Top all-time · #723
Nicolas Seriot
Personal blog · seriot.chsecurityprogramming
Nicolas Seriot's personal blog at seriot.ch covers security and programming. Since 2009, 89 different Hacker News readers have linked it 143 times, most often “Parsing JSON is a Minefield”. No feed was found, so read it on the site itself.
Rarely recommended · 5 of 40 sampled comments recommend it?
Why HN links it
HN readers link his JSON parsing post as the reference for JSON's loose specification and for how different parsers disagree on edge cases. Commenters cite its test results across parsers.
- Recommended for · 5 comments
- a great practical analysis of parsers and the spec(s); a useful resource; still relevant, worth reading; neat, worth looking into
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Parsing JSON is a Minefield41 people · 46 mentions · first linked 2016-10-26
- Parsing JSON Is a Minefield (2018)21 people · 21 mentions · first linked 2021-12-26
- Parsing JSON Is a Minefield (2016)9 people · 10 mentions · first linked 2021-10-11
- Jira Is Turing Complete4 people · 4 mentions · first linked 2026-05-22
- /json/pruned_results.png3 people · 3 mentions · first linked 2016-10-26
- iPhone Privacy3 people · 3 mentions · first linked 2009-12-05
- PSChess – A chess engine in PostScript3 people · 3 mentions · first linked 2024-03-23
- Simulating Turing Machines with Wang Tiles2 people · 2 mentions · first linked 2023-05-01
- Writing a Minimal Mach-O Executable File2 people · 2 mentions · first linked 2014-11-08
- Abusing Twitter API2 people · 2 mentions · first linked 2012-11-28
What Hacker News says?
JSON gets the most important thing right: it's simpler than XML. I probably should have rephrased my comment. I literally mean that it's a decent format, but not a great one. One issue is that it's surprisingly poorly specified: http://seriot.ch/parsing_json.php . As a data-interchange format, it lacks first class dates/timestamps, the issues about specification are a pain when dealing with numbers (depending on lan…
Comment linking /parsing_json.php
on “It’s time to kill the web app”Submitted Parsing JSON is a Minefield as a story · 559 points
HN discussionIn theory, yes. In practice, there are throngs of parsers and converters who might handle such cases differently . https://seriot.ch/projects/parsing_json.html
Comment linking /projects/parsing_json.html
on “UTF-8 is a brilliant design”Submitted Parsing JSON is a Minefield as a story · 339 points
HN discussionThat _shouldn't_ be ambiguous, `false` is a valid JSON document according to specification, but not all parsers are compliant. There's some interesting examples of ambiguities here: https://seriot.ch/projects/parsing_json.html
Comment linking /projects/parsing_json.html
on “A love letter to the CSV format”Submitted PSChess – A chess engine in PostScript as a story · 203 points
HN discussion> The JSON spec fits on two screen pages https://www.json.org/json-en.html The beloved minimalist spec. . No way anything could be wrong with that: https://seriot.ch/projects/parsing_json.html Turns out there are at least half a dozen more specs. trying and failing to clarify that mess.
Comment linking /projects/parsing_json.html
on “XSLT RIP”Submitted Parsing JSON Is a Minefield (2016) as a story · 184 points
HN discussionAgree. This is another useful resource, discussed here already - http://seriot.ch/parsing_json.php - which lists relevant standards. But "the" standard is static, so divergence, is any, is with other standards (different from json.org) vs. evolving JavaScript.
Comment linking /parsing_json.php
on “Simdjson – Parsing Gigabytes of JSON per Second”Submitted Parsing JSON Is a Minefield (2018) as a story · 183 points
HN discussionWow! This was a great practical analysis of existing implementations, besides a great technical overview of the spec(s). Thanks for open sourcing the analysis code[1], and for the extended results[2] [1] https://github.com/nst/JSONTestSuite [2] http://seriot.ch/json/parsing.html
Comment linking /json/parsing.html
on “Parsing JSON is a Minefield”Submitted I � Unicode [pdf] as a story · 98 points
HN discussionDid you read the post? The JSON standard(s) are very simple. But in practice this simplicity leads to a lot of edge cases. Very deeply nested structures, numbers that run on to infinity. The point of this post is testing various parsers against these malicious structures. See this image: http://seriot.ch/json/pruned_results.png
Comment linking /json/pruned_results.png
on “Parsing JSON is a Minefield”Submitted Parsing JSON Is a Minefield (2018) as a story · 90 points
HN discussionAmazing! And just in time when the novelty of playing chess in Postscript ( https://seriot.ch/projects/pschess.html ) has worn off :)
Comment linking /projects/pschess.html
on “A minimax chess engine in regular expressions”Submitted A Tiny NTP client as a story · 46 points
HN discussionJSON is in fact defined in (at least) six different places, as described in the piece 'Parsing JSON is a Minefield' [1] (HN: [2]). The problem is perhaps not as egregious as with "CSV" -- which is more of a "technique" rather than a format, despite after 30 years of customary usage, someone retroactively having written a spec; but it does manifest in various edge cases like we're debating. [1] http://seriot.ch/parsi…
Comment linking /parsing_json.php
on “JSON Feed”Submitted Undocumented Twitter APIs [pdf] as a story · 43 points
HN discussion> XML also has a lot of room for syntax errors, with many types of tokens and escape rules. JSON, by comparison, does not. Parsing JSON is a minefield. Yellow and light blue boxes highlight the worst situations for applications using the specified parser. Take a look at how a bunch of parsers perform with various payloads: http://seriot.ch/json/pruned_results.png "JSON is the de facto standard when it comes to (un)s…
Comment linking /parsing_json.php
on “JSON Feed”Submitted A Minsky machine in ncurses terminfo as a story · 36 points
HN discussionWhile I'd agree that parsing JSON is much easier than XML, it is still not completely trivial as demonstrated by this article: http://seriot.ch/parsing_json.php
Comment linking /parsing_json.php
on “JSON Feed”Submitted From Brainfuck to Domino Computers [pdf] as a story · 29 points
HN discussionParsing JSON is a Minefield (2016) https://seriot.ch/projects/parsing_json.html
Comment linking /projects/parsing_json.html
on “Sj.h: A tiny little JSON parsing library in ~150 lines of C99”Submitted Curl was accidentally Turing-complete for nine months as a story · 28 points
HN discussionBoth JSON and YAML are very difficult to construct parsers for. To make matters worse, both formats are full of pitfalls: http://seriot.ch/parsing_json.php https://arp242.net/yaml-config.html using either of these, in my opinion, is extremely misguided.
Comment linking /parsing_json.php
on “TSV Utilities: Command line tools for large, tabular data files”Submitted iPhone Privacy as a story · 16 points
HN discussionJSON is actually not well or consistently specified, and definitely not to the rigour of a state machine; it’s specified in half a dozen places and ways, with inconsistencies and fuzzy details; see http://seriot.ch/parsing_json.php .
Comment linking /parsing_json.php
on “Falling through the KRACKs”Submitted SpyPhone: See how your Apple iPhone privacy can be violated as a story · 15 points
HN discussion> There's no standard way of doing file watching across BSDs, Mac OS and Linux. You are correct, but that's about the only divergence matters in this context. As I've noted elsewhere, you can't even safely use `char*` for file names in Windows; it should be `wchar_t*` in order to avoid any encoding problem. > Are you referring to the clear feature? Yes, it's fixed. It's also pretty standard in that regard. At the ve…
Comment linking /projects/parsing_json.html
on “Rewriting Rust”Submitted ScreenTime – movies from periodic OS X screenshots as a story · 10 points
HN discussion
