Live data from Hacker News

YAML: Probably not so great after all

arp242.net

151–160 of 457 posts

Re: YAML: Probably not so great after all

#151
The first argument, about YAML security, isn't valid; YAML is hardly the only format whose parsers have admitted deserialization vulnerabilities (they're endemic in Java; Rails had this problem with XML, and even before ROP-style deserialization was a thing, XML was getting applications owned up through external entity definitions).

Format aside, no matter which you choose, you have to pick library interfaces that don't deserialize to arbitrary, constructed objects.

Re: YAML: Probably not so great after all

#152
post #111

Earlier quoted context omitted.

Attributes are XML’s foot-gun. I disagree. Back in the day we used attributes for everything that was key value and inner tags for anything with structure. We also formatted for clarity: Compared with what we used to do, I look at attribute-less maven pom.xml with horror.

What if it's to be used by french speaking software/people ? Or Dehors Außenseite Outside Quite curious about it.

I guess this way:

  
    Dehors
    Draußen
    Outside
  
says[0]the w3.

[0]https://www.w3.org/TR/REC-xml/#sec-lang-tag

Re: YAML: Probably not so great after all

#153
The problem with most configuration file formats is: you can't put functions in them realistically.

The best configuration file is simply source code that initializes whatever you want to run, and then runs it. That way, you can install hooks in the form of closures and make the program behave exactly like you want without the constraints that a simple "value-only" configuration file format has.

Re: YAML: Probably not so great after all

#154
tl;dr: Another alternative to YAML (among many great others), this one designed and developed by me:

https://eno-lang.org/

I've been doing a lot of research and development on language design for file-based content (e.g. for static site generators). I've found that YAML - although established as the go-to format for statically generated blogs, etc. - was never designed for these things as it by its nature does not support simple, essential features for this usecase like for instance unindented blocks of verbatim text (for which YAML frontmatter was invented as a very limited hack).

The result of all this R&D is a language called "eno notation" which is designed especially for file-based content usecases, and around which I've also built an entire ecosystem for many languages and editors - if you're working in that field, it might be worth taking a look!

Re: YAML: Probably not so great after all

#155
post #30

Earlier quoted context omitted.

You say that like you’ve never really used XML... (Mostly /s. Come at me:))

I've used it quite a bit. I even like the namespacing bits. I find that XML composes elegantly in a way that the JSON and friends don't. My one request would be to bring back to SGML-like closing tag abbreviation: That is, instead of qux we should be able to write qux I think this one change would make XML more "palatable" for the JSON/YAML/TOML crowd.

Or even better:

  >
(Although standard SGML inexplicably specifies a null-end-tag character of '/' rather than '>', so this won't work in stock parsers.)

Re: YAML: Probably not so great after all

#156

The problem with most configuration file formats is: you can't put functions in them realistically. The best configuration file is simply source code that initializes whatever you want to run, and then runs it. That way, you can install hooks in the form of closures and make the program behave exactly like you want without the constraints that a simple "value-only" configuration file format has.

This may be application-specific, but I might worry about security if my configuration files support arbitrary closures.

Re: YAML: Probably not so great after all

#157
post #25
post #20

Earlier quoted context omitted.

> JSON was a reaction to the verbosity of XML, but a better reaction would have been to work harder on our text editors so that working with XML would be just as easy as working with JSON in terms of the numbers of keystrokes needed. Isn't that only solving half the problem? XML is also pretty difficult to read

Look. I am just a web guy. But why is XML so freaking great? We can’t even tell if whitespace is significant or not. If a schema says it’s insignificant then that’s that! https://www.oracle.com/technetwork/articles/wang-whitespace-... That alone is TERRIBLE! (Same problem with YML.) Why should I bother with that? JSON can encode strings, hashes, arrays etc. in a way that’s instantly interoperable with JS and is far f…

One thing that bugs me about JSON is that it can't easily [0] represent general graph-structured data because its notion of identity is too limited. XML can represent general graphs trivially.

[0] https://realprogrammer.wordpress.com/2012/08/17/json-graph-s...

Re: YAML: Probably not so great after all

#158

Earlier quoted context omitted.

Aren't we just reinventing the wheel, though? Got your structured data format, now you need parsers (tons available for XML, incl SAX, DOM parsers, SimpleXML, Nokogiri...) a schema and validation tools (XSD), a templating mechanism (XSLT), a query language (XPath), ... JSON was a reaction to the verbosity of XML, but a better reaction would have been to work harder on our text editors so that working with XML would b…

Verbosity certainly is an issue with XML, but far from the only one. IMO the main problem of XML is that it was designed as a markup language, but then misused as a data structure serialization language. When used as a markup language, the distinction between attributes and children is meaningful. When serializing data structures, the dichotomy breaks down. For most subfields of a larger data structure, it's not obvi…

> not obvious whether to serialize that subfield as an attribute or as a child.

Attributes are just strings, generally for metadata. I'd probably serialize an object from another language more verbosely. This is where an important distinction needs to be made: the XML format you use for config files or for data exchange from your app to others should not necessarily be just a serialized object from the most convenient form inside your application. If you care about the operators of the app, you'll allow them a more concise format for that kind of thing, and use XSD or your own internal mechanisms to turn that into an object you want to actually work with.

It's the sort of problem people have once, abstract away, and move on from.

Re: YAML: Probably not so great after all

#159

The problem with most configuration file formats is: you can't put functions in them realistically. The best configuration file is simply source code that initializes whatever you want to run, and then runs it. That way, you can install hooks in the form of closures and make the program behave exactly like you want without the constraints that a simple "value-only" configuration file format has.

This may be application-specific, but I might worry about security if my configuration files support arbitrary closures.

Any more so than the rest of your code?

Re: YAML: Probably not so great after all

#160

So what's the HN consensus on the best format for config files? Is it TOML as the author seems to prefer at the end?

I say just use JSON. Everyone knows it already and it's good enough. Use a parser in your app that allows comments and trailing commas like vscode does.
Post reply on HN