JSON Explained
summary
Covers exact gotchas: floating‑point limits (no exact 0.1, negative zero, NaN, infinities), why numeric IDs break through JSON, and a practical hash collision DoS that ties up a CPU for minutes with 1–2MB of crafted input; shows fixes landed in OpenJDK 8 and Android Oreo. Compares concrete tools and tradeoffs: Jackson’s byte‑quads canonicalizer for string reuse, Moshi’s trie field lookup, and Kotlin serialization’s lack of streaming; recommends streaming, generated adapters, and protobuf as a performance path.
AI-written summary · about
chapters (21)
- 0:00Intro
- 2:14What is JSON
- 3:45Numbers
- 5:50Computer Numbers
- 7:14Floating Points
- 7:57Infinity
- 8:31Negative
- 10:10Floatingpoint numbers
- 12:24Distance between values
- 15:53Doubles
- 19:19JSON API
- 21:32Arrays
- 27:54Names
- 29:12Dates
- 30:07JSON Libraries
- 31:43JSON Decoders
- 38:29JSON Adapters
- 46:39JSON APIs
- 46:58JSON Adapter
- 50:59Testing
- 51:38Performance
related talks
25mNo Way, JOSE
41mNon-traditional Encryption Problems And Solutions
19mHow a vulnerability hack may happen and how to prevent it
46mThe Anatomy of Java Vulnerabilities
34mDeserialization: what, how and why [not]
56mThe Anatomy of Java Vulnerabilities
43mDon't hack the JVM? ☠️💣💥
41mHigh-Secure Java Serialization