423

If you're developing a FOSS project, be aware of cryptobros trying to PR a tea.yml into it. (connortumbleson.com)

submitted 7 months ago by db0@lemmy.dbzer0.com to c/opensource@lemmy.ml

94 comments fedilink hide all child comments

Yet another "brilliant" scheme from a cryptobro. Naturally this caused a gold-rush for scammers who outsourced random people via the gig economy to open PRs for this yml file (example)

you are viewing a single comment's thread
view the rest of the comments

[-] theherk@lemmy.world 7 points 7 months ago

That sounds like a skill issue. Something isn’t bad because you don’t understand it. Suggesting quoting is an issue for yaml is beyond the pale; it happens to be an issue everywhere.

[-] jeffhykin@lemm.ee 2 points 7 months ago* (last edited 7 months ago)

Despite my love of yaml. I actually think he has a small point with unquoted strings. I teach students and see their struggles. Bash also does unquoted strings and basically all students go years and years without realizing

cat --help
cat "--help"
# ^ same thing

cat *
cat "*"
# ^ not same thing

cat $thing
cat "$thing"
# ^ similar but not the same

To know the difference between special and normal-but-no-quotes you have to know literally every special symbol. And, for example, its rare to realize the -- in --help, isn't special at a language level, its only special at a convention level.

Same thing can happen in yaml files, but actually a little worse I'd say. In bash all the "special" things are at least symbols. But in yaml there are more special cases. Imagine editing this kind of a list:

js_keywords:
- if
- else
- while
- break
- continue
- import
- from
- default
- class
- const
- var
- let
- new
- async
- function
- undefined
- null
- true
- false
- Nan
- Infinity

Three of those are not strings. Syntax highlighting can help (which is why I don't think its a real issue). But still "why are three not strings? Well ... just because". AKA there isn't a syntax pattern, there's just a hardcoded list of names that need to be memorized. What is actually challeging is, unless students start with a proper yaml tutorial, or see examples of quotes in the config, its not obvious that quotes will solve the problem (students think "true" behaves like "\"true\""). So even when they see true is highlighted funny, they don't really know what to do about it. I've seem some try stuff like \true.

Still doesn't mean yaml is bad, every language has edge cases.

[-] theherk@lemmy.world 1 points 7 months ago

While the subjective assessment that quote handling in yaml is worse than bash is understandable, it is really just two of many many cases where quotes complicate things. And for a pretty good reason. They are used to isolate strings in many languages, even prose. They, therefore, always get special handling in lexical analysis. Understanding which languages use single quotes, double quotes, backticks, heredocs, etc and when to use them is really just part of the game or the struggle I guess.

[-] toastal@lemmy.ml 1 points 7 months ago

Most languages require you to put quotes around strings as the norm… breaking that is part of what causes all of the confusion in the first place. Better design upfront would lead to less common errors. I have way more quoting issues in YAML than I do JSON, Nix, Nickel, Dhall, etc. because they aren’t trying to be cute with strings.