Hacker News Reader

Comment by nurettin | Hacker News Reader

* Insecure: If you are unpickling insecure code, you have other problems. Deserializers should not be used as a protection against hacking.

* Old pickles look like old code: Again, convert your object into json and serialize that to your database. Oh no, you are missing an attribute. Pickle should not be used so you don't have to employ a release engineer.

* Implicit: No software works everywhere with defaults. So use copyreg.

* Over-serializes: USE copyreg.

* __init__ isn’t called: USE COPYREG.

* Python only: what's this for, then? http://www.picklingtools.com/

* Unreadable: Great feature.

* Appears to pickle code: Another great feature.

* Slow: check again, it has been 8 years. I can't find any faster method.

View on HN

> * Python only: what's this for, then? http://www.picklingtools.com/

From the picklingtools FAQ:

What versions of Python does PicklingTools support? Historically, versions 2.1.x to 2.6.x have been tested extensively. More recently, 2.7 has been tested and should work, but it has not been tested as much as the other versions.

   3.x has not been tested: We are waiting for our main paying customer to adopt the 3.x series.

[edit] formatting

> * Insecure: If you are unpickling insecure code, you have other problems. Deserializers should not be used as a protection against hacking.

There are lots of good use cases for deserializing untrusted data -- it's what you do in almost any client-server situation. So the fact you can't do this with pickle really is an important limitation.

> There are lots of good use cases for deserializing untrusted data

Yes, and untrusted user data should not have arrived at the system in pickle format. And in case of RoR, it should not have arrived in YAML format or loaded with YAML.load[1] So my point stands.

[1] https://gist.github.com/niklasb/df9dba3097df536820888aeb4de3...

In what client server situation does it make sense to use pickles over JSON/YAML?

None, except when you're taking a huge shortcut. Which is why you want to be super cautious about using Pickle, or Java serialization, or any serialization solution that deserializes arbitrary objects. Once your deserialization isn't explicit about what objects you accept, you have to be super careful about the provenance of that data.

Like hyperpape said, virtually none. And this point is the biggest reason why.

The article is, after all, about reasons not to use pickle. :-)

"* Unreadable: Great feature."

???

Subjective, isn't it?

I’m curious why you find it to be a great feature. Being unreadable doesn’t mean meaningless, obviously, so as far as I can tell, unreadable just means it’s a little more hassle to figure out what it means.

I just like it when floats and integers are serialized into bytes and it's harder to see what is where. IPC becomes a little harder to decipher. Obfuscation is not exactly a use case for pickle, but still nice extra feature.

Reply on news.ycombinator.com