces.

Public facing interfaces are their own special thing, regardless if json or anything else, and not all data is a public facing interface. If you need it, then you need it. But if you don't need it, then you don't need it. There is a non-trivial value in the smallness and simplicity, and a non-trivial cost in trying to handle infinity problems when you don't have infinity use-case.

This is a serialization library. The entire point is to communicate with data that's coming from out of process. It should be safe by default especially if it's adding a quick check to avoid overflow and undefined behavior.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#103

Post by tripplyons »

tonypapousek wrote: post #99
maldonad0 wrote: post #97

Earlier quoted context omitted.

It's open source, not free software.

The license says otherwise; hard to get freer than public domain.

Open source is a more informative term for this than free software. Not all free software is open source, but all open source software is free.

Edit: I was not aware of the FSF's definition. I was using a definition of free software being software that you can use without having to pay for it.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#104

Post by leptons »

userbinator wrote: post #77
leptons wrote: post #73

Earlier quoted context omitted.

JSON does not necessarily come from untrusted sources if you control the entire system. Not everything needs to be absolutely 100% secure so long as you control the system. If you are opening the system to the public, then sure, you should strive for security, but that isn't always necessary in projects that are not processing public input. Here's an example - I once coded a limited JSON parser in assembly language.…

You probably didn't control the other end, as otherwise you would've used something more sane than JSON?

I controlled both ends. There is nothing "insane" about JSON. It's used far and wide for many purposes. The system sending the JSON was based on Nodejs, so it was pretty natural to use JSON. And I did it with JSON just because I wanted to. I'd have had to invent some other protocol to do it anyway, and I didn't feel like reinventing the wheel when it was quite simple to write a basic JSON parser in assembly language, which is what I am comfortable with on the embedded system (been coding assembly for 40 years).

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#105

Post by SoKamil »

tonypapousek wrote: post #99
maldonad0 wrote: post #97

Earlier quoted context omitted.

It's open source, not free software.

The license says otherwise; hard to get freer than public domain.

What is the stance of Your Average Corp’s security department on public domain software? Do they accept software under such licensing (or lack thereof)?

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#106

Post by lioeters »

maldonad0 wrote: post #97
lioeters wrote: post #8

What I love about this author's work is that they're usually single-file libraries in ANSI C or Lua with focused scope, easy-to-use interface, and good documentation. And free software license. Aside from the posted project, some I like are: - log.c - A simple logging library implemented in C99 - microui - A tiny immediate-mode UI library - fe - A tiny, embeddable language implemented in ANSI C - microtar - A lightwe…

It's open source, not free software.

Aside from the posted library sj.h which is in public domain (compatible with the definition of "free software"), the author's other projects mostly use the MIT license.

The MIT license upholds the four essential freedoms of free software: the right to run, copy, distribute, study, change and improve the software.

It is listed under "Expat License" in the list of GPL-compatible Free Software licenses.

https://www.gnu.org/licenses/license-list.html

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#107

Post by captbaritone »

tonypapousek wrote: post #99
maldonad0 wrote: post #97

Earlier quoted context omitted.

It's open source, not free software.

The license says otherwise; hard to get freer than public domain.

I recall hearing that SQLite actually had some significant issues with choosing public domain as their license and somewhat regret the decision. Apparently it’s not a concept which has broad understating internationally, and there’s less legal precedent in a software context which has made it harder for some teams to adopt due to concerns from legal departments.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#108

Post by F3nd0 »

maldonad0 wrote: post #97
lioeters wrote: post #8

What I love about this author's work is that they're usually single-file libraries in ANSI C or Lua with focused scope, easy-to-use interface, and good documentation. And free software license. Aside from the posted project, some I like are: - log.c - A simple logging library implemented in C99 - microui - A tiny immediate-mode UI library - fe - A tiny, embeddable language implemented in ANSI C - microtar - A lightwe…

It's open source, not free software.

‘Free software’ and ‘open source software’ (as respectively defined by the FSF [1] and the OSI [2], which is how they’re usually used in practice) have overlapping definitions. The project in question is released into the public domain via the Unlicense, which qualifies as a free software ‘licence’. Many of the other projects use the MIT/Expat licence, which also qualifies as a free software licence.

[1] https://www.gnu.org/philosophy/free-sw.html [2] https://opensource.org/osd

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#109

Post by ghurtado »

leptons wrote: post #73
klysm wrote: post #39

Earlier quoted context omitted.

Strongly disagree here because JSON can come from untrusted sources and this has security implications. It's not the same kind of problem that the bloat article discusses where you just have bad contracts on interfaces.

JSON does not necessarily come from untrusted sources if you control the entire system. Not everything needs to be absolutely 100% secure so long as you control the system. If you are opening the system to the public, then sure, you should strive for security, but that isn't always necessary in projects that are not processing public input. Here's an example - I once coded a limited JSON parser in assembly language.…

> Not everything needs to be absolutely 100% secure so long as you control the system.

Isn't that a bit like saying "you don't have to worry about home security as long as you are the only person who has the ability to enter your house"?

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#110

Post by cozzyd »

paulddraper wrote: post #88
jeroenhd wrote: post #71

Earlier quoted context omitted.

Very few programming languages default to checked increments. Most Rust or Java programmers would make the same mistake. Writing a function to do a checked addition like in other languages isn't exactly difficult, either.

Yes but those languages have defined overflow.

-fwrapv
Post reply on HN