The Fishbowl

tail -f /dev/mind > blog

November 2015

08Nov2015

The Java Deserialization Bug

By carlfish on

Arbitrary object deserialization (or marshalling, or un-pickling, whatever your language calls it) is inherently unsafe, and should never be performed on untrusted data. →