4 ms·

I love the example at https://github.com/crdoconnor/strictyaml/blob/master/FAQ.rst#what-is-wrong-with-implicit-typing https://github.com/crdoconnor/strictyaml/b

I love the example at https://github.com/crdoconnor/strictyaml/blob/master/FAQ.rst#what-is-wrong-with-implicit-typing https://github.com/crdoconnor/strictyaml/blob/master/FAQ.rst.... Convinced in 2 seconds that full YAML is idiotic.

guitarbill 10y ago
this whole idea of strictyaml just makes so much sense to me. plus having comments is a huge bonus. why am i only hearing about this now?
- scrollaway 10y ago
  You're hearing about it now because 99+% of people who use YAML have no idea about how horrible the spec is. They just assume that it's like what strictyaml strives to be and don't understand why "such an elegant, simple and readable language isn't used more". In other words, people don't understand the need for it. Those that do use other formats - json or toml, namely.
MasonOfWords 10y ago
The FUD here is a bit ridiculous. Writing movie scripts in YAML using unquoted strings? That's pretty contrived. Using literal style is easy when it is potentially needed (e.g. programmatic output), and any decent editor can highlight inferred types in helpful ways. I've used YAML in a variety of contexts and never been bitten by this one, and I don't think that any of his examples are still problems in YAML 1.2 (from 2009). The Ruby security problem they reference is also absurdly misattributed. The problem there is with trusting serialized data to mark its own types, and having no limits on what types can be deserialized into. That's a depressingly common security problem in many web frameworks, and YAML as an interchange format isn't a unique source of vulnerability. Any data format is dangerous on the web if you trust it to create arbitrary types.
sirn 10y ago
I read that and thought, hey, it couldn't be that bad, right? Then proceed to type: irb(main):002:0> YAML.load("on: yes") => {true=>true} Oh.

guitarbill 10y ago

this whole idea of strictyaml just makes so much sense to me. plus having comments is a huge bonus. why am i only hearing about this now?

scrollaway 10y ago
You're hearing about it now because 99+% of people who use YAML have no idea about how horrible the spec is. They just assume that it's like what strictyaml strives to be and don't understand why "such an elegant, simple and readable language isn't used more". In other words, people don't understand the need for it. Those that do use other formats - json or toml, namely.

MasonOfWords 10y ago

The FUD here is a bit ridiculous. Writing movie scripts in YAML using unquoted strings? That's pretty contrived. Using literal style is easy when it is potentially needed (e.g. programmatic output), and any decent editor can highlight inferred types in helpful ways. I've used YAML in a variety of contexts and never been bitten by this one, and I don't think that any of his examples are still problems in YAML 1.2 (from 2009). The Ruby security problem they reference is also absurdly misattributed. The problem there is with trusting serialized data to mark its own types, and having no limits on what types can be deserialized into. That's a depressingly common security problem in many web frameworks, and YAML as an interchange format isn't a unique source of vulnerability. Any data format is dangerous on the web if you trust it to create arbitrary types.

sirn 10y ago

I read that and thought, hey, it couldn't be that bad, right? Then proceed to type: irb(main):002:0> YAML.load("on: yes") => {true=>true} Oh.