In the stable-structures crates as in Islam presentation in this week R&D (here), ciborium is used to encode and decode bytes (ser::into_writer and de::from_reader).
It’s also possible to do the same with Candid (encode_one and decode_one).
Is there any advantage or disadvantage to using one or the other?
CBOR stores dictionary keys in the encoding, which is great if you have a loose schema and want to throw random data into a database and be able to parse it later. But that costs space. If you have a fixed schema Candid is likely to give you a more compact encoding. Other advantages or disadvantages might depend on the project, e.g. are you already using Candid or CBOR? If so, importing another library might not be worth it.
Note: In a small test of NNS account data, CBOR took 27% more space but your mileage will vary! 