Conversation

Wait I thought escape was going to mean something hideous like "\True" but no, this cursed format just doesn't require quoting strings at all. WTF is this trash and why would anyone prefer it over JSON (also bad but nowhere near this bad)?! twitter.com/sjmurdoch/stat

This Tweet is unavailable.

Replying to

By the way, the most popular implementations of YAML also dynamically execute arbitrary code based on the input. It's used because it looks elegant and user friendly on the surface. It's a lot more aimed at being worked with by humans than JSON and wasn't based around early JS.

Replying to

and

See pyyaml.org/wiki/PyYAMLDoc for an example. > Warning: It is not safe to call yaml.load with any data received from an untrusted source! yaml.load is as powerful as pickle.load and so may call any Python function. Check the yaml.safe_load function though. Great.

1:07 AM · Mar 7, 2021Twitter Web App

Replying to

and

It's similar to the origin of Markdown. It's a poorly designed and loosely specified syntax for marking up data rather than documents where they delegated complex stuff to the underlying system it targeted (HTML for Markdown and the object systems of Ruby, Python, etc. for YAML).

Replying to

and

At least Markdown has commonmark.org but it still depends heavily on extensions and/or HTML along with having some messed up syntax decisions. YAML is immensely complex and has the same issues with ambiguities, etc. without a coalition that came together to fix it up.

Show replies