Live data from Hacker News

ECMA-404: The JSON Data Interchange Format [pdf]

ecma-international.org

31–40 of 199 posts

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#31

No thanks to Mr. Crawford for not fixing the \u2028-9 issue. JSON as defined is not a subset of javascript. It is a design mistake that was pointed out to him years ago, but he is too stubborn or arrogant to fix it.

Isn't this a design mistake in JavaScript rather than JSON?

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#33
post #20

No thanks to Mr. Crawford for not fixing the \u2028-9 issue. JSON as defined is not a subset of javascript. It is a design mistake that was pointed out to him years ago, but he is too stubborn or arrogant to fix it.

Why do you ask him without the stubborn and arrogant comment on G+ and about trailing commas? Or is indirect better?

Trailing commas would make the problem worse! If you allow trailing commas then you would break json parsing in all old version of IE. The unicode line ending problem is more subtle.

I have seen people write code like (mix javascript and some templating):

    
    var prefs = ;
    ...
The above code looks okay, but if the json is just spec conforming, then you are exposed to a potential XSS attack.

Most people that write json encoders are aware of the problem, but why publish a a spec that can potentially create serious security problems?

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#34
They say JSON is not for binary and won't change. With a backslash (oops reverse solidus) you could send binary data - eg an image. { myimage: "\01\02\03" } of course, not efficient. You could base64-encode it and put that in a string. I think some syntax for binary would be useful - eg { myimage: 0x010203 }

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#35
post #30

Earlier quoted context omitted.

Why do you believe that using XML is better than JSON in every case? Or am I misinterpreting your comment?

I took it as sarcasm. The "for everything" was the tell.

Poe's Law; it's impossible to tell. There are presumably some companies who think that using XML for everything is appropriate, so it stands to reason that there actually are people who believe that as well.

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#36
post #34

They say JSON is not for binary and won't change. With a backslash (oops reverse solidus) you could send binary data - eg an image. { myimage: "\01\02\03" } of course, not efficient. You could base64-encode it and put that in a string. I think some syntax for binary would be useful - eg { myimage: 0x010203 }

The slash and the solidus are two separate entities. I am not aware of any use of the actual solidus being used for escaping.

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#37
post #20

Earlier quoted context omitted.

Why do you ask him without the stubborn and arrogant comment on G+ and about trailing commas? Or is indirect better?

Probably because he's very aware of it already and people here may not be. (Meta: Why have any conversation on an HN back-channel when there are comments open at the source?)

Meta: because the comments are closed to people with a Google account that have no problems in sharing their comment on G+ publicly

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#38
post #20

Earlier quoted context omitted.

Why do you ask him without the stubborn and arrogant comment on G+ and about trailing commas? Or is indirect better?

Trailing commas would make the problem worse! If you allow trailing commas then you would break json parsing in all old version of IE. The unicode line ending problem is more subtle. I have seen people write code like (mix javascript and some templating): var prefs = ; ... The above code looks okay, but if the json is just spec conforming, then you are exposed to a potential XSS attack. Most people that write json en…

> you would break json parsing in all old version of IE

Why do people still care about old versions of IE?

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#39
post #9

Earlier quoted context omitted.

I'd be interested to know if this has any impact on the "don't be evil" clause in the JSON license.

That's just a license for software available on json.org, so no impact at all.

Where is it on json.org? I can't seem to find it.

Re: ECMA-404: The JSON Data Interchange Format [pdf]

#40
post #23

Does this mean comments will be added to the spec?

Nope, sorry.

This sucks, because it limits the usability of JSON. It should interfere with its being a serialization and interchange format, but for configuration files anything without comments is useless.
Post reply on HN