The Harmful Consequences of the Robustness Principle – Martin Thomson (2015) (tools.ietf.org)

The part of the JSON improvements is wrong though. Each new iteration of the standard made it worse, opening security holes, and the last clarified only one minor issue, but not the other major open ones. But it is still the only secure serialization format because it is so dumb.