DJB Netstrings: A Simple, Secure Protocol for Reliable Network Communication
Netstrings (1997)
I introduce netstrings, a self-delimiting encoding method that makes generating and parsing strings incredibly easy. Unlike traditional protocols, netstrings declare their size upfront, allowing applications to verify memory availability before reading data. This approach eliminates the risk of buffer overflows often seen with CRLF encoding, offering a robust foundation for secure network protocols.
The famous Finger security hole may be blamed on Finger's use of the CRLF encoding.
- regularfry
Tagged Netstrings (tnetstrings) was a related proposal from 15 years ago or so. It replaces the comma with a single-character type definition so you can do JSON-like objects with a couple of recursive types: you had ',', '#', '^', '!', and '~' for strings, integers, floats, booleans, and nulls, then ']' and '}' for lists and dictionaries.
Most of the links have bitrotted and I don't think it ever got much traction, but I did always like how simple it was. There's a copy someone grabbed of the original spec here: https://raw.githubusercontent.com/ged/tnetstrings.info/refs/...
- Joker_vD
if (scanf("%9lu",&len) < 1) barf(); /* >999999999 bytes is bad */
if (getchar() != ':') barf();
buf = malloc(len + 1); /* malloc(0) is not portable */
if (!buf) barf();
if (fread(buf,1,len,stdin) < len) barf();
if (getchar() != ',') barf();
Ah, the wonders of error-handling in C. Also, I wonder what's wrong with
buf = malloc(len ? len : 1);
- weinzierl
Making the thing that describes the bounds of an arbitrary length thing itself arbitrary length sound like an unnecessarily risky complication to me.
Especially since it only grows with the log of the thing it bounds. So, we could easily have s fixed length length field that covers all ever possible length values.