3 ms·

* Insecure: If you are unpickling insecure code, you have other problems. Deserializers should not be used as a protection against hacking. * Old pickles look

* Insecure: If you are unpickling insecure code, you have other problems. Deserializers should not be used as a protection against hacking. * Old pickles look like old code: Again, convert your object into json and serialize that to your database. Oh no, you are missing an attribute. Pickle should not be used so you don't have to employ a release engineer. * Implicit: No software works everywhere with defaults. So use copyreg. * Over-serializes: USE copyreg. * __init__ isn’t called: USE COPYREG. * Python only: what's this for, then? http://www.picklingtools.com/ http://www.picklingtools.com/ * Unreadable: Great feature. * Appears to pickle code: Another great feature. * Slow: check again, it has been 8 years. I can't find any faster method.

ogogmad 6y ago
"* Unreadable: Great feature." ???
- nurettin 6y ago
  Subjective, isn't it?
  - tonyarkles 6y ago
    I’m curious why you find it to be a great feature. Being unreadable doesn’t mean meaningless, obviously, so as far as I can tell, unreadable just means it’s a little more hassle to figure out what it means.
    - nurettin 6y ago
      I just like it when floats and integers are serialized into bytes and it's harder to see what is where. IPC becomes a little harder to decipher. Obfuscation is not exactly a use case for pickle, but still nice extra feature.
stestagg 6y ago
> * Python only: what's this for, then? http://www.picklingtools.com/ http://www.picklingtools.com/ From the picklingtools FAQ: What versions of Python does PicklingTools support? Historically, versions 2.1.x to 2.6.x have been tested extensively. More recently, 2.7 has been tested and should work, but it has not been tested as much as the other versions. 3.x has not been tested: We are waiting for our main paying customer to adopt the 3.x series. [edit] formatting
price 6y ago
> * Insecure: If you are unpickling insecure code, you have other problems. Deserializers should not be used as a protection against hacking. There are lots of good use cases for deserializing untrusted data -- it's what you do in almost any client-server situation. So the fact you can't do this with pickle really is an important limitation.
- manicdee 6y ago
  In what client server situation does it make sense to use pickles over JSON/YAML?
  - hyperpape 6y ago
    None, except when you're taking a huge shortcut. Which is why you want to be super cautious about using Pickle, or Java serialization, or any serialization solution that deserializes arbitrary objects. Once your deserialization isn't explicit about what objects you accept, you have to be super careful about the provenance of that data.
  - price 6y ago
    Like hyperpape said, virtually none. And this point is the biggest reason why. The article is, after all, about reasons not to use pickle. :-)
- nurettin 6y ago
  > There are lots of good use cases for deserializing untrusted data Yes, and untrusted user data should not have arrived at the system in pickle format. And in case of RoR, it should not have arrived in YAML format or loaded with YAML.load[1] So my point stands. [1] https://gist.github.com/niklasb/df9dba3097df536820888aeb4de3284f https://gist.github.com/niklasb/df9dba3097df536820888aeb4de3...

ogogmad 6y ago

"* Unreadable: Great feature." ???

nurettin 6y ago
Subjective, isn't it?
- tonyarkles 6y ago
  I’m curious why you find it to be a great feature. Being unreadable doesn’t mean meaningless, obviously, so as far as I can tell, unreadable just means it’s a little more hassle to figure out what it means.
  - nurettin 6y ago
    I just like it when floats and integers are serialized into bytes and it's harder to see what is where. IPC becomes a little harder to decipher. Obfuscation is not exactly a use case for pickle, but still nice extra feature.

stestagg 6y ago

> * Python only: what's this for, then? http://www.picklingtools.com/ http://www.picklingtools.com/ From the picklingtools FAQ: What versions of Python does PicklingTools support? Historically, versions 2.1.x to 2.6.x have been tested extensively. More recently, 2.7 has been tested and should work, but it has not been tested as much as the other versions. 3.x has not been tested: We are waiting for our main paying customer to adopt the 3.x series. [edit] formatting

price 6y ago

> * Insecure: If you are unpickling insecure code, you have other problems. Deserializers should not be used as a protection against hacking. There are lots of good use cases for deserializing untrusted data -- it's what you do in almost any client-server situation. So the fact you can't do this with pickle really is an important limitation.

manicdee 6y ago
In what client server situation does it make sense to use pickles over JSON/YAML?
- hyperpape 6y ago
  None, except when you're taking a huge shortcut. Which is why you want to be super cautious about using Pickle, or Java serialization, or any serialization solution that deserializes arbitrary objects. Once your deserialization isn't explicit about what objects you accept, you have to be super careful about the provenance of that data.
- price 6y ago
  Like hyperpape said, virtually none. And this point is the biggest reason why. The article is, after all, about reasons not to use pickle. :-)
nurettin 6y ago
> There are lots of good use cases for deserializing untrusted data Yes, and untrusted user data should not have arrived at the system in pickle format. And in case of RoR, it should not have arrived in YAML format or loaded with YAML.load[1] So my point stands. [1] https://gist.github.com/niklasb/df9dba3097df536820888aeb4de3284f https://gist.github.com/niklasb/df9dba3097df536820888aeb4de3...