ysoserial.net VS Json.NET

Any unchecked deserialization is dangerous - as you can see in this repo the same attack works on Json.NET, since you can inject a payload that performs arbitrary remote code execution.

So if you have some type within your application that does something sensitive or disruptive in its constructor, an attacker can craft a stream of bytes that asks the application to create that type. From there, all kinds of crazy things can happen. Here's a privilege escalation exploit discovered in Docker for Windows that relied on BinaryFormatter. Digging into some things he mentioned I found an entire exploit suite for .NET serialization. Through very clever tricks, it creates types that, when deserialized, will execute commands. That's a big deal.

This bug and many others related to time: https://github.com/JamesNK/Newtonsoft.Json/issues/862 And they will never get fixes, because the project is kind of dead. Edit: and actually, the creator claim to have made it like this on purpose, so I don't trust it anymore.

There's a related discussion on the GitHub repo:

Nuget is where you'll get 3rd party libraries (such as Newtonsoft.Json for JSON processing)

Common convention (with rare exceptions) is to name your project the same as your assembly name and default namespace. For example, Newtonsoft.Json.csproj makes an assembly called Newtonsoft.Json.dll with the default namespace of Newtonsoft.Json. Inside that project directory (which usually also has the same name), subdirectories would match namespaces nested inside the default, like in that example there is a folder named Serialization which contains classes that are all in the namespace Newtonsoft.Json.Serialization. Classes in this nested namespace can automatically access classes defined in parent namespaces without extra using statements, like how JsonProperty.cs can reference JsonConverter from the Newtonsoft.Json namespace, but it needs a using statement at the top of the file in order to access classes from the sibling namespace Newtonsoft.Json.Utilities

As I said, I'm not familiar with C# but on a quick Google it seems there isn't one idiomatic way to handle JSON in C# - instead a multitude of different libraries/packages for doing so. This seems... ...irritating. json.NET (https://www.newtonsoft.com/json) seems to be one of the best (but again, I don't know C#).

MonoGame abstracts a lot of the rendering work and is easy to use for 2D games (I haven't tested its 3D support so far). It also provides you with a content pipeline plus audio and input handlers. All that's left for you to do is roll your own Entity Component System, physics, and game logic. If you're not interested in writing your own physics, there are libraries out there already. Additionally, if you don't want to get caught up in the details of data serialization, Json.NET is a great package for serializing data in JSON format. That makes it perfect when paired with a map editor such as Tiled, which can export to JSON.

Also file an issue report with Newtonsoft because IMO that should not be happening.