[Cbor] Re: CBOR Tooling breadth of use

["A.J. Stein" <[e-mail]>]

On Thu, Jul 25, 2024 at 9:03 PM Steve Lasker <[e-mail]>
wrote:

> A.J. – yes, round tripping a serialization format is “easy”-ish. There are
> many aspects that go beyond. Auto-complete, validation, are the generic
> ones. Pulling in public and private CBOR registries are another specific to
> CBOR.
>
Let me more clear: alternative serialization formats are easier to use.
Markup language or not, there are very popular classes of vulnerability
around serializing and deserializing them because it allows developers, we
are all human after all (me included) to make shortcuts.

Beyond vulnerabilities, they support dangerous ambiguities that I,
personally, find incredibly risky where whitespace alignment and weird
gotchas can be find into a complex processor and bring down whole systems
by accident. Ask me how I know! (Sarcasm aside, I have been bitten by these
issues in doing DevOps work and why I am very worried of approving code
changes with configuration management tools that use YAML without
distraction and not quickly approving in less than sixty seconds).

https://en.wikipedia.org/wiki/YAML#Criticism


> I'll throw my hat in helping scope, build, document, evangelize CBOR and
> COSE tooling
>
> Without spamming this WG further, If anyone on this mailing group would
> like to contribute, please let me know and I'd be happy to help facilitate.
>

And I wasn't trying to be overly flippant. I think it is good to discuss
this here or anywhere else, but when working on an emerging technology (it
seems CBOR per RFC 7049 is 11 years old? wow) this issue is always
presented to me or the "early" adopters group. On this list or elsewhere,
it would be nice to know what problems those critics have and how that is
helped at a finer granularity than "where is the tooling I can get with X
or Y?" Believe me, I am not dismissing you with these replies, this thread
is the third or maybe fourth iteration of this theme for me in different
technologies in the last three years (this is the first time in IETF and
not elsewhere). Starting with specific pain points and building an
ecosystem around the system is hard, but details matter.

I am more than happy to engage on this list or elsewhere, let me/us/list
know?