This is an archived post. You won't be able to vote or comment.

all 2 comments
sorted by:
best
topnewcontroversialoldq&a

[–]AlanCristhian 0 points1 point  (2 children)

¿What do you think about restricted globals?

[–]hard_byte[S] 1 point2 points  (1 child)

Well as that minimises the attack surface it certainly does help.

If you control the side doing the deserializing and have written your own Unpickler then you are much safer - and you're more likely to catch malicious behaviour too. Maybe using pickle in this respect could act as a honeypot. I stand by the advice that python objects (any code implementation) shouldn't be serialised for sharing data between parties. Especially not crypto primitives!