Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm not sure what your search query is supposed to prove. That something is rare doesn't mean it doesn't exist. I have personally used this YAML feature, albeit very rarely, obviously.


His query is attempting to show that while

> YAML is what people turn to who need these kind of advanced feautures

might be literally true, it is also true that

YAML is what many people turn to even if they don't use those features

So the original concern of

> Powerful but pretty catastrophic if you use (naive) recursion to analyze a user-submitted data structure.

is probably reasonable.

There is a pretty good likelihood that many YAML users (i.e. the app developers) are unaware of the power exposed in the format, and the possible consequences of parsing & walking user input.

It brings back all sorts of memories of XML entity attacks, etc. When developers build simple data interchange methods on top of complex formats that they don't fully understand, all sorts of issues emerge.

It's not YAML's problem per se - it's very helpful that there is a commonly used, complex data format for people who need such features. It would be far worse if everyone was inventing their own solution for this - but the reality on the ground is still pretty messy.


>It would be far worse if everyone was inventing their own solution for this

They are - HJSON, JSON5, TOML, etc. Most of these reference YAML's overcomplicated spec as a reason for their existence.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: