Is this still about malicious payloads in serialized Java packets? I don't use Java so maybe I'm being unjust, but I'm smiling slightly because Python went thr

Is this still about malicious payloads in serialized Java packets? I don't use Java so maybe I'm being unjust, but I'm smiling slightly because Python went through this 20 years ago with regard to the pickle protocol. It was originally intended to be ok for transporting hostile data, and it took a fair amount of persuasion and a few security incidents to turn the community's thinking around about that. ast.literal_eval was invented partly for this reason, but the generally preferred way to serialize now is usually json.