Is this used in production anywhere?

[michaeleiselsc]

Hi, I work for a large mobile app company that is interested in replacing JSON with something faster. The one disappointing thing is that colfer is written in Go and JS it looks like, which we can't use for iOS or Android (without a fair amount of finagling at least), so are there any plans for it to get ported to C/C++? Also, are there any companies that use it? It would be great to see a list of some companies that use or even their experiences, as that would really sell the format. How much security auditing has occurred?

The numbers on https://github.com/eishay/jvm-serializers/wiki are tantalizing, so I'm curious to hear more :)

[pascaldekloe]

Hi Michael,

The Java from Colfer is supposed to run on Adroid.
A C port is under development yet I haven't used that language for over 10
years. Some help would be much appreciated.

Yes Colfer is used by a few companies including a high volume stock broker.
Just like you they didn't mention the specifics and I don't ask. ^_^

Op 20 okt. 2016 8:14 a.m. schreef "Michael Eisel" <notifications@github.com

:

Hi, I work for a large mobile app company that is interested in replacing
JSON with something faster. The one disappointing thing is that colfer is
written in Go and JS it looks like, which we can't use for iOS or Android
(without a fair amount of finagling at least), so are there any plans for
it to get ported to C/C++? Also, are there any companies that use it? It
would be great to see a list of some companies that use or even their
experiences, as that would really sell the format. How much security
auditing has occurred?

The numbers on https://github.com/eishay/jvm-serializers/wiki are
tantalizing, so I'm curious to hear more :)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#5, or mute the thread
https://github.com/notifications/unsubscribe-auth/AEpEAN8iVVOS7W8A2UxuJEBOMN2aDPyeks5q1wazgaJpZM4KbwbS
.

[pascaldekloe]

I've mistaken the e-mail notification for a PM. 😁
Anyway, security is an important factor indeed. The (un)marshalling has built-in support for size limitation. I did some fuzzing for the Go implementation with './testdata/fuzz.go'. Can you recommend any C libraries for testing?

[michaeleiselsc]

Check out the security work these guys did: https://capnproto.org/news/

[pascaldekloe]

Let's skip that kind of "work" here. 😉

[pascaldekloe]

Started a wiki to collect information.

B.t.w., after this issue was created I saw quite some activity from security experts. Was that you @michaeleiselsc and if so, would you care to share the results?

[pascaldekloe]

@michaeleiselsc: the C++ port is up for the next milestone. (issue #10)

[michaeleiselsc]

That was not me doing the security testing :P
Thanks for the heads up!