4 ms·

If we're being honest, YAML is one of the dumbest ideas of the last 20 years to have proliferated. How we got from XML to here I cannot comprehend. This is not

If we're being honest, YAML is one of the dumbest ideas of the last 20 years to have proliferated. How we got from XML to here I cannot comprehend. This is not the first RCE involving YAML and it won't be the last.

szszrk 1y ago
That was not RCE. It's not in yaml, it's in Helm's logic. But glad you vented, I guess.
ChocolateGod 1y ago
Why we settled on a file format that relies on invisible characters I'll never know.
- imiric 1y ago
  You use invisible characters whenever you press Enter or Space. If you're referring to Tab, many of the most popular programming languages like Go and Python use them as part of their syntax. The reason YAML was popularized is because it was a response to XML which isn't user friendly to write. It's unfortunate that the spec got so convoluted, and uses a lot of implicit behavior, but I'd rather write YAML than XML, JSON or TOML for things like configuration files. Nowadays there might be better alternatives, but YAML is the de facto standard. It's also unfortunate that YAML got abused by people who wanted to turn it into a DSL, so we ended up with thousands of lines of Ansible playbooks, CI workflows, and Helm charts, but here we are.
  - drysart 1y ago
    It's unfortunate, but inevitable. Every structured text data format that sees widespread use, given enough time, will eventually be turned into a DSL.
    - cluckindan 1y ago
      In fact, once a structured text format is used as a data source for any process, it has already become a DSL.
  - mrheosuper 1y ago
    i always enjoy writting json more. I feel it's easier to translate/integrate json into the code.
    - pieterjongsma 1y ago
      [dead]
    - cluckindan 1y ago
      YAML is a superset of JSON, so go right ahead and write your .yml files in JSON.
      - galangalalgol 1y ago
        Sometimes what makes something great is what it lacks. An automatic transmission, operator overloading, schema extensions, batteries etc.
      - baobun 1y ago
        YAML is actually not a superset of JSON. https://john-millikin.com/json-is-not-a-yaml-subset https://john-millikin.com/json-is-not-a-yaml-subset https://news.ycombinator.com/item?id=30052633 https://news.ycombinator.com/item?id=30052633
        cluckindan 1y ago
        The NO case is not valid JSON. So that leaves scientific notation.
        baobun 1y ago
        The point is that "going right ahead and write your .yml files in JSON" is not valid. You'd have to restrict yourself to a subset of JSON to not get different semantics.
        joombaga 1y ago
  - sofixa 1y ago
    > many of the most popular programming languages like Go and Python use them as part of their syntax Go doesn't use tabs or whitespace as a part of its syntax. It's a part of the formatting, but not the syntax of the language. Python on the other hand, one extra tab or whitespace can cause havoc.
- qsort 1y ago
  The gyrations people will go through to avoid using S-expressions...
- kubectl_h 1y ago
  Exactly how I feel about Python!
fmbb 1y ago
A search for XML on cve.org gives > Showing 1 - 25 of 6,749 results for XML Searching for YAML: > Showing 1 - 25 of 288 results for YAML
- baq 1y ago
  Is that from the past two years?
tsimionescu 1y ago
While YAML has all sorts of issues and disadvantages compared to XML, security is certainly not one of them. XML is a crazy source of security issues by design, especially with the crazy idea of adding built-in support for URLs that parsers are expected to follow.
quotemstr 1y ago
In what way is this vulnerability YAML-specific?
javcasas 1y ago
Are we going to blame the next RCE we find in some application on XML just because that application uses XML somewhere? If so, then I agree on blaming this on YAML.
immibis 1y ago
NIH syndrome and "inverse second system effect". In the real second system effect, the second system is more complicated because it includes everything that could possibly be perceived as missing in the first system. In the inverse second system effect the first system was perceived as too complicated, not too simple, so the second system is much simpler and doesn't do its job well. Also this vuln has nothing to do with YAML
- galangalalgol 1y ago
  It is tangentially related in that yaml became normal to use as a DSL within the devops world. As another post said, everything becomes a DSL eventually because people want to be "fully configurable" not realizing that is roughly the same thing as not being complete yet. But in this case the lack of direct acknowledgement of yaml as an interpreted language with an interpreter that doesn't think of itself as such and hence doesn't have a real sandbox, is what leads us to the present. People didn't use xml as a DSL as often because it was so flexible. That would be like using c++ as a DSL instead to write the interpreter for one.
  - moondev 1y ago
    This is like blaming python problems on yaml because someone embedded a python script in a multiline string.
    - galangalalgol 1y ago
      I wasn't blaming yaml at all. Our mistake is thinking we are using it as a configuration file. When we are actually using it as an interpreted language. Not yaml's fault people are writing dsl interpreters unknowingly. It's just related because people who make that mistake are picking yaml. I nearly made the mistake with toml a few years ago. You could even make the mistake with complicated environment variable usage. Whenever your configuration source is flexible enough to create executable primitives it needs to be sanitized. And really that is whenever a configurable value gets used in a conditional, which is often. Especially considering that even numeric values become conditional when they are used in operations that can result in ub or even just exceptions/panics/unhandled errors. Not a yaml exclusive.
fapjacks 1y ago
I have no horse in that race but just to see people talking about XML like this a quarter of a century after the first time I saw similar comments is just funny, I don't care who you are.

szszrk 1y ago

That was not RCE. It's not in yaml, it's in Helm's logic. But glad you vented, I guess.

ChocolateGod 1y ago

Why we settled on a file format that relies on invisible characters I'll never know.

imiric 1y ago
You use invisible characters whenever you press Enter or Space. If you're referring to Tab, many of the most popular programming languages like Go and Python use them as part of their syntax. The reason YAML was popularized is because it was a response to XML which isn't user friendly to write. It's unfortunate that the spec got so convoluted, and uses a lot of implicit behavior, but I'd rather write YAML than XML, JSON or TOML for things like configuration files. Nowadays there might be better alternatives, but YAML is the de facto standard. It's also unfortunate that YAML got abused by people who wanted to turn it into a DSL, so we ended up with thousands of lines of Ansible playbooks, CI workflows, and Helm charts, but here we are.
- drysart 1y ago
  It's unfortunate, but inevitable. Every structured text data format that sees widespread use, given enough time, will eventually be turned into a DSL.
  - cluckindan 1y ago
    In fact, once a structured text format is used as a data source for any process, it has already become a DSL.
- mrheosuper 1y ago
  i always enjoy writting json more. I feel it's easier to translate/integrate json into the code.
  - pieterjongsma 1y ago
    [dead]
  - cluckindan 1y ago
    YAML is a superset of JSON, so go right ahead and write your .yml files in JSON.
    - galangalalgol 1y ago
      Sometimes what makes something great is what it lacks. An automatic transmission, operator overloading, schema extensions, batteries etc.
    - baobun 1y ago
      YAML is actually not a superset of JSON. https://john-millikin.com/json-is-not-a-yaml-subset https://john-millikin.com/json-is-not-a-yaml-subset https://news.ycombinator.com/item?id=30052633 https://news.ycombinator.com/item?id=30052633
      - cluckindan 1y ago
        The NO case is not valid JSON. So that leaves scientific notation.
        baobun 1y ago
        The point is that "going right ahead and write your .yml files in JSON" is not valid. You'd have to restrict yourself to a subset of JSON to not get different semantics.
        joombaga 1y ago
- sofixa 1y ago
  > many of the most popular programming languages like Go and Python use them as part of their syntax Go doesn't use tabs or whitespace as a part of its syntax. It's a part of the formatting, but not the syntax of the language. Python on the other hand, one extra tab or whitespace can cause havoc.
qsort 1y ago
The gyrations people will go through to avoid using S-expressions...
kubectl_h 1y ago
Exactly how I feel about Python!

fmbb 1y ago

A search for XML on cve.org gives > Showing 1 - 25 of 6,749 results for XML Searching for YAML: > Showing 1 - 25 of 288 results for YAML

baq 1y ago
Is that from the past two years?

tsimionescu 1y ago

While YAML has all sorts of issues and disadvantages compared to XML, security is certainly not one of them. XML is a crazy source of security issues by design, especially with the crazy idea of adding built-in support for URLs that parsers are expected to follow.

quotemstr 1y ago

In what way is this vulnerability YAML-specific?

javcasas 1y ago

Are we going to blame the next RCE we find in some application on XML just because that application uses XML somewhere? If so, then I agree on blaming this on YAML.

immibis 1y ago

NIH syndrome and "inverse second system effect". In the real second system effect, the second system is more complicated because it includes everything that could possibly be perceived as missing in the first system. In the inverse second system effect the first system was perceived as too complicated, not too simple, so the second system is much simpler and doesn't do its job well. Also this vuln has nothing to do with YAML

galangalalgol 1y ago
It is tangentially related in that yaml became normal to use as a DSL within the devops world. As another post said, everything becomes a DSL eventually because people want to be "fully configurable" not realizing that is roughly the same thing as not being complete yet. But in this case the lack of direct acknowledgement of yaml as an interpreted language with an interpreter that doesn't think of itself as such and hence doesn't have a real sandbox, is what leads us to the present. People didn't use xml as a DSL as often because it was so flexible. That would be like using c++ as a DSL instead to write the interpreter for one.
- moondev 1y ago
  This is like blaming python problems on yaml because someone embedded a python script in a multiline string.
  - galangalalgol 1y ago
    I wasn't blaming yaml at all. Our mistake is thinking we are using it as a configuration file. When we are actually using it as an interpreted language. Not yaml's fault people are writing dsl interpreters unknowingly. It's just related because people who make that mistake are picking yaml. I nearly made the mistake with toml a few years ago. You could even make the mistake with complicated environment variable usage. Whenever your configuration source is flexible enough to create executable primitives it needs to be sanitized. And really that is whenever a configurable value gets used in a conditional, which is often. Especially considering that even numeric values become conditional when they are used in operations that can result in ub or even just exceptions/panics/unhandled errors. Not a yaml exclusive.

fapjacks 1y ago

I have no horse in that race but just to see people talking about XML like this a quarter of a century after the first time I saw similar comments is just funny, I don't care who you are.