Hacker News Reader

Comment by exabrial | Hacker News Reader

This is pretty danged slick. I especially like the API to create your own components very intuitive.

One rotten egg I can spot: "Supported subset of Jackson". Ow. Jackson is unfortunately a land mine, rattled with CVEs over the years. This was mostly fixed by taking the best ideas from Jackson and standardizing them as JsonB, which not have several good implementations. I would highly suggest they drop Jackson support in flavor of JsonB just so the Jackson libs don't have to be on anyones class path.

View on HN

Any more details? A quick googling doesn’t find many talking about comparative performance and security of Jackson vs jsonb vs gson?

Have seen Jackson in parts of my code base (internal, but still)

These 3 issues basically.

https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

As Jackson is used in Spring, you can assume most banks, big corporations, etc. use it. So, update your dependencies and it's fine.

Gson is kind of to be avoided for the simple reason that it seems to be no longer maintained by Google. I've used it in the past and its fine but wouldn't pick it for something new because of this.

If you are using Kotlin, kotlinx serialization is worth a look. I've been using that recently. One of the nice things is that it relies on compiler plugins and code generation rather than a lot of reflective magic at runtime. From a security and performance point of view, that's a good thing.

kotlinx.serialization has a learning curve, but it is quite flexible and very fast. I've only used it on the JVM but obviously its cross-platform nature is a big plus as well.

It could use some simplified syntax (similar to how Kotson improved on Gson), perhaps a JPath parser. But for something that just went 1.0 very recently, it is terrific.

We are using kotlinx serialization in a multiplatform project where we use the same model classes in a cross platform API client and our Spring server. Tested this on Javascript and JVM so far and will likely add IOS there soonish.

TeaVM Flavour does not compile Jackson. Instead it comes with its own JSON serializer that supports subset of Jackson annotation. As Kotlin serialization, it relies on code generation, no reflection used at all.

Correct, I'd rather not have it on the classpath nonetheless.

Reply on news.ycombinator.com