Hacker News Reader

Someone at work recently got bit by unexpected YAML parsing a git commit hash that contained a substring which was a valid number in scientific notation (IIRC 5e38031).

Ouch

YAML is interesting, because at first glance it looks like a pretty convenient, human-readable syntax, it's got lists, dicts/mappings, strings, numbers, booleans... simple enough for 90% of the use-cases, and focusing on "human-readable, right? But look at little deeper and one uncovers some horrors.

In particular, the plethora of boolean values... here let me just grab the regex from the spec [1]:

    y|Y|yes|Yes|YES|n|N|no|No|NO
    |true|True|TRUE|false|False|FALSE
    |on|On|ON|off|Off|OFF

At that point why limit yourself to just the English language?

Then there's the language-specific types or, as YAML calls them, "local tags". The stuff preceded by `!` like

    !!map {
      ? !<tag:yaml.org,2002:str> "foo"
      : !<!bar> "baz"
    }

At that point, you've exceeded the scope of "human-readable".

I'll admit there are some other, er, "complications" that I actually like. In particular, anchors (`&FOO`) and aliases/references (`*FOO`) [2] make it possible to describe arbitrary graphs, and I find it very useful to factorizing blocks. Also, "folding" [3] text, which allows you to spread value/text across multiple lines for readability, while respecting the surrounding indentation, is neat.

[1] https://yaml.org/type/bool.html

[2] https://yaml.org/spec/1.0/#syntax-anchor

[3] https://yaml.org/spec/1.0/#id2566944

YAML 1.2 fixed the boolean thing.

Language tags can get weird but they're ultimately just additional types implemented by your yaml parser you should basically always turn off/not turn on unless you know you want it. You can serialize classes in your language without it.

Tags are really good for readability if you use them thoughtfully

    value: !!binary
       base64string

    # ordered map
    value: !!omap
      a: 123
      b: 455

The reason that example is so ugly is it's using the "complex mapping key" syntax which is unbelievably ugly but if you're using objects as keys in your map you abandoned sanity long ago.

> YAML has a lot of extra stuff going on that can cause accidents if you don't take care. The classic example is the "Norway problem" where "no" (the country code for Norway) is parsed as "false" instead. If "no" is used as a key, this can cause the Norwegian data to disappear or to throw strange errors on load.

This was fixed in YAML 1.2, but the problem is that almost nobody uses (and there is patchy support for) it.

The vast, vast majority of issues with YAML can be solved by quoting all strings. Then a lot of the type inference magic goes away.