What YAML engine do you use?

[Paul Rubin]

aleaxit at yahoo.com (Alex Martelli) writes:
> I wonder, however, if, as an even "toyer" exercise, one might not
> already do it easily -- by first checking each token (as generated by
> tokenize.generate_tokens) to ensure it's safe, and THEN eval _iff_ no
> unsafe tokens were found in the check.

I don't trust that for one minute.  It's like checking a gun to make
sure that it has no bullets, then putting it to your head and pulling
the trigger.  Or worse, it's like checking the gun once, then putting
it to your head and pulling the trigger every day for the next N years
without checking again to see if someone has inserted some bullets
(this is what you basically do if you write your program to check if
the tokens are safe, and then let users keep running it without
re-auditing it, as newer versions of Python get released).

See the history of the pickle module to see how that kind of change
has already screwed people (some comments in SF bug #467384).  "Don't
use eval" doesn't mean mean "check if it's safe before using it".  It
means "don't use it".