Because that would require consumers to have a Javascript interpreter to use it.

moralestapia · 2024-10-18T16:57:45.000000Z

Because that would require consumers to have an interpreter for the most widely deployed language, ever, and by far.

FTFY

yawnxyz · 2024-10-18T17:08:29.000000Z

security nightmare; sometimes you don't want consumers to execute code arbitrarily

kevin_thibedeau · 2024-10-18T17:20:48.000000Z

This is what makes Tcl great as a data interchange format. It comes with a safe mode for untrusted code and you can further restrict it to have no control flow commands to be non-Turing.

moralestapia · 2024-10-18T17:15:23.000000Z

Not true. Google, Meta, ... do it at a massive scale, no issues.

It's not really hard to protect yourself against that.

Any (competent) security guy can give you like 4 ways to implement it properly.

hifromwork · 2024-10-19T00:59:53.000000Z

I am a (hopefully competent) security guy, please don't run arbitrary code if you can help it. Especially for something as trivial as JSON patching.

rererereferred · 2024-10-18T18:58:39.000000Z

Do you mean the ads they serve that contain malware?

crabmusket · 2024-10-18T21:48:55.000000Z

Ok hear me out, what if my API accepts WASM fragments that I run against my database but in a sandbox!

oguz-ismail · 2024-10-18T17:08:58.000000Z

Nah, in that case Python would be a better option as it's already installed everywhere.

moralestapia · 2024-10-18T17:12:43.000000Z

That is so derangedly untrue.

jrockway · 2024-10-18T18:09:15.000000Z

Starlark is a nice embeddable scripting language, though. Java, Go, and Rust implementations: https://github.com/bazelbuild/starlark/blob/master/users.md#...

royjacobs · 2024-10-18T17:54:04.000000Z

But what's your point? Would you truly want consumers of JSON Patch data to embed a JS interpreter?

moralestapia · 2024-10-18T17:56:09.000000Z

My point is that the JS interpreter is likely already there.

_blk · 2024-10-19T15:53:41.000000Z

only if you think of JSON in the context of a browser. JSON is used as serialized representation of objects in embedded systems, config files, etc. where a JS interpreter is unnecessary, absent or unwanted (size, security, platform preferences, ...)