You're missing the point: even if JSON and GraphQL were better, untrusted data is always "untyped". Something has to parse the raw representation until proper data types the type system can understand.

Ideally this is all transparent, and programmers can stop wasting their lives reimplementing this stuff again and again and again, but even if programmers don't waste their time reimplementing it, computers will spend a decent amount of time running it, at least where there is more than one process / machine / whatever in question and therefore untrusted boundaries.

I don't follow. Writing a parser doesn't require generics. I've written hundreds of parsers. You can even use a generator like protoc to provide you read/write code that returns/uses concrete, static types.

What on earth does dealing with untrusted inputs have to do with anything?

I wasn't primary talking about generics, I would responding to

> You may as well have written:

> > How do I disable static typing for this statically typed language?

and so just talking about parsing and static type checking.

As it turns out, generics do help immensely if one wants to use so-called "parser combinators".

GraphQL is typed.