Re: [Json] JSON or I-JSON?

Most of the I-JSON constraints are good for interoperability, and as Anders
points out, the lack of a distinct Integer type means that some
applications must use String rather than Number to represent Integers.  But
section 4.2 ("must-ignore") is anathema to security, and the fact that that
is not even discussed in RFC 7493's security considerations is negligent.

If you are designing a protocol that uses, for example, Reputons (
https://tools.ietf.org/html/draft-ietf-repute-media-type-13#section-3.1),
and a Reputon can contain megabytes of malware, or mpegs of cats being
cute, or 14th century pornography (
https://github.com/oasis-tcs/openc2-usecases/blob/master/Cybercom-Plugfest/TestData/slpf%2Bacme/commands/bad/create_poetry.json),
that isn't necessarily a good thing for the Internet.

Dave

On Fri, Feb 26, 2021 at 10:03 AM Tim Bray <tbray@textuality.com> wrote:

> I personally would use I-JSON if possible because it has useful MUSTs in
> it to help resolve arguments between implementors.  [But then, I edited the
> RFC, so I would.]  There's one downside, which is that as far as I know,
> there's little software that actually enforces the I-JSON constraints.
>
> On Fri, Feb 26, 2021 at 6:55 AM Pete Cordell <petejson@codalogic.com>
> wrote:
>
>> On 26/02/2021 13:59, John Cowan wrote:
>> >
>> >
>> > On Fri, Feb 26, 2021 at 7:49 AM Anders Rundgren
>> > <anders.rundgren.net@gmail.com <mailto:anders.rundgren.net@gmail.com>>
>> > wrote:
>> >
>> >     If the standard-to-be is supposed to interoperate with browsers and
>> >     node.js the only viable option is RFC7493.
>> >
>> >     If the standard-to-be also targets the financial market, further
>> >     constraints apply since floating point arithmetic is ill-suited for
>> >     monetary operations. E.g. a monetary amount of 46.99 should be
>> >     represented in JSON as the string "46.99".
>> >
>> >
>> > RFC 8259 incorporates all of the restrictions of 7493 as
>> > interoperability warnings, including the one above.  That way it stays
>> > compatible with ECMA-404 (which has no such restrictions or warnings)
>> > but still steers you away from the dark corners of JSON.
>>
>> RFC 8259 tells you "that way lies madness" but doesn't actually tell you
>> to not to go that way!  RFC 7493 makes it explicit not to go that way
>> for those that might otherwise say "well you didn't tell me not to...".
>>
>> Pete.
>> --
>> ---------------------------------------------------------------------
>> Pete Cordell
>> Codalogic Ltd
>> C++ tools for C++ programmers, http://codalogic.com
>> Read & write XML in C++, http://www.xml2cpp.com
>> ---------------------------------------------------------------------
>>
>> _______________________________________________
>> json mailing list
>> json@ietf.org
>> https://www.ietf.org/mailman/listinfo/json
>>
> _______________________________________________
> json mailing list
> json@ietf.org
> https://www.ietf.org/mailman/listinfo/json
>