> I don't see how you can get away from having a defined serialisation format.
Yep, that's exactly it. Your TLS certificate is not sent as string, and neither are your TCP packets, nor the images contained in them. Your URLs shouldn't be either, but it's probably too late for that.
> People try to operate directly on the serialised data using ad-hoc implementations and run into trouble.
That's a whole lot better than the current footgun we have, where
Yep, that's exactly it. Your TLS certificate is not sent as string, and neither are your TCP packets, nor the images contained in them. Your URLs shouldn't be either, but it's probably too late for that.
> People try to operate directly on the serialised data using ad-hoc implementations and run into trouble.
That's a whole lot better than the current footgun we have, where
is a valid URL. People don't operate directly on string URLs without trouble either, so at least the structured data is not inviting incorrect usage.