423

If you're developing a FOSS project, be aware of cryptobros trying to PR a tea.yml into it. (connortumbleson.com)

submitted 10 months ago by db0@lemmy.dbzer0.com to c/opensource@lemmy.ml

94 comments fedilink hide all child comments

Yet another "brilliant" scheme from a cryptobro. Naturally this caused a gold-rush for scammers who outsourced random people via the gig economy to open PRs for this yml file (example)

you are viewing a single comment's thread
view the rest of the comments

[-] kogasa@programming.dev 10 points 10 months ago

Not that YAML's structure is too complicated, but its syntax is too flexible. All the shit about being whitespace sensitive yet with whitespace errors leading to a syntactically valid YAML document. TOML's syntax is rigid which makes it unsuitable for expressing complex nested data structures, which is good because that's not what you should use TOML for. Ultimately the dependence on a highly flexible baseline language like YAML to create complex DSLs is a failure on the developers' part, and the entire configuration system should be reworked.

[-] moonpiedumplings@programming.dev 3 points 10 months ago* (last edited 10 months ago)

Do you use a linter like the ansible vscode extension?

I used to hate writing ansible, and yaml, until I installed the ansible lint vscode extension, and everything became much, much easier.

Later on, when I was working on a docker-compose, I noticed that the vscode yaml extension (which the ansible extension pulled in as a dependency) caught errors. It's quite intelligent, able to spot errors exactly like what you mentioned, where the yaml syntax is correct, but the docker-compose, or the ansible syntax is wrong.