this post was submitted on 10 Feb 2026
26 points (88.2% liked)

Python

7790 readers
22 users here now

Welcome to the Python community on the programming.dev Lemmy instance!

๐Ÿ“… Events

PastNovember 2023

October 2023

July 2023

August 2023

September 2023

๐Ÿ Python project:
๐Ÿ’“ Python Community:
โœจ Python Ecosystem:
๐ŸŒŒ Fediverse
Communities
Projects
Feeds

founded 2 years ago
MODERATORS
 

It is common knowledge that pickle is a serious security risk. And yet, vulnerabilities involving that serialisation format keep happening. In the article I shortly describe the issue and appeal to people to stop using pickle.

you are viewing a single comment's thread
view the rest of the comments

project cost = sigma(1...n)(risk likelihood of occurring * risk cost), but we aren't discussing every possible risk. Only the one risk.

The risk of having to:

  • for the app to work, requires compiled components
  • having to be familiar with setup.py. This is referred to as the sewer, which is what is targeted by hackers e.g. xv
  • maintainers who come later being familiar and can maintain packages that incorporate other languages e.g. C or rust
  • possibly neglecting to perform the compile (but lets ignore this)
  • compiler runs a binary written and maintained by the spy agency Google

or

Just not doing that

The only justification for going with protoc, over other methods, could only come down to data serialization speed. But in that case, wouldn't a rust solution be: not only as fast, but also much safer.