3 ms·

That site's listed complaints are all either about a really old YAML spec or about self-inflicted, unrelated technical debt. Granted, Python and other popular

• rurban 1y ago
  The safety concerns are all about the later YAML specs, tags and code. That's why most stayed on the early version, with some white list API.
  • xelxebar 1y ago
    You mean the executable YAML claims? Some are explicitly listed as for the older spec, but indeed a few are for 1.2. However... If you configure your YAML loader to run arbitrary, input-controlled deserialization code, then of course you're opening a can of worms. Just, uh, don't do that for untrusted input maybe? Is $programming_language terrible because some people run user input through eval? The latest YAML (1.2 currently) gives you the option of doing all that stuff if you want. It's a bad implementation that decides to run random code by default, or heaven forbid, bakes such behavior in.