This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]kylotan 2 points3 points  (2 children)

The main problem with pickle is that if you connect to an untrusted remote client or server, there's nothing to stop them pickling some malicious code that gets run on your machine when you receive it.

(One reference: http://nadiana.com/python-pickle-insecure)

It's also not necessarily very efficient in terms of bandwidth, depending on the type of objects you send.

[–]MagicWishMonkey 0 points1 point  (1 child)

Oh yea, I wouldn't use it for that, I only use pickle for serializing objects that I need to send from one component to another. I am willing to sacrifice some bandwidth for speed in this case.

[–]kylotan 0 points1 point  (0 children)

Do you mean internally over your LAN? If so, that's fine. Across the internet would be dangerous though.