HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
kstenerud
concise-encoding
ANTLR2019–2024
kstenerud / concise-encoding

concise-encoding

The secure data format for a modern world

5Distinct people
63Mentions
0Explicit recommenders
280GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

The secure data format for a modern world

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 10:02:42 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year63 dated mentions

Observed mentions: 2019-05-31 18:05:03 UTC to 2024-08-13 16:16:01 UTC.

0510152019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 9 mentions; 0 submissions, 9 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 17 mentions; 1 submissions, 16 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 13 mentions; 0 submissions, 13 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 15 mentions; 2 submissions, 13 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2024

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC909
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC17116
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC13013
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC15213
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC615
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC303

What Hacker News says

15 sources
kstenerud·Dec 29, 2022Submission

Ask HN: Please help me by reviewing KBNF

Hi everyone! Merry Christmas and happy new year! I'm making a modernized BNF-style metalanguage that supports grammars for text and binary formats, but unless there's some kind of outside review, I won't find any blind spots I have until long after release. If you have experience in grammars or protocols (text or binary), could you take a quick look? Note: I'm not aiming for perfect expressivity; just 80-90% of use cases without making things overcomplicated so that it can be used descriptively in documentation. https://github.com/kstenerud/kbnf/blob/master/kbnf.md Some examples of it in use: * Internet Prodocol, version 4: https://github.com/kstenerud/kbnf/blob/master/ipv4.kbnf * Concise Text Encoding: https://github.com/kstenerud/concise-encoding/blob/master/cte.kbnf * Concise Binary Encoding: https://github.com/kstenerud/concise-encodi
Read the rest
6 points · Open discussion
Hey thanks for taking the time to critique! I actually do have an ANTLR file that is about 90% of the way there ( https://github.com/kstenerud/concise-encoding/tree/master/an... ), so I could use those as a basis... One thing I'm not sure about is how to define a BNF rule that says for example: "An identifier is a series of characters from unicode categories Cf, L, M, N, and these specific symbol characters". BNF feels very ASCII-centric...
In Keep ’em coming: Why your first ideas aren’t always the best
It's still in the prerelease stage, but v1 will be released later this year. I'm mostly getting hits from China since they tend to be a lot more worried about security. I expect the rest of the world to catch on to the gaping security holes of JSON and friends in the next few years as the more sophisticated actors start taking advantage of them. For example https://github.com/kstenerud/concise-encoding/blob/master/ce... There are still a few things to do: - Update enctool (https://github.com/kstenerud/enctool) to integrate https://cuelang.org so that there's at least a command line schema validator for CE. - Update the grammar file (https://github.com/kstenerud/concise-encoding/tree/master/an...) because it's a bit out of date. - Revamp the compliance tests to be themselves written in Concise Encoding (for example https://github.com/ksten
Read the rest
erud/go-concise-encoding/blob/master... but I'll be simplifying the format some more). That way, we can run the same tests on all CE implementations instead of everyone coming up with their own. I'll move the test definitions to their own repo when they're done and then you can just submodule it. I'm thinking that they should look more like: c1 { "type" = { "identifier" = "ce test" "version" = 1 } "tests" = [ { "name" = "Some kind of test" "success" = [ // These must successfully convert to each other { "cte" = "c1 [1 2 3 4]" "cbe" = |u8x 81 01 7a 01 02 03 04 7b| // Events are a kind of text shorthand for what the parsing of cte or cbe should produce "events" = ["v 1" "l" "n 1" "n 2" "n 3" "n 4" "e"] } { ... } ] "failure" = [ // These must fail to decode { "cte" = "c1 100 ]" } { "cbe" = |u8x 81 01 64 7b| } ] } ] }
In Working in the software industry, circa 1989
Ugh Unicode has been the bane of my existence trying to write a text format spec. I started by trying to forbid certain characters to keep files editable and avoid Unicode rendering exploits (like hiding text, or making structured text behave differently than it looks), but in the end it became so much like herding cats that I had to just settle on https://github.com/kstenerud/concise-encoding/blob/master/ct... Basically allow everything except some separators, most control chars, and some lookalike characters (which have to be updated as more characters are added to Unicode). It's not as clean as I'd like, but it's at least manageable this way.
In Breaking our Latin-1 assumptions (2017)
You might get a kick out of Concise Encoding then (shameless plug). It focuses on security and consistency of behavior. And it supports comments and has first class date types ;-) https://concise-encoding.org/ In particular: * How to deal with unrepresentable values: https://github.com/kstenerud/concise-encoding/blob/master/ce... * Mandatory limits and security considerations: https://github.com/kstenerud/concise-encoding/blob/master/ce... * Consistent error classification and processing: https://github.com/kstenerud/concise-encoding/blob/master/ce...
In I accidentally used YAML.parse instead of JSON.parse and it worked
> - Cyclic data: ASN.1 supports recursive data structures. Not sure if I missed something, but the link was talking about self-referential types, not self-referential data. For example (in CTE): &a:{ "recursive link" = $a } In the above example, `&a:` means mark the next object and give it symbolic identifier "a". `$a` means look up the reference to symbolic identifier "a". So this is a map whose "recusive link" key is a pointer to the map itself. How this data is represented internally by the receiver of such a document (a table, a dictionary, a struct, etc) is up to the implementation, but the intent is for a structure whose data points to itself. > - Time zones: ASN.1 supports ISO 8601 time types, including specification of local or UTC time. Yes, this is the major failing of ISO 8601: They don't have true time zones.
Read the rest
It only uses UTC offsets, which are a bad idea for so many reasons. https://github.com/kstenerud/concise-encoding/blob/master/ce... > - Bin + txt: Again, I'm unclear on what you mean here, but ASN.1 has both binary and text-based encodings Ah cool, didn't know about those. > - Versioned: Also a little unclear to me The intent is to specify the exact document formatting that the decoder can expect. For example we could in theory decide to make CBE version 2 a bit-oriented format instead of byte-oriented in order to save space at the cost of processing time. It would be completely unreadable to a CBE 1 decoder, but since the document starts with 0x83 0x02 instead of 0x83 0x01, a CBE 1 decoder would say "I can't decode this" and a CBE 2 decoder would say "I can decode this". With documents versioned to the spec, we can change even the fundamental structure of the format to deal with ANYTHING that might come up in future. Maybe a new security flaw in CBE 1 is discovered. Maybe a new data type becomes so popular that it would be crazy not to include it, etc. This avoids polluting the simpler encodings with deprecated types (see BSON) and bloating the format.
In Ask HN: Who wants to collaborate?
Yes, I had a look at avro as well. I've been following all of the established and nascant formats over a number of years, hoping for one that addresses my concerns, but unfortunately nothing emerged. My ambitions are actually at a much higher level; this is just to set a solid foundation for them. Cyclic bombs are but one security concern... There are actually a LOT of them, which I try to cover cover in the security section ( https://github.com/kstenerud/concise-encoding/blob/master/ce... ). The security space is of course wider and more nuanced than this, but I didn't want to turn it into an entire tome so I tried to cover the basic philosophical problems. At the end of the day, you must treat data crossing boundaries as hostile, and build your ingestors with that in mind. Sane defaults can avoid the worst of them (and CE actually REQUI
Read the rest
RES sane defaults for a lot of things in order to be compliant), but no format can protect you completely. A "fork bomb" using cyclic data is unlikely, unless your application code is really naive (if you're using cyclic data, you need to have a well-reasoned purpose for it, and are likely just using pointers internally - which won't blow out your memory unless you're doing something foolish when processing the resulting structs). Actually, this does give me an idea... make cyclic data disallowed by default, just to cover the common case where people don't use it and don't even want to think about it. Re time formats: global coordinates will always start with a slash, so 12:00:00/-130/-172. UTC offsets will always start with + or -, and be 4 digits long, so 12:00:00+0130 or 12:00:00-0130. The validation rules are very specific, and that does complicate the text format a bit, but this drives to the central purpose of it: The text format is for the USER, and is not what you send to other machines or foreign systems. It's for a user to edit or inspect or otherwise interact with the data on the RARE occasions where that is necessary. So the text format doesn't need to be fast or efficient, only unambiguous and easy for a human to read. You certainly shouldn't open an internet connected service that accepts the text format as input (except maybe during development and debugging...) In fact, I would expect a number of CE implementations (such as for embedded systems) to only include CBE support, since you could just use a standalone command-line tool or the like to analyze the data in most cases. Re: subfields. That would make it harder for a human to read. The text format sacrifices some efficiency for human friendliness and better UX. Parser logic re-use isn't really a priority (other than making sure it's not OBVIOUSLY bad for the parser), because text parsing/encoding is supposed to be the 0.0001% use case. It's not super easy to add new types to the text format grammar, but that's fine because human friendliness trumps almost all, and adding new types should be done with EXTREME CARE. I've lost count of all the types I've added and then scrapped over the years. It's really hard to come up with these AND justify them! The ANTLR grammar is actually more of a documentation thing. I've verified it in a toy parser but it's not actually tied to the reference implementation (yet). The reference implementation currently is similar to a parser combinator, with a lot of inspiration from the golang team's JSON parser (I watched a talk by the guy some time ago and was impressed). But at the same time I'm starting to wonder if it might have been better to implement the reference implementation as just an ANTLR parser after all... leave the optimizations and ensuing complications to other implementations and keep the reference implementation readable and understandable. The binary format code is super simple, and about 1/3 the size of the text format code. The major downside of ANTLR of course is the terrible error reporting.
In Ask HN: Who wants to collaborate?
Yes, I had a look at these formats before embarking on my venture. I listed the things I found important in the comparison matrix: https://github.com/kstenerud/concise-encoding#-compared-to-o... To your points: - Protobufs is not an ad-hoc format, which is a big reason why low-friction formats like JSON are popular. There are many use cases where formats like protobufs are clearly the superior choice, but CE doesn't target those. This is a fundamental trade-off so you can't have both. - readable-thrift is a diagnostic tool. You wouldn't want to be inputting data like that. I want the text format to be fully usable by non-technical people, like JSON is. - the capn proto tool page doesn't seem to document how the text format works (or at least I couldn't find any examples). It looks more like a diagnostic tool, not a first-class citizen. I
Read the rest
felt that there were enough pain points, missing types, and missing security features (for example versioning) to warrant a fresh start.
In Ask HN: Who wants to collaborate?
Local protobuf user here. Appreciate seeing a comparison chart. :-) It's unfortunate that it isn't documented very well, but Protobuf does have a text format [1] which I've used a lot, usually when writing test cases, but also when inspecting logs. Similar to the CBE encoder spec [2], it does use variable length encoding for ints [3] and preserves the type information. Another efficiency item to compare against different message types is the implementation itself, e.g. memory arenas out of the box. [4] Regarding CE, what would be the use case? APIs, data at rest, inter-service communications? If data at rest meant for analysis, then there probably are a handful more formats to compare against. If one doesn't wish to decode the whole message into memory to read it, FlatBuffers [5] can be checked out which is also supported as a message typ
Read the rest
e in gRPC. It is similar to what is used in some trading systems. There is also a FlexBuffers variation if you'd want something closer to JSON/BSON. Must say however, I found it cool that you have some Mac/iOS GitHub repos. Definitely going take some time to check them out -- I used to develop iOS apps. [1] https://developers.google.com/protocol-buffers/docs/referenc... [2] https://github.com/kstenerud/concise-encoding/blob/master/cb... [3] https://developers.google.com/protocol-buffers/docs/proto3#s... [4] https://developers.google.com/protocol-buffers/docs/referenc... [5] https://google.github.io/flatbuffers/flatbuffers_white_paper...
In Ask HN: Who wants to collaborate?
Ad-hoc data formats like JSON and XML are too insecure for the modern world, so I'm developing a new format to remedy this [1]. It's a twin format, one binary and one text, so that you can input / edit the data in text, and then it passes from machine to machine in binary only (or convert back to text if a human needs to inspect it). The binary format is designed for simplicity and speed, and the text format is designed for human readability. Both formats are designed for security and minimal attack surface, while providing the fundamental data types we use in our daily life (so you're not stuck doing stringification and base64 fields and other such hacks). I've pretty much completed the base format [2], and am 90% done with the golang reference implementation [3] plus some standard compliance tests, but I could use a lot of help: - Revie
Read the rest
wing the specifications and pointing out issues or anything weird or things that seem wrong or don't make sense. - Implementations in other languages. - Ideas for a schema. - Public outreach, championing online. [1] https://concise-encoding.org/ [2] https://github.com/kstenerud/concise-encoding [3] https://github.com/kstenerud/go-concise-encoding
In Ask HN: Who wants to collaborate?

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.