game development is just a series of writing json deserialization code with periodic breaks to do game design
November 24, 2025 at 2:03 PM
game development is just a series of writing json deserialization code with periodic breaks to do game design
🎉 I've bumped github.com/facet-rs/facet from "highly experimental" to just "experimental" — it has a pretty well-designed set of types, the derive macro is quite capable already, the JSON read+write crates are iterative (!!), go play with it!
GitHub - facet-rs/facet: Rust reflection, serialization, deserialization — know the shape of your types
Rust reflection, serialization, deserialization — know the shape of your types - facet-rs/facet
github.com
April 8, 2025 at 10:28 PM
🎉 I've bumped github.com/facet-rs/facet from "highly experimental" to just "experimental" — it has a pretty well-designed set of types, the derive macro is quite capable already, the JSON read+write crates are iterative (!!), go play with it!
It's finding so many issues 😅
One of them is an unsafe deserialization in a user-controlled message queue that allows an attacker to write arbitrary records to the database, so I think I'm going to treat this experiment as a success.
One of them is an unsafe deserialization in a user-controlled message queue that allows an attacker to write arbitrary records to the database, so I think I'm going to treat this experiment as a success.
Now that I'm back from the woods, I'm trying Jev with my datalog engine to tag identifiers with whether they correspond to sensitive data (PII, secrets, etc), to use as part of taint tracing, and it's really promising so far.
This is the part of static analysis that always needed a human before
This is the part of static analysis that always needed a human before
September 22, 2026 at 9:41 PM
It's finding so many issues 😅
One of them is an unsafe deserialization in a user-controlled message queue that allows an attacker to write arbitrary records to the database, so I think I'm going to treat this experiment as a success.
One of them is an unsafe deserialization in a user-controlled message queue that allows an attacker to write arbitrary records to the database, so I think I'm going to treat this experiment as a success.
![using System.Text.Json;
using System.Text.Json.Serialization;
JsonSerializer.Deserialize<Person>(
"""
{
"name": "David"
}
""");
public class Person
{
[JsonPropertyName("name")]
public required string Name { get; set; }
[JsonPropertyName("age")]
public required int Age { get; set; }
}](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:d47qj4iye2tgorzu3os4ayss/bafkreifowgkqo7tx56ghowjt24tjiigvlyduigobzhd7k6ozersokmqune)
at System.Text.Json.JsonSerializer.ReadFromSpan[TValue](ReadOnlySpan`1 json, JsonTypeInfo`1 jsonTypeInfo)
at System.Text.Json.JsonSerializer.Deserialize[TValue](String json, JsonSerializerOptions options)
at Program.<Main>$(String[] args)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:d47qj4iye2tgorzu3os4ayss/bafkreie4odt7zxqau3jbedwb33gt7jhyiw5qq57lse2i3yx6u4hj6q2fqa)
December 9, 2024 at 4:33 AM
And, well, partial deserialization, iterative deserialization, streaming deserialization, async deserialization, and much more..
April 8, 2025 at 10:43 PM
And, well, partial deserialization, iterative deserialization, streaming deserialization, async deserialization, and much more..
I have shit to do and deadlines to hit but god damn I want to stop everything and spend all my time fleshing out github.com/bearcove/sha... because I'm SO EXCITED about it
GitHub - bearcove/shapely: Rust reflection, serialization, deserialization — know the shape of your types
Rust reflection, serialization, deserialization — know the shape of your types - bearcove/shapely
github.com
March 13, 2025 at 3:52 PM
I have shit to do and deadlines to hit but god damn I want to stop everything and spend all my time fleshing out github.com/bearcove/sha... because I'm SO EXCITED about it
rubi chan- haaaaai- nani ga suki- EXCEPTION IN DESERIALIZATION, yori mo anata! ^w^
May 10, 2025 at 8:54 PM
rubi chan- haaaaai- nani ga suki- EXCEPTION IN DESERIALIZATION, yori mo anata! ^w^
(note: "deser" stands for "deserialization" here. it's a pun on "dessert", which I do know how the spelling of)
April 8, 2026 at 9:40 PM
(note: "deser" stands for "deserialization" here. it's a pun on "dessert", which I do know how the spelling of)
Within every #rust engineer there are two wolves: one loves `serde`, the other hates returning deserialization errors one at a time to their users.
We wrote `eserde` to bring you peace.
(To bring _me_ peace too, at last!)
We wrote `eserde` to bring you peace.
(To bring _me_ peace too, at last!)
February 18, 2025 at 4:57 PM
Within every #rust engineer there are two wolves: one loves `serde`, the other hates returning deserialization errors one at a time to their users.
We wrote `eserde` to bring you peace.
(To bring _me_ peace too, at last!)
We wrote `eserde` to bring you peace.
(To bring _me_ peace too, at last!)
Big day for Ruby deserialization fans
August 7, 2026 at 9:20 PM
Big day for Ruby deserialization fans
Doing my "Java deserialization security talk" at #DevBCN.
July 3, 2023 at 3:34 PM
Doing my "Java deserialization security talk" at #DevBCN.
Week 1 update on university 3D engine:
- ECS
- Windowing, Input
- Simple Wren scripting
- Profiler
- D3D12 backend with mesh shaders and raytracing support
- Deferred shading + HDR rendering
- Asset system and caching
- Scene serialization/deserialization
- ECS
- Windowing, Input
- Simple Wren scripting
- Profiler
- D3D12 backend with mesh shaders and raytracing support
- Deferred shading + HDR rendering
- Asset system and caching
- Scene serialization/deserialization
February 9, 2025 at 6:50 PM
Week 1 update on university 3D engine:
- ECS
- Windowing, Input
- Simple Wren scripting
- Profiler
- D3D12 backend with mesh shaders and raytracing support
- Deferred shading + HDR rendering
- Asset system and caching
- Scene serialization/deserialization
- ECS
- Windowing, Input
- Simple Wren scripting
- Profiler
- D3D12 backend with mesh shaders and raytracing support
- Deferred shading + HDR rendering
- Asset system and caching
- Scene serialization/deserialization
Jacquard v0.6.0 is a doozie. We got:
- WebSocket streaming
- HTTP streamed responses and (on non-wasm platforms) requests
- Support for atproto event streams (firehose)
- Jetstream subscribers
- Also fixed blob upload and download bugs & CID link deserialization issues.
tangled.org/@nonbinary.c...
- WebSocket streaming
- HTTP streamed responses and (on non-wasm platforms) requests
- Support for atproto event streams (firehose)
- Jetstream subscribers
- Also fixed blob upload and download bugs & CID link deserialization issues.
tangled.org/@nonbinary.c...
@nonbinary.computer/jacquard
A better Rust ATProto crate
tangled.org
October 18, 2025 at 4:53 PM
Jacquard v0.6.0 is a doozie. We got:
- WebSocket streaming
- HTTP streamed responses and (on non-wasm platforms) requests
- Support for atproto event streams (firehose)
- Jetstream subscribers
- Also fixed blob upload and download bugs & CID link deserialization issues.
tangled.org/@nonbinary.c...
- WebSocket streaming
- HTTP streamed responses and (on non-wasm platforms) requests
- Support for atproto event streams (firehose)
- Jetstream subscribers
- Also fixed blob upload and download bugs & CID link deserialization issues.
tangled.org/@nonbinary.c...
tinybvh v1.1.8 has been merged into the main branch. New:
* Building over indexed primitives
* Faster SBVH construction
* Wavefront path tracer example
* CWBVH serialization / deserialization
* Many smaller improvements and bug fixes.
Link: github.com/jbikker/tiny...
* Building over indexed primitives
* Faster SBVH construction
* Wavefront path tracer example
* CWBVH serialization / deserialization
* Many smaller improvements and bug fixes.
Link: github.com/jbikker/tiny...
January 1, 2025 at 2:23 PM
tinybvh v1.1.8 has been merged into the main branch. New:
* Building over indexed primitives
* Faster SBVH construction
* Wavefront path tracer example
* CWBVH serialization / deserialization
* Many smaller improvements and bug fixes.
Link: github.com/jbikker/tiny...
* Building over indexed primitives
* Faster SBVH construction
* Wavefront path tracer example
* CWBVH serialization / deserialization
* Many smaller improvements and bug fixes.
Link: github.com/jbikker/tiny...
bumping this because I'm going to write easily 2 more just about deserialization. strong theme emerging here
new post: "Set Member Parsing"
let's talk "parse, don't validate" with a focused example:
set membership. how can we encode the fact that a primitive belongs to some set, in a type the same size as the primitive? why is this useful in your rust web server?
piss.beauty/post/set-mem...
let's talk "parse, don't validate" with a focused example:
set membership. how can we encode the fact that a primitive belongs to some set, in a type the same size as the primitive? why is this useful in your rust web server?
piss.beauty/post/set-mem...
stellz' blog
piss.beauty
April 22, 2025 at 5:26 PM
bumping this because I'm going to write easily 2 more just about deserialization. strong theme emerging here
before even reading i knew it was a deserialization issue lol
December 3, 2025 at 8:56 PM
before even reading i knew it was a deserialization issue lol
serde hot take: #[untagged] enums produce the most aggravating deserialization errors.
May 22, 2025 at 2:23 PM
serde hot take: #[untagged] enums produce the most aggravating deserialization errors.
In our new #blog, Senior Security Consultant
@two06.bsky.social goes over methodology that led him to discovering a deserialization vulnerability in #LINQPad, a .NET scratchpad application commonly used by developers. Read it now! trustedsec.com/blog/discove...
@two06.bsky.social goes over methodology that led him to discovering a deserialization vulnerability in #LINQPad, a .NET scratchpad application commonly used by developers. Read it now! trustedsec.com/blog/discove...
Discovering a Deserialization Vulnerability in LINQPad
trustedsec.com
December 3, 2024 at 4:14 PM
In our new #blog, Senior Security Consultant
@two06.bsky.social goes over methodology that led him to discovering a deserialization vulnerability in #LINQPad, a .NET scratchpad application commonly used by developers. Read it now! trustedsec.com/blog/discove...
@two06.bsky.social goes over methodology that led him to discovering a deserialization vulnerability in #LINQPad, a .NET scratchpad application commonly used by developers. Read it now! trustedsec.com/blog/discove...
Jacquard 0.4.0 release cut and pushed to crates.io
Brings a bunch of ergo improvements to borrowed and owned deserialization, an axum extractor (thanks @thoth.ptnote.dev), a ton of new lexicons in the generated API bindings, plus better value type conversions.
tangled.org/@nonbinary.c...
Brings a bunch of ergo improvements to borrowed and owned deserialization, an axum extractor (thanks @thoth.ptnote.dev), a ton of new lexicons in the generated API bindings, plus better value type conversions.
tangled.org/@nonbinary.c...
@nonbinary.computer/jacquard
A better Rust ATProto crate
tangled.org
October 12, 2025 at 12:00 AM
Jacquard 0.4.0 release cut and pushed to crates.io
Brings a bunch of ergo improvements to borrowed and owned deserialization, an axum extractor (thanks @thoth.ptnote.dev), a ton of new lexicons in the generated API bindings, plus better value type conversions.
tangled.org/@nonbinary.c...
Brings a bunch of ergo improvements to borrowed and owned deserialization, an axum extractor (thanks @thoth.ptnote.dev), a ton of new lexicons in the generated API bindings, plus better value type conversions.
tangled.org/@nonbinary.c...
well someone should show github.com/facet-rs/facet to ralf that's for sure
GitHub - facet-rs/facet: Rust reflection, serialization, deserialization — know the shape of your types
Rust reflection, serialization, deserialization — know the shape of your types - facet-rs/facet
github.com
April 8, 2025 at 10:22 PM
well someone should show github.com/facet-rs/facet to ralf that's for sure
It's so frustrating when I keep stumbling back into the fact that zero-copy deserialization both allows for crazy efficient and convenient handling of &[u8] and &str data, but it essentially DEMANDS immediate(ish) dispatching OR an allocator.
April 26, 2025 at 9:21 PM
It's so frustrating when I keep stumbling back into the fact that zero-copy deserialization both allows for crazy efficient and convenient handling of &[u8] and &str data, but it essentially DEMANDS immediate(ish) dispatching OR an allocator.
Blogged: Using the YamlDotNet source generator for Native AOT
andrewlock.net/using-the-ya...
In this post I show how you can use the YamlDotNet source generator to do strongly-typed serialization and deserialization, even in Native AOT apps
#dotnet #aspnetcore
andrewlock.net/using-the-ya...
In this post I show how you can use the YamlDotNet source generator to do strongly-typed serialization and deserialization, even in Native AOT apps
#dotnet #aspnetcore
Using the YamlDotNet source generator for Native AOT
In this post I show how you can use the YamlDotNet source generator to do strongly-typed serialization and deserialization, even in Native AOT apps
andrewlock.net
December 10, 2024 at 5:46 PM
Blogged: Using the YamlDotNet source generator for Native AOT
andrewlock.net/using-the-ya...
In this post I show how you can use the YamlDotNet source generator to do strongly-typed serialization and deserialization, even in Native AOT apps
#dotnet #aspnetcore
andrewlock.net/using-the-ya...
In this post I show how you can use the YamlDotNet source generator to do strongly-typed serialization and deserialization, even in Native AOT apps
#dotnet #aspnetcore