Conversation

Wait I thought escape was going to mean something hideous like "\True" but no, this cursed format just doesn't require quoting strings at all. WTF is this trash and why would anyone prefer it over JSON (also bad but nowhere near this bad)?! twitter.com/sjmurdoch/stat

This Tweet is unavailable.

Daniel Micay

@DanielMicay

Replying to

@RichFelker

By the way, the most popular implementations of YAML also dynamically execute arbitrary code based on the input. It's used because it looks elegant and user friendly on the surface. It's a lot more aimed at being worked with by humans than JSON and wasn't based around early JS.

1:05 AM · Mar 7, 2021Twitter Web App

Replying to

and

See pyyaml.org/wiki/PyYAMLDoc for an example. > Warning: It is not safe to call yaml.load with any data received from an untrusted source! yaml.load is as powerful as pickle.load and so may call any Python function. Check the yaml.safe_load function though. Great.

Replying to

and

It's similar to the origin of Markdown. It's a poorly designed and loosely specified syntax for marking up data rather than documents where they delegated complex stuff to the underlying system it targeted (HTML for Markdown and the object systems of Ruby, Python, etc. for YAML).

Show replies