I don’t think it matters, at all. Java has serialization, and everyone uses it, and it’s a security nightmare. As uncomfortable as it may feel to me, I kinda

I don’t think it matters, at all. Java has serialization, and everyone uses it, and it’s a security nightmare. As uncomfortable as it may feel to me, I kinda agree with Oracles approach here: kill serialization, make things more secure. If they have to change core language/libraries, so be it. You were trying to say that anything left on a network socket will be compromised, and that’s simply not true. Most software is pretty solid. Anything in C will have more than it’s fair share of upcoming patches, but unlike Java serialization, you can’t fix a single lib to fix 99% of bugs.. or we would’ve surely done that.