3 ms·

I was thinking Java and .NET yes. Here’s a discussion for .NET core not adding support for security reasons (eventually overruled for backwards compatibility r

by tybit 7y ago

I was thinking Java and .NET yes. Here’s a discussion for .NET core not adding support for security reasons (eventually overruled for backwards compatibility reasons unfortunately). https://github.com/dotnet/corefx/issues/6564#issuecomment-219579151 https://github.com/dotnet/corefx/issues/6564#issuecomment-21... Java: https://www.bleepingcomputer.com/news/security/oracle-plans-to-drop-java-serialization-support-the-source-of-most-security-bugs/ https://www.bleepingcomputer.com/news/security/oracle-plans-...

pjmlp 7y ago
On the context of .NET, not only backwards compatibility, performance is also a big reason, text serialization sucks in that regard. Also the official path forward for WCF is gRPC, which also supports binary serialization. As per Java, Brian Goetz has spoken multiple times about it, but the issue was mainly due to how the whole thing is designed, not necessarily due to using binary formats.