Why We Hate Java Serialization And What We're Doing About It
summary
Java serialization is claimed to break the object model by bypass constructors and reflectively scrape and stuff private final fields, enabling invariant violations, thread-safety breaks, malicious subclass injection, and resurrection via finalizers. The proposed fix is to make serialization explicit in code: use deconstruction/pattern matching for state extraction and constructors or factories for reconstruction, annotated for intent and versioning. This reduces attack surface but makes cycles harder and requires programmers to provide explicit de/serialize members.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:33Everyone hates serialization
- 1:28What's with all the hate?
- 3:28The benefits...
- 5:43and the costs
- 7:08Serialization mechanics
- 9:19Casualty: thread safety
- 11:05Casualty: initialization mechanics
- 12:39Casualty: confinement
- 15:18Effective Java, Item 88
- 16:43Special bonus attack: finalization
- 18:33Serialization scorecard
- 19:05Lessons
- 20:00Why not "just" use JSON?
- 23:03A language designer looks at serialization
- 25:23The root problems
- 26:29Banishing the magic
- 28:37Deserialization is construction
- 30:33Digression: pattern matching
- 34:25Serialization is deconstruction
- 38:01Versioning
- 39:49Access control
- 41:26Towards better serialization
- 43:14The bad news
- 44:30The long road ahead
- 46:31Summary
related talks
41mJava Serialisation: A Modern Fairytale
47mA Modern Fairy Tale: Java Serialization
41mHigh-Secure Java Serialization
45mSerialization & Object Graph Communication
49mMarshalling: Data-Oriented Serialization
42mSerialization and Object Graph Communication
34mWhen Records Meet Serialization A Happy Tale
23mSerialization 2.0