TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

JSON extra uses orjson instead of ujson (2019)

69 点作者 arvindh-manian12 个月前

9 条评论

arvindh-manian12 个月前
Ran into this PR today. Thought Samuel Colvin&#x27;s response to the migration request was prescient, especially considering what we later saw with the XZ Utils backdoor.<p>I&#x27;ve no clue if there actually were&#x2F;are any problems with orjson, but I admire this kind of dedication to security, especially years ago.
评论 #40594460 未加载
评论 #40596923 未加载
jay-barronville12 个月前
I’d be willing to bet that Samuel was perceived as a jerk by some for even implying that this contributor was a bit suspicious, yet it was the most honorable position to take as a maintainer so many folks are relying on and trusting, both directly and indirectly. Job well done.
noitpmeder12 个月前
Hard to argue with his logic, especially re the fact that pydantic is used very widely by large organizations. Some degree of dependency visibility (i.e. non binary releases, &gt;1 contributor, publicly attributable maintainer) is a good thing.
3r7j6qzi9jvnve12 个月前
I&#x27;m really surprised ijl got angry that his mail was quoted, it looks innocent enough to me.<p>For reference it&#x27;s been edited out here: <a href="https:&#x2F;&#x2F;github.com&#x2F;pydantic&#x2F;pydantic&#x2F;issues&#x2F;589">https:&#x2F;&#x2F;github.com&#x2F;pydantic&#x2F;pydantic&#x2F;issues&#x2F;589</a><p>But github shows edits, so the edit is meaningless for privacy. Here&#x27;s the original mail (yes, I&#x27;m blatantly ignoring his request to not publish this, I&#x27;m just this evil.)<p><pre><code> I&#x27;ve looked into replacing ujson in pydantic with orjson (https:&#x2F;&#x2F;github.com&#x2F;ijl&#x2F;orjson). In this implementation, the same JSON library is used for everything, and JSON outputs bytes without whitespace (as it&#x27;s faster and JSON is a serialization format). If orjson is installed, it won&#x27;t affect pydantic&#x27;s benchmark for validation, but can be expected to improve whole-program performance. It&#x27;s a large change with breaking changes to JSON methods, however, so rather than opening a pull request now, could you take a look and see if that&#x27;s consistent and acceptable to the project? https:&#x2F;&#x2F;github.com&#x2F;ijl&#x2F;pydantic&#x2F;commit&#x2F;7c08f41edd340614d7c58888f025665dbc71d0e3 That passes tests, but that&#x27;s all. I&#x27;ll clean it up or modify if the idea&#x27;s acceptable. Thanks.</code></pre>
评论 #40597024 未加载
omh128012 个月前
I’ve also been wary of orjson considering ijl is anonymous and the only one authoring commits. Any ideas on if security folks are checking repository artifacts and verifying builds for projects like this?
meowface12 个月前
Has anyone done an analysis of it? I&#x27;ve used orjson in all my Python projects for years.
评论 #40595966 未加载
评论 #40599556 未加载
cqqxo4zV46cp12 个月前
I definitely appreciate this degree of rigour.
comex12 个月前
(2019)
评论 #40592206 未加载
ranger_danger12 个月前
Can someone ELI5 why this is news? I&#x27;m just not following...