> The fix: All buffers should be length prefixed from database How does this fix anything? When you compose length prefixed data (in e.g. arrays, nested stucts

> The fix: All buffers should be length prefixed from database How does this fix anything? When you compose length prefixed data (in e.g. arrays, nested stucts) you still have to check if these length and offset fields are coherent. If these length fields get passed over the wire from the user, you still can't trust their values. Binary protocols don't solve this problem, they just make doing the validation less CPU hungry.