I'm fine with JSON except it doesn't officially do comments, but that's a big deal IMO

Which is especially problematic for config files where you want helpful hints or a place to store the “old value” while you do something else with the app. I have an app where I change a specific config almost every time I use it. I usually just copy the entire darn node and rename it to something that doesn’t get deserialized. Closest I can get to holding the value in a comment.

Might be interesting to check out json5.

https://json5.org/

This is a great example why we should avoid writing custom DSLs and just use a proper programming language.

Then again, Gradle has come to show why that is a terrible idea.

I think at some point 24 out of 28 Gradle projects I had access to at a certain customer had variations in either kotlin/Groovy style or the way they did or didn't use variables, how they did or didn't do loops or maps and what not.

With Maven you (or someone who know Maven) can immediately look at a rather small, very standardized file and start making educated guesses and so can an IDE.

With Gradle you sometimes have to run it to actually know what it will do.

I had the same experience with Maven vs SBT (scala build system, config is scala). At first it is really cool to have access to a full programming language (in particular when it is the same as the one the project is in, which means that you do not need to "switch brains" when working on the config), but quickly people start trying to be smart or cute, and it becomes a big mess. In particular in Scala, where people _love_ defining new DSLs and favor cuteness over readability. After two years working with SBT I still do not really understand some of the DSLish constructs used in there (and I tried to read the docs).

On the other side I fell in the trap of trying to overcome the limitations of purely declarative config formats by using jinja templates, which also ended up being a very bad idea and a maintenance nightmare.

For most projects, my approach is now to try to be as standard as possible compared to the particular community in the tech at end, and resist the urge to be smart or cute (hard!). Configuration always sucks, and I now prefer to just suck it up and get done with the config part, rather than loosing time reinventing the wheel, ending with a config that still sucks _and_ no one understands.

The good thing about Maven is it is XML so everyone wants to keep it as short as possible ;-)

(More seriously: with Maven shorter and more boring is a sign that everything is correctly configured. Maven works by the convention over configuration principle so if you don't configure something it means it follows the standard. Which again means if you see someone has configured for example a folder or something that usually isn't configured it means they have put something in a non standard location.)

I think it's only popular in the scala ecosystem, but I find HOCON to be a pretty nice superset.

You know that JSON is subset of yaml, right?

Since most people’s (especially critics) understanding of YAML is stuck on YAML 1.1 where that wasn't quite true, probably not.

The commenter said they preferred json over yaml because yaml is whitespace sensitive; Json is not

yaml's feature set is also too broad, forcing safe loaders

I think the point is that if something accepts YAML, you can feed it JSON without issue.

> yaml's feature set is also too broad, forcing safe loaders

Could you elaborate?

Yaml tags allow for serialization of native types, and has been abused to run malicious code.

I think you can also make circular references in yaml effectively making a zip bomb

This is why you have yaml.safe_load in Python and SafeConstructor in Java's snakeyaml package

The end result is that you should not use yaml to handle untrusted data unless you are also explicitly handling it safely

Any de-serialization should be done via safe loaders. Using `require()` or `eval()` isn't something I'd do outside of a very narrow set of scenarios.

The json modules in the same languages doesn't support the madness and doesn't necessitate a safe loader

It's possible someone could come along and write a json library that would support this, but somehow we have made it this far without it and that's a good thing

The point is that yaml and xml both have side effects in the form of require and eval that json won't, and frequently people are unaware of this

I feel I must still be misunderstanding something. OWASP has pages of resources which talk about the lack of safety of JSON:

https://owasp.org/search/?searchString=json

Perhaps yaml and xml have _more_ ways to inject behavior into an application, but I would still not consider JSON safe in any way. Why would JSON.parse() even exist if `require()` and `eval()` were safe to use?

Much easier to have invalid JSON than invalid XML as jsonschema isn’t even close

XML is whitespace sensitive, unless your particular schema just doesn't care about whitespace text nodes.