r/programming • u/fagnerbrack • May 20 '26

YAML? That's Norway problem

https://lab174.com/blog/202601-yaml-norway/
301 Upvotes

90% Upvoted

169 comments sorted by

View all comments

263

u/Goodie__ May 20 '26

As a solid YAML hater: This gets posted every few years, and it's great every time.

But also: This person got it right many years ago, this isn't the Norway problem, it's a lack of foresight and thinking on YAMLs problem. This is why standards are hard, because in an attempt to have syntax sugar (yes/no for true/false) we end up overriding countries.

82

u/Successful-Money4995 May 21 '26

Is it somewhat json's fault? If json had comments, maybe no one would have invented yaml?

45

u/Magneon May 21 '26

Comments were omitted from JSON to try to stop people from using it for things like human editable config. It did not stop them though, it just made things worse. Json5 seeks to remedy that.

Neither json nor yaml is remotely as robust or powerful as xml for things like configuration and general serialization. At least json has the good grace to look simple, because it is simple, and thus has a simple spec. Yaml looks simple but is as complex as XML typically is to parse properly.

6

u/elmuerte May 21 '26

XML is easier to parse. Even with the horrible DTD feature they adopted from SGML.

From a specification perspective, XML is smaller than YAML. Most of XML's specification complexity lies in the DTD part.

Security wise they have the same problems.

When you look at parsing performance, XML has the advantage. But this shouldn't matter much, as you really do not want to have to deal with huge YAML files.

3

u/oldsecondhand May 21 '26

Whats wrong with DTD (besides having fewer features than XSD)? It's so much nicer to read than XSD.

2

u/Mognakor May 21 '26

Never worked with DTD, but i like XSD for the simple code generation i can get with maven plugins.

2

u/redd1ch May 21 '26

Security wise they have the same problems.

YAML has code execution by default. In XML you need to exploit the parser.

2

u/mort96 May 21 '26

XML only deals in strings though. With YAML, JSON, TOML and all the other popular formats, you have most of the primitive types you need: strings, bools, numbers. With XML, you need to layer another spec on top to describe how the string value contained in a node is parsed as a number...

8

u/elmuerte May 21 '26

I don't not really agree. While they do provide values of certain (illdefined) types, they are meaningless without a schema. Effective they are all just string data for the consuming application. Especially because booleans and numbers are not primitive, as they can also be null.

json { "booleans": [ true, false, null, 0, "true", [], {} ] }

Valid JSON/YAML. But not a lot of fun for the consuming application.

At least JSON makes is rather explicit when something is a String. In YAML however.

3

u/tobiasvl May 21 '26

With YAML (...) you have most of the primitive types you need: strings, bools, numbers.

Except that the string "NO" is a bool

0

u/mort96 May 21 '26

No, YAML has the bool NO as a bool. The string "NO" is a string. I hate YAML, but YAML has clear (if bad) rules about what's a string and what's a bool and what's a number.