421

If you're developing a FOSS project, be aware of cryptobros trying to PR a tea.yml into it. (connortumbleson.com)

submitted 3 months ago by db0@lemmy.dbzer0.com to c/opensource@lemmy.ml

98 comments fedilink hide all child comments

Yet another "brilliant" scheme from a cryptobro. Naturally this caused a gold-rush for scammers who outsourced random people via the gig economy to open PRs for this yml file (example)

you are viewing a single comment's thread
view the rest of the comments

[+] toastal@lemmy.ml -98 points 3 months ago* (last edited 3 months ago)

The easy red flag here is YAML. It’s a hideous, overly-complex format for anything so of course a scam would choose it.

[-] db0@lemmy.dbzer0.com 116 points 3 months ago

That's a patently ridiculous statement

[+] toastal@lemmy.ml -31 points 3 months ago

Have you read the spec? It’s a total mess

[-] jeffhykin@lemm.ee 44 points 3 months ago* (last edited 3 months ago)

I have read the 1.2 spec (I'm trying to make a round trip parser for JS, and I do maintainance on a fork of the rumel yaml python package). I actually think its very well thought out, with things I hadn't considered like future extensibility, streaming applications, and data-corruption detection.

The diagrams, color coding, and less-formailty of the spec was much appreciated. Especially compared to something like the ECMA Script spec, which reads like a math textbook had a child with a legal document.

I'm not saying YAML is perfect; round trip (the thing I'm working on) is nearly impossible because it wasn't a design goal. It has a few too many features (I've never seen a declaration in the wild), but it does a good job at accomplishing the creators goals, and the additional features basically only slow down parser-implementers like me. I often pick it because of the tag support, which I've struggled to find an equivalent for in other serialization languages. I use anchors in recursive data structures, and complex keys for serializing complex data structures (not human readable). The "document end" marker has been nice when I'm worried about detecting partial-writes. And the merge key is nice for config files.

The application/perspective matters. Yaml might be bad for you but its not bad for everyone.

[+] toastal@lemmy.ml -9 points 3 months ago* (last edited 3 months ago)

Even if anchors are pretty novel… I’ve watched myself & others fail for things that seem like they should be simple like scalars, quoting, & indentation rules all for being confusing (while failing to understand how/why the tab character isn’t supported).

[-] theherk@lemmy.world 7 points 3 months ago

That sounds like a skill issue. Something isn’t bad because you don’t understand it. Suggesting quoting is an issue for yaml is beyond the pale; it happens to be an issue everywhere.

[-] jeffhykin@lemm.ee 2 points 3 months ago* (last edited 3 months ago)

Despite my love of yaml. I actually think he has a small point with unquoted strings. I teach students and see their struggles. Bash also does unquoted strings and basically all students go years and years without realizing

cat --help
cat "--help"
# ^ same thing

cat *
cat "*"
# ^ not same thing

cat $thing
cat "$thing"
# ^ similar but not the same

To know the difference between special and normal-but-no-quotes you have to know literally every special symbol. And, for example, its rare to realize the -- in --help, isn't special at a language level, its only special at a convention level.

Same thing can happen in yaml files, but actually a little worse I'd say. In bash all the "special" things are at least symbols. But in yaml there are more special cases. Imagine editing this kind of a list:

js_keywords:
- if
- else
- while
- break
- continue
- import
- from
- default
- class
- const
- var
- let
- new
- async
- function
- undefined
- null
- true
- false
- Nan
- Infinity

Three of those are not strings. Syntax highlighting can help (which is why I don't think its a real issue). But still "why are three not strings? Well ... just because". AKA there isn't a syntax pattern, there's just a hardcoded list of names that need to be memorized. What is actually challeging is, unless students start with a proper yaml tutorial, or see examples of quotes in the config, its not obvious that quotes will solve the problem (students think "true" behaves like "\"true\""). So even when they see true is highlighted funny, they don't really know what to do about it. I've seem some try stuff like \true.

Still doesn't mean yaml is bad, every language has edge cases.

[-] theherk@lemmy.world 1 points 3 months ago

While the subjective assessment that quote handling in yaml is worse than bash is understandable, it is really just two of many many cases where quotes complicate things. And for a pretty good reason. They are used to isolate strings in many languages, even prose. They, therefore, always get special handling in lexical analysis. Understanding which languages use single quotes, double quotes, backticks, heredocs, etc and when to use them is really just part of the game or the struggle I guess.

[-] toastal@lemmy.ml 1 points 3 months ago

Most languages require you to put quotes around strings as the norm… breaking that is part of what causes all of the confusion in the first place. Better design upfront would lead to less common errors. I have way more quoting issues in YAML than I do JSON, Nix, Nickel, Dhall, etc. because they aren’t trying to be cute with strings.

[-] jeffhykin@lemm.ee 1 points 3 months ago* (last edited 3 months ago)

When you're editing yaml, why not just always write JSON?

Almost all nix attr keys are unquoted strings. Maybe I'm missing the point list, but I kinda wouldn't expect it to be on the list.

[-] jeffhykin@lemm.ee 1 points 3 months ago

Its easy for me to say "just start writing JSON in the yaml. It doesn't get more simple than JSON", but actually I do think there's a small point with the unquoted strings.

Back before I knew programming, I was trying to change grammar settings sublime 2, which uses yaml. I had no idea what yaml was. The default setting values used unquoted strings fot regex. I knew PCRE regex and escapes, but suddenly they didnt work, and when I tried to match a single quote inside of regex that also didn't work. I didn't know I was editing yaml file (it had a .tmLanguage extension). Even worse, if I remeber correctly, unparsable settings just silently fail. Not only did I have no errors to google, I didn't have any reason to believe the escapes were the cause of the problem (they worked in the command line). Sometimes I edited the regex and it was fine, and other times it just seemed to break. I didn't learn about quoting in YAML until years later.

For me that was an unfortuate combination, which was exacerbated by yaml unquoted weirdness. But when you're talking about "did you read the spec" that's a whole other story. .nan for nan, tabs vs spaces, unquted string weirdness, etc should just be one error message+google away. I think they're a small hiccups with what is overall a great format.