bad_json_parsers

> The serializers, http servers, etc. are probably not worth the squeeze to force into a functional domain. These are two examples I would probably come up with if you asked me “where does FP thoroughly beat imperative?” (De)Serializers - parser combinator libraries like attoparsec absolutely BTFO imperative parser libraries in most dimensions. Bidirectional codec libraries like haskell’s Binary, Serial, Aeson[1] are top-tier. Functional formatters like Blaze are top-tier as well. Haskell’s HTTP ecosystem is massively better than anything else I’ve used, and I went on a binge of trying a ton of HTTP servers like 6 years ago (in python, ruby, C++, Go, and finally Haskell). [1] https://github.com/lovasoa/bad_json_parsers

The author has now added this as an aside: https://github.com/lovasoa/bad_json_parsers/commit/16f6ed75b...

To be fair, the article was updated to address those complaints after the comment you're responding to was made. https://github.com/lovasoa/bad_json_parsers/commit/16f6ed75b...

To be fair, that text was added after the above comment was posted. https://github.com/lovasoa/bad_json_parsers/commit/16f6ed75b...

They’ve changed the title[1] to remove the phrasing “bad,” I think the title should be updated here as well, even if the repo name still reflects the original title. It’s not reasonable to use this single criteria as a measure of “badness,” as there are many different variables. I would place security/memory safety 1000x higher than recursion limits. I have never hit JSON recursion limits in production. [1]: https://github.com/lovasoa/bad_json_parsers/commit/16f6ed75b...

On the topic of malicious input, the serde_json example seems to be deliberately limiting recursion depth in order to head off DoS attacks: "serde_json has a recursion limit to protect from malicious clients sending a deeply recursive structure and DOS-ing a server. However, it does have an optional feature unbounded_depth that disables this protection. It still uses the stack though, so it will still eventually blow the stack instead of using all available memory" https://github.com/lovasoa/bad_json_parsers/issues/7 This begins to suggest that it may be downright desirable for servers to toss out deeply-nested JSON, regardless of the JSON specification.