W3C home > Mailing lists > Public > public-bpwg@w3.org > May 2009

Re: MWABP for discussion: JSON parsing vs eval benchmarking.

From: Jeff Sonstein <jeffs@it.rit.edu>
Date: Tue, 19 May 2009 07:56:01 -0400
To: Adam Connors <adamconnors@google.com>
Message-Id: <54BEA9DD-F57C-4CD0-99F5-978A95B5B799@it.rit.edu>
Cc: public-bpwg@w3.org
On May 19, 2009, at 7:44 AM, public-bpwg@w3.org wrote:

> There is a BP in the MWABP which states you shouldn't directly  
> eval() JSON data but should use a JSON parser instead for security  
> reasons... We came to this point after a number of more nuanced  
> iterations. However, feedback from a colleague in the office who did  
> some benchmarking suggests that JSON parsing is approx. * 10 slower  
> than direct eval(). So... I don't think we can really make a BP that  
> would require an app to run * 10 slower than it has to...

it would just be the "get and parse remote data" part
which would run slower...
the rest of the app should not be effected
I would think

> I propose:
> * Would somebody please volunteer to verify this figure and see if  
> it is still true. It was true on iPhone 1 and the gap may have  
> narrowed in 2.x, Android, or other platforms...

someone who has other-than-iPhones avail
should probably do this

> * If the gap has narrowed we should keep things as they are and  
> offer some comment on relative performance eval vs json parsing.

even if the gap is that bad and has not narrowed
this still seems an appropriate thing to do

> * If the gap hasn't closed I propose that we change this BP to state  
> that the preferred option is to use eval() but only on trusted data

makes sense either way

do you have a link to a benchmark?


"By the time you swear you're his,
  Shivering and sighing,
  And he vows his passion is
  Infinite, undying -
  Lady, make a note of this:
  One of you is lying."
- Dorothy Parker -

Prof. Jeff Sonstein

Received on Tuesday, 19 May 2009 11:57:04 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 20:43:00 UTC