Hacker News Reader

Comment by woodruffw | Hacker News Reader

I don't think this really has anything to do with YAML; Conda appears to have defined a bespoke semi-DSL in comments rather than encoding it in YAML itself. They could have done this in any configuration language that supports comments. That doesn't make it any less cursed, of course.

(If I'm reading this correctly, they may have their own "YAML" parser entirely -- multiple keys with different values shouldn't be distinctly represent-able in a normal YAML document, at least not after parsing.)

View on HN

> (If I'm reading this correctly, they may have their own "YAML" parser entirely -- multiple keys with different values shouldn't be distinctly represent-able in a normal YAML document, at least not after parsing.)

I don't think they have their own YAML parser - the preprocessor just strips out lines whose magic comments return False.

I can't tell if that's better or worse :-)

Higher order YAML logic, sounds fun to implement as a preprocessor

I think you're technically correct, but in practice you do see these misguided templating ideas seem to be almost universally YAML and Python.

I've never seen someone try to template JSON or XML like this. About the closest is HTML templating but even that is not really the best way these days.

I haven't seen anyone template JSON (probably because its so simple and painful to write you don't need to), but I have seen XML templating with comments (I guess you could XSLT, but I suspect the templating was easier to implement and understand). Also, helm/kubernetes are in go, so I think whenever strings are used as input, people will try to template it.

> in any configuration language that supports comments

Notably, not JSON. In fact JSON doesn't support comment specifically to prevent this. And YAML was created specifically to add comments to JSON, in violation of this precaution. So YAML can eat the lunch that it serve itself.

I have seen plenty of JSON applications abuse the "$" key namespace for comments. JSON Schema, for example, uses `$comment`[1]. So no, I don't think this is a shingle that can be uniquely hung around YAML's neck.

The Norway problem, anchors & references, infinite ways to begin a multi-line string, on the other hand, are all legitimate grievances that are somewhat unique to YAML.

Edit: And note: what makes this hack bizarre is that they chose to do it in comments, despite YAML having ample syntax for an inline dictionary or whatever else. YAML offers all kinds of exquisitely complicated ropes to hang yourself with, and they chose plain old boring comments!

[1]: https://json-schema.org/understanding-json-schema/reference/...

> In fact JSON doesn't support comment specifically to prevent this.

They were mainly concerned about interoperability but partially yes.

Source: https://web.archive.org/web/20190112173904/https://plus.goog...

You can exploit any ambiguity besides from comments. JSON in particular doesn't fully forbid duplicate keys in objects (though many implementations do reject them), and I think they were already abused as comments in the past. And you can always use special keys like `$when` (a la MongoDB) to add turing completeness, so even that point is moot.

Reply on news.ycombinator.com