Live data from Hacker News

Show HN: Updatecli – What if Dependabot and Ansible had a child?

news.ycombinator.com

11–20 of 39 posts

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#11
> Because let’s say it, everybody loves YAML. YAML is everywhere.

Nope. Nope, nope, nope.

I know a lot of people, including myself, who hates YAML with a passion.

First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then just the "Norway problem". Typically, a bad monday morning could look like this:

    >>> import yaml
    >>> yaml.safe_load(''' 
        port_mappings: 3333:33
        alternative_port_mapping: 3333:33,
        countries: [FR, US, UK, NO, IT] 
        1 : 1,0
        2: 01
        3: 1.0
        4: 1O
        5: 0b1
        6: 0x1
        7: 0i1
        8: hey,
        8.0: oh,
        version: [3.1, "3.1", 3.10, "3.10"]
    ''')

Which may turn into this:

    {
        'port_mappings': 200013,
        'alternative_port_mapping': '3333:33,',
        'countries': ['FR', 'US', 'UK', False, 'IT'],
        1: '1,0',
        2: 1,
        3: 1.0,
        4: '1O',
        5: 1,
        6: 1,
        7: '0i1',
        8: 'oh,',
        'version': [3.1, '3.1', 3.1, '3.10']
    }
It's a terrible, terrible format, that has too much variability, and way too many foot guns. Especially since typo-writing humans are supposed to edit those with their little clumsy hands.

But worse, YAML is mostly declarative, so no complex system can be described in it. Here we come to the second reason people may hate it: it's usually turned into an even worse DSL.

A very limited, badly designed, half documented and tested DSL with almost no tooling to write or debug the stuff. And each project has a different DSL, of course.

Take Ansible. If your playbook is more than 10 lines, it becomes a pain to write because you are basically using a programming language embedded into a markup language. You have no print() or breakpoint to dive into the mess it does. It has to reinvent ways to pass values around since there are no functions with references to parameters nor return values.

Mind you, this DSL calls Python under the hood, so they could have just exposed a declarative, idempotent Python API, but no. The entire world was required to recreate syntax highlighting, snippets, go-to-definition and so on for it. Which will never be good compared to the infra for real languages.

There are few reasons to decide to use YAML, apart from "this is the only rich format supported out of the box by this system that has comments". Which I totally get, but still.

If one can, use JSON, TOML or XML depending of the case, if we need only values.

And if we need more than values, let's either define a clean, restricted API with a full blown programming language, or, if the use case requires it, use CUELang (https://cuelang.org/).

CUELang is cleaner than YAML on all points, even for just data. It can provide a schema, can validate the data with that schema. It can embed logic. It can import and export from YAML and JSON so you stay compatible with the entire devops world.

And it's not Turing complete, but has useful constructs to repeat, branch and reuse code.

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#12

This does sound interesting. Regarding the idea of constantly updating dependencies automatically, I've heard of Dependabot, and haven't used it much myself, but isn't there a danger with an automatic update breaking things in production without supervision? I'd guess I'm missing something in that question?

Depends on your risk tolerance. At a bare minimum you should have tests as part of your project and CI for detecting breaking changes from version bumps, with validating deploys to dev environments, and possibly human review of changes before deploys to prod.

Another thing to consider is malicious packages being published. In the Node ecosystem, the last few times this has happened, the community reacts quickly with a speedy (It's important to ensure your CI systems do not hold any important credentials, and are decoupled from your deployments. In a setup like this, at best, your source code may be stolen by one of these malicious packages. At worst, it will scrape for goodies such as `AWS_SECRET_ACCESS_KEY`.

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#13

> Because let’s say it, everybody loves YAML. YAML is everywhere. Nope. Nope, nope, nope. I know a lot of people, including myself, who hates YAML with a passion. First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then jus…

No post body was provided.

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#14

> Because let’s say it, everybody loves YAML. YAML is everywhere. Nope. Nope, nope, nope. I know a lot of people, including myself, who hates YAML with a passion. First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then jus…

Another yaml problem is that it can have both .yaml and .yml extensions and some tools choose to support only one

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#15

> Because let’s say it, everybody loves YAML. YAML is everywhere. Nope. Nope, nope, nope. I know a lot of people, including myself, who hates YAML with a passion. First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then jus…

Cluelang is a DSL which I already considered and that I like very much. It wasn't high enough in my priorities.

I struggled to use the HCL.

The DSL used by updatecli is not fixed in stone. It's just the interface exposed. The reality nowadays, is that YAML remains the most used DSL.

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#16
post #15

> Because let’s say it, everybody loves YAML. YAML is everywhere. Nope. Nope, nope, nope. I know a lot of people, including myself, who hates YAML with a passion. First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then jus…

Cluelang is a DSL which I already considered and that I like very much. It wasn't high enough in my priorities. I struggled to use the HCL. The DSL used by updatecli is not fixed in stone. It's just the interface exposed. The reality nowadays, is that YAML remains the most used DSL.

To add on top this. I started by supporting other DSL such as Json. Then I realized it was adding burden on me in terms of documentation since people would ask me for different examples.

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#17

> Because let’s say it, everybody loves YAML. YAML is everywhere. Nope. Nope, nope, nope. I know a lot of people, including myself, who hates YAML with a passion. First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then jus…

> Nope. Nope, nope, nope.

Maybe it's just me, but I read this as a joke. As much as we dislike YAML it's not really something we have the luxury of ignoring, especially in the infrastructure field.

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#18
May I suggest creating a JSON Schema for the yaml files, so reasonable editors can help complete the structure?

I didn't study the docs to know how much this is on the "ansible" side of things, where conditions can be almost anything, and thus describing possible legal values would be some monster work

Re: Show HN: Updatecli – What if Dependabot and Ansible had a child?

#19
post #14

> Because let’s say it, everybody loves YAML. YAML is everywhere. Nope. Nope, nope, nope. I know a lot of people, including myself, who hates YAML with a passion. First, they hate the format itself. It's very easy to introduce hard-to-find typos. Plus it has multiple versions, no way to tell which one you use, and depending of the parser that ends up eating the file, you may get weird results. It's way worse then jus…

Another yaml problem is that it can have both .yaml and .yml extensions and some tools choose to support only one

updatecli supports both
Post reply on HN