Re: [Json] What are we trying to do?

[Nico Williams <[e-mail]>]

On Wed, Jul 3, 2013 at 12:01 AM, Tim Bray <[e-mail]> wrote:
> [...]

+1.

> What the industry really needs is a document normatively describing
> JSON-as-best-practiced, with an RFC number.  It would say that senders MUST
> NOT do X and Y, and that receivers, upon encountering X OR Y, MUST DO Z.
> Thus  other spec writers can say “Do what RFCXXXX says” and not have to
> resort to the sort of drafting pain that the people in Jose are experiencing
> right now in order to avoid attacks on cryptographically signed protocol
> elements by exploiting variation in dupe-key handling.

I'd be happy with either of:

 - no update to RFC4627, but a BCP, and possibly an FYI about what
ECMAScript (and others) do,

or

 - an update to RFC4627 noting the divergent interpretations and only
absolute minimal normative language additions for which we have
consensus (possibly none) (and remove the safe-for-eval regexp
nonsense), plus a BCP.

I might be happy with just concluding, but only as a last resort.

> Is it the sense of the WG that such a document is within our mandate?  -T

We should recharter if it isn't, and either way we should then
publish.  If we can't either find it in the charter nor get consensus
to re-charter then we should conclude (and take some more painkillers,
then promptly forget this episode).

So that's a big +1 from me.

Nico
--