3 ms·

What is wrong with Pickle?

• andreareina 4y ago
  Arbitrary code execution is a big one.
  • HyperSane 4y ago
    I'm aware, but it is not an issue if you only use it with your own data. You can even cryptographically sign it.
• ianbicking 4y ago
  Besides security it's pretty opaque, and unnecessarily so. The data all comes over JSON so there's no non-JSONable types involved. It would be nice to be able to run tools like cost summarizing over the JSON without having to load up any other code.