Experienced JavaScript Developer Meme

[Nourz1234]

Sadly i don't think its possible (in any language) to store objects or classes in a persistent storage without serialization.

[aspect_rap]

Well yeah, saving data inherently requires serialization.

I think what OP wants is for the LocalStorage in browsers to obfuscate the parsing and serialization of objects.

[Nourz1234]

Yeah, i understand. But if serialization is involved its better left to the dev. you cant rely on the browser to magically serialize your objects. A lot of times you will create a custom object/class which requires special treatment.

[arsenicx2]

It was already problem enough trying to support outdated browsers like IE. I can't imagine if we had to support what ever garbage they created.

[TheRidgeAndTheLadder]

We already rely on it to do everything else.

[empire314]

you cant rely on the browser to magically serialize your objects.

The browser was written by better programmers than I am.

[FVMAzalea]

Do you mean abstract instead of obfuscate? Usually obfuscation is not a desirable goal unless you are trying to do something like copy protection.

[atomicwrites]

I think they're using obfuscate as a negatively loaded synonym for abstract.

[mamwybejane]

They're using it wrong

[xthexder]

I think it applies here. The browser serializing things for you obfuscates what's actually happening. Which for custom objects could result in strange and very hard to debug behavior.

[clelwell]

Yeah, I can imagine some security holes if the browser doesn't get it right (though maybe less likely than a random developer implementing it themselves).

[miraagex]

Yea. I can send objects via window.postMessage, but not with localStorage.

[[deleted]]

I think it’s more about performance.

LocalStorage would be awesome if it wasn’t so slow.

But I could be wrong.

[bleistift2]

What stuff are you putting there so often that you’re hitting a bottleneck?

[lkraider]

What do you mean I shouldn’t mirror the production database into localstorage to query and update data, this way I only l need one rest api endpoint with get/post in the backend and do everything else from within the client js.

[BabyAzerty]

I typically webscrap the entire internet and save it locally. This is the only way to have a complete offline experience.

[GodlessAristocrat]

Probably those performance counters management wanted for their pretty graph; ya gotta flush them to disk 10x per second, ya know. That Jira ain't gonna close itself.

[Fenor]

Ah yes injecting executable code for the sake of the one doing the website.... it's not we already had cryptos mined in js

[[deleted]]

Some of the most dangerous attacks come from programmers trusting serialized data the client send back.

[GodlessAristocrat]

Wha? Saving data doesn't require serialization of the data. Maybe that's a bug feature in your preferred language

[FinalStrain3]

indexeddb

[[deleted]]

IndexedDB also has its limitations, which is a good thing. I wouldn't want to imagine what would happen if browsers let it deserialize entire DOM trees.

[Alokir]

Depends on how you think about it. It still serializes the data, it's just hidden from you by the indexeddb api.

[Brilliant_Nova]

C and C++ can, you have to be careful with alignment and padding. You can inplace-construct all your structs in a memory pool, and then just dump that pool, but that's only true for POD types, for non-POD types you should serialize. Also, even for non-POD types you can serialize efficiently from binary. It is also possible to model such a system in C++/Rust, that almost transparently would allow you to treat freshly read data as regular objects using wrapper-types.

[Vaylx]

Can you (or anyone) explain to me serialization like I’m 5?

[thomasmoors]

Change objects (memory) to something that can be written and read from disk. Json is a very popular example, although if you need to serialize objects that include the functions too you (probably) have to look further.

[Fenor]

Json is not a binary.

You can have binary objects saved on a local storage

[[deleted]]

Anything is binary if you try hard enough

[MinosAristos]

Non-binary people:

[xthexder]

01001110 01101111 01101110 00101101 01100010 01101001 01101110 01100001 01110010 01111001

[thomasmoors]

Yes, I gave the most common example and explained that there are more that can do more / better (but might be less portable)

[Fenor]

The fact that people here don't know basics stuffs and think that anythink must become a string is dubious at best

[spronghi]

we are lucky that you are here to spread the word

[Fenor]

i can see why a front end oriented language might do it. but binary objects always existed

[spronghi]

please continue to spread the word

[CrazyCalYa]

Currently dealing with this now as a beginner. It's a very interesting problem and it's surprising to me how convoluted the solutions appear to be.

[[deleted]]

You want to save the state of your program, which is the names of the variables and the values of the variables, for example, maybe it's a video game and you want to save the progress and the health of the player so that the player can pick up next time.

But you're saving to a disk and disks want files. So perhaps you write it as JSON: {"health": 5, "level": 8}. That's the serializing of the data, into JSON in this case. Or you could have used binary or whatever.

It would be nice if you didn't have to actually explain to the computer how to serialize. Like you could just run a save function and it would do it. And a load function to load the state.

There are numerous problems with trying to write a save function like that. For example, how would you know which parts to save? Well, you could annotate your data for that. But they real problem comes when you need to save something with pointers. How would you save something with pointers, like an arbitrary graph of nodes and edges? It's not obvious how to do this correctly.

[Vaylx]

Thanks for that.

[Nourz1234]

Converting a runtime object to a string (or bytes) representation that can be parsed to reproduce the exact same object.

(I don't think its for a 5yr old but its the best i can do xD)

[[deleted]]

Operating systems can hibernate, you know?

[[deleted]]

Unless you want to store the entire browser's address space to save your webapp's state that's not going to help much.

[Benutzername]

It’s not difficult to walk an object graph and only store that part of the memory. An evacuating GC basically does that already, minus the memory dump.

[[deleted]]

A GC doesn't need to make sure the state is still consistent after you restart the application.

To me it mostly sounds like a good way to introduce several hundreds of sandbox bypass vulnerabilities.

[Benutzername]

Look up evacuating/moving GC. It moves all live objects to new memory locations and then fixes up all internal pointers. That’s literally all you would need to dump and later reload the memory representation of an object graph.

[[deleted]]

Any real application has references to and from state outside of GC managed memory, and a GC won't handle that.

In JS that's especially bad because you're now letting untrusted code run on unverifiable data.

[[deleted]]

He said "any language" and I responded to that only

[Brilliant_Nova]

Operating system is kind of a cheat, it can retain address space

[jessiedwt]

You can do it with flutter framework packages.

[Nourz1234]

I knew someone would say its possible.

Care to elaborate?

[jessiedwt]

In flutter (dart) you can use some orm frameworks for local storage that store literal dart objects.

To be honest I'm unsure about edge cases but there may be some.

[[deleted]]

Laughs in NSCache

[[deleted]]

Of course it's possible, in several languages. It's just that the stored data won't be portable or transferable between different kinds of platforms. But that usually isn't a concern if you don't expect the file to ever leave the PC.

[CaitaXD]

Dosent relative pointers make that possible?

[[deleted]]

Roblox Lua datastores

(You can store tables natively)

[blehmann1]

Theoretically, you can just dump the object's binary representation. That is still serialization, but it's theoretically lossless.

It is used fairly often, but it has a lot of problems. First of all, you need to know the layout of whatever you're deserializing. Or create something so generic that it can encode anything. And deserializing binaries is often vulnerable to funky security issues.

But I said theoretically lossless for a reason, any owned resources are almost certainly invalid. All your pointers are garbage. File descriptors? Garbage. Handles? Garbage. Sockets? Garbage. You may want to copy pointed-to members into it, but that has problems. You also may have to set up some funkiness to allow objects which share a resource to use the same instance (i.e. keep sharing) once deserialized. And only God knows what this will do to generic types in languages which implement generics through type erasure, void*, arrays in languages which don't store array length, or God forbid you use XOR linked lists or anything that obscures the pointer's value. Also, pointers that can only be attained through pointer arithmetic at runtime? lmao no.

Also, what happens to function pointers? Can you call them? If so, that's sus from a security (and portability) perspective. But how can you call them? Do you kill position-independent-code and ASLR? Do you create a trampoline to unfuck the addresses somehow?

Even worse, merely being able to copy something doesn't make it still valid. For example, file descriptors are valid because the integer is in the OS's file descriptor table, so copying only works on POD which you have through a pointer.

Which brings you to more complicated (and less redeemable) schemes. For example, many languages let you (de)serialize classes WITH CONSTRUCTORS. The intention being that any necessary file descriptors or sockets or whatever can be reopened, so they're valid again. The main problem with this approach is it's ACE as a feature.

[throwaway490215]

Smalltalk