A website created by developer Geoff Huntley documents widespread frustrations with YAML, the configuration language widely adopted in DevOps and Kubernetes environments.
According to the source, YAML presents several categories of problems. Type-conversion issues are particularly problematic. The format treats values like 07 and 08 differently, parsing them as integer 7 and string “08” respectively. Time-like values such as 04:30 get converted to seconds since midnight (16200) unless explicitly marked as strings. Version numbers like 1.7 and 1.70 parse as identical, while 1.7.0 and 1.70.0 parse as different values—a critical issue when specifying package versions.
Boolean ambiguity presents another hazard. In YAML 1.1, the string “NO” parses as a boolean false rather than the country code for Norway, requiring quotes to preserve the intended value. The specification offers 22 different ways to represent true or false, creating confusion across implementations.
The source documents security concerns related to YAML’s executable nature. References cite vulnerabilities in Ruby’s YAML parser, PHP’s yaml-parse function, and PyYAML’s yaml.load() method, which can execute arbitrary code when processing untrusted input.
Octal notation handling differs between YAML versions, with YAML 1.1 using 0666 notation and YAML 1.2 using 0o666. The source notes that learning this distinction “is a DevOps rite of passage” for Kubernetes users whose clusters fail unpredictably on the eighth deployment.
Escaping becomes increasingly complex in nested contexts. The source provides an example of CloudFormation and CloudWatch configurations requiring multiple layers of escape sequences, making configurations difficult to read and maintain.
The resource also highlights inconsistency across YAML parsers. One Twitter reference states “Every YAML parser is a custom YAML parser,” suggesting implementations diverge significantly from the specification. The source notes there are 63 different ways to write multi-line strings in YAML.
The website itself demonstrates these frustrations through its design—it functions as an editable text field, intentionally as difficult to use as YAML itself. The source includes Reddit feedback ranging from hostile criticism of the website’s usability to agreement with its underlying critique of the format.
The resource concludes by listing alternative configuration languages, including Nickel, Dhall, CUE, and Jsonnet, positioning them as potential replacements for YAML in infrastructure-as-code contexts.
Key facts
- YAML converts values like ‘07’ and ‘08’ to different types (integer and string respectively)
- Time values like ‘04:30’ parse as seconds since midnight (16200) unless explicitly marked as strings
- The string ‘NO’ parses as boolean false in YAML 1.1 rather than the country code for Norway
- YAML 1.1 and YAML 1.2 use different octal notation (0666 vs 0o666)
- Security vulnerabilities exist in multiple YAML parser implementations that can execute arbitrary code
- Version numbers like 1.7 and 1.70 parse identically, while 1.7.0 and 1.70.0 parse differently
- There are 63 different ways to write multi-line strings in YAML