3 ms·
Why the heck are those classes marked as `implements Serializable`?...
by bonzini 8y ago
Why the heck are those classes marked as `implements Serializable`?...
- dwaite 8y agoPossibly because a superclass or interface are marked, and it is inherited? The problem is that (excluding the new filtering mechanism) deserialization is unscoped - any class in your code, a third party library, or the core VM is fair game in an attack.
- dionian 8y agoIt is a marker interface. You are supposed to consciously opt-in.
- bonzini 8y agoExactly, so I am not sure why wrappers to native pointers are Serializable.