mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.21k stars 410 forks source link

Replacing XML for templates #534

Open glaslos opened 3 years ago

glaslos commented 3 years ago

For #525 I had to write some XML which was rather unpleasant... I'm suggesting to replace our use of XML for defining the templates with something more human readable, suggestions welcome. I would definitely like to maintain the ability to verify a template with a schema. Whatever we decide to replace XML with, doesn't need to support a schema. but we can verify the JSON we parse from the template.

srenfo commented 3 years ago

I would steer clear of JSON [1][2] and YAML [3], except maybe StrictYAML [4]. Googling for "JSON configuration" had two articles advising against it in the first four results for me. You can find plenty about YAML issues and gotchas as well. I have had minor (JSON) to medium (YAML) issues using them as configuration myself.

On the other hand, with PEP 518 (pyproject.toml), TOML has become a first-class citizen in Python. Contrary to JSON and YAML, it was explicitly designed as a configuration language. The PEP discusses TOML and even includes a comparison table of TOML, JSON, YAML and INI. JSON Schema Everywhere has a section about TOML.

The articles above/below list Hjson, JSON5 and HOCON as further alternatives.

I do not have much experience with either TOML or the other alternatives, but just from the looks of it I suggest TOML.

[1] https://www.arp242.net/json-config.html [2] https://www.lucidchart.com/techblog/2018/07/16/why-json-isnt-a-good-configuration-language/ [3] https://www.arp242.net/yaml-config.html [4] https://news.ycombinator.com/item?id=17358103 (thread with the creators of YAML and StrictYAML weighing in, with some noise)

glaslos commented 3 years ago

Yeah, I share your experience. There are options which are more structured (e.g. HCL) but I'm also leaning towards something which is easy to understand and familiar. I keep this issue around for a bit longer before making a decision. Maybe @t3chn0m4g3 or @xandfury have some input as well.