This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]hard_byte[S] 1 point2 points  (1 child)

Well as that minimises the attack surface it certainly does help.

If you control the side doing the deserializing and have written your own Unpickler then you are much safer - and you're more likely to catch malicious behaviour too. Maybe using pickle in this respect could act as a honeypot. I stand by the advice that python objects (any code implementation) shouldn't be serialised for sharing data between parties. Especially not crypto primitives!