4 ms·
> unless you override Java's default serialization behavior and build a whole lot of black magic. ...but then, if the developer is writing custom deserializati
by marcodave 8y ago
> unless you override Java's default serialization behavior and build a whole lot of black magic.
...but then, if the developer is writing custom deserialization code that does black magic (like, executing the equivalent of eval() on a content of a String field), any serialized format is affected, be it binary, JSON, YAML, etc