search

ietf-wg-httpapi / mediatypes

Other
5 stars 4 forks source link

The text/yaml media type should not be defined #11

Closed eemeli closed 2 years ago

eemeli commented 2 years ago

For context, I'm one of the members of the YAML core team and the author of the JS yaml package. We were approached by @ioggstream primarily to ensure that the parent specification includes a proper discussion of the security considerations inherent in workign with YAML.

While I strongly support defining the application/yaml media type, I do not think that the text/yaml should be defined at this time. The rationale given for this appears to be based on a current difference in browser behaviour, and a nominal need to communicate consumer intent from the source.

Defining more than one media type is superfluous, and creates unnecessary uncertainty. The bare-text presentation of YAML content to a human is already now achievable by presenting YAML as text/plain, exactly as is the case with JSON, which canonically uses the application/json media type.

If a different medium than GitHub issues is the best way to discuss this, I would be happy to make myself available to any such endeavour.

ioggstream commented 2 years ago

@eemeli thanks for your feedback! I think this is the right place to discuss that.

  1. Happy to confirm that the yaml community is ok with application/yaml. Please, integrate the other "deprecated" media types (eg. application/x-yaml, application/vnd.yaml, ...)

  2. Agree on presenting yaml as text/plain: maybe google-chrom just uses text/ for that and does not have a specific behavior wrt text/yaml and https://www.iana.org/assignments/media-types/ I see that text/javascript has been deprecated.

Can you PR that change?