4 ms·
I'm not really interested in having a language shootout but I will say that I think you may be misunderstanding Java's history of serialization vulnerabilities.
by staticassertion 8y ago
I'm not really interested in having a language shootout but I will say that I think you may be misunderstanding Java's history of serialization vulnerabilities.
- kllrnohj 8y ago> I think you may be misunderstanding Java's history of serialization vulnerabilities. Can you elaborate? https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet is just one example compendium. The number of vulnerabilities in this area is huge, across a wide range of libraries. It really is an entire category of exploits at this point, and it's still ongoing (eg, from last year: https://nvd.nist.gov/vuln/detail/CVE-2018-4939 https://nvd.nist.gov/vuln/detail/CVE-2018-4939 )
- staticassertion 8y agoYou're right that it's a real footgun, the major issues that I'm aware of are in the native serializer, but yeah even the big libraries like Jackson have had issues. I don't consider those on the same level as memory unsafety, personally, but it's not really a meaningful comparison because I'm not going to dig around for numbers and mitigation techniques.