YAML's Norway Problem: A Cautionary Tale
Description
A screenshot of a Twitter thread discussing configuration formats. The initial tweet by Simon Høiberg asks, 'Do you prefer JSON or YAML when setting up configuration?' and shows two code blocks comparing the syntax of JSON and YAML for a sample configuration. Below this, a reply from Aaron Abramov reads, 'I once disabled our product for the entire country of Norway for a day because `NO` in YAML evaluates to `false`'. This meme highlights a notorious pitfall in YAML known as 'The Norway Problem.' YAML's specification allows for automatic type conversion, meaning it interprets certain unquoted strings like 'NO', 'no', and 'off' as the boolean value `false`. If a configuration file uses the two-letter country code for Norway ('NO') as a string value without quoting it, a YAML parser can silently convert it to `false`, leading to unexpected and potentially catastrophic application behavior, as humorously illustrated by the tweet
Comments
7Comment deleted
YAML is that 'helpful' friend who automatically turns your shopping list item 'NOrway' into 'false' because they assumed you were being negative. JSON just asks you to be explicit and doesn't cost you a Scandinavian country
YAML taught us that an unquoted “NO” is a boolean; the post-mortem taught us that schema validation is cheaper than explaining to Norway why their country was toggled off
The real reason Norway has such high software quality standards isn't their education system - it's natural selection from surviving decades of YAML parsers treating their country code as a boolean false
This is the YAML equivalent of Bobby Tables - except instead of dropping tables, you're dropping entire countries. The real kicker? YAML 1.1's spec includes 22 different ways to represent boolean false (yes, on, off, y, n, true, false, and apparently NO for Norway). It's the gift that keeps on giving, which is why seasoned engineers now treat YAML like a loaded footgun: powerful for simple cases, but one misplaced country code away from an international incident. JSON may be verbose, but at least it won't accidentally geofence your users
YAML: Human-readable until eval() turns your config into a national incident
YAML: where ISO codes are booleans - “NO” is false in 1.1, instantly turning Norway into a feature flag; turns out commas in JSON are cheaper than Sev-1s
YAML 1.1 implicit booleans: the reason our runbook now says “quote ISO‑3166 codes or enjoy a nationwide feature‑flag outage.”