Re: [vwrap] Working Draft: SNOW-375

[Joshua Bell <[e-mail]>]

On Mon, Aug 2, 2010 at 1:28 PM, Dzonatas Sol <[e-mail]> wrote:

>
> In such cases for XML, I currently assume that full secure
> encapsulation/canonicalization is needed to pass on sanity to non-XML
> formats. If we assume XML only, then one valid XML structure is directly
> implantable into another XML structure where allowed (ambiguous tags,
> variable DTDs, intra-tags). I don't see a way for JSON to support
> intra-tags.
>
>
Assuming I'm understanding you correctly...

As in LLSD, everything in JSON is a key or value. So you could easily have:

{ "somekey": "somedata",
  "otherdata": /* your data here */
}

... where the overall JSON payload's value is a map, and value of that map's
key "otherdata" is an arbitrary JSON value in place of the C-style comment
(the above is not valid JSON as written, of course). There is no capability
in JSON for the included data to change the meaning of the container, so
this is as "secure" as in a similar XML usage.

(If you had a buggy output mechanism that didn't output values as valid
fragments, then obviously the payload could render the container invalid.
But this is as true with XML as with JSON - or SQL or ... /me thinks of
little Bobby Tables http://xkcd.com/327/.)

I have written raw XML parsers that fold and unfold structures dynamically,
> and the parser knows nothing about its data or types. I could apply such
> technique instead of encapsulation.
>

Although a JSON parser must be aware of the JSON types (object, array,
string, number, true, false, null), it does not need to be aware of the
interpretation of the data any more than an XML parser that is not also a
validator. While this may seem slightly more complicated than XML (its just
tags, right?), a fully conforming JSON parser is simpler than a fully
conforming XML parser since XML is more feature-rich (whitespace rules,
attributes, character entities, CDATA, namespaces, mixed content, ids, etc).

So, although XML may be superior in other ways, I don't believe this is a
case where JSON is inferior to XML - if I'm understanding your point
correctly.


> When people say they don't like XML, I know they actually mean they don't
> like DTDs, which should have been a separate standard than raw XML.


In my experience, everyone has a favorite XML schema language, and thinks
the others are evil. :)

XML has a tremendous amount of power, but most of the time you need only a
small fraction of that power. (e.g. LLSD's XML serialization doesn't need
namespaces, mixed content, etc). Contrariwise, XML's expressiveness lets you
precisely serialize all of LLSD's types, whereas many LLSD types collapse to
JSON strings.