4 ms·
That's a leading question. Authors of some libraries did not consider the security implications of the object serialisation part of the spec. I assign the blam
by bmn__ 7y ago
That's a leading question.
Authors of some libraries did not consider the security implications of the object serialisation part of the spec. I assign the blame to them for not looking beyond their own limited horizon, metaphorically speaking. When they made their libraries, the reference implementation was already available and it was secure by default.
- Animats 7y agoA "call arbitrary external program" feature does not get in there by accident.
- bmn__ 7y agoIt's not a "call arbitrary external program" feature, but an "object serialisation" feature that has security implications which some implementers did not handle correctly because of their language parochialism and lack of experience. That does make it closer to an unfortunate (but entirely avoidable) accident rather than what you believe, that evil people maliciously and intentionally added a backdoor. You can keep believing it, but that does not make it any more true.