3 ms·
> 2. Just dump runtime data. Example: Mnemosyne’s old format. Do you use Python? Just dump your state as a Python pickle. (Con: dependency on a particular runti
by trinix912 1y ago
> 2. Just dump runtime data. Example: Mnemosyne’s old format. Do you use Python? Just dump your state as a Python pickle. (Con: dependency on a particular runtime, good luck rewriting it in Rust.)
Be particularly careful with this one as it can potentially vastly expand the attack surface of your program. Not that you shouldn't ever do it, just make sure the deserializer doesn't accept objects/values outside of your spec.
- strogonoff 1y agoI certainly hope no one takes my list as an endorsement… It’s just some formats seen in the wild. It should be noted (the article does not) that parsing and deserialisation is generally a known weak area and a common source of CVEs, even when pickling is not used. Being more disciplined about it helps, of course.