I'd recommend looking at alternative serialization formats. Pickle is a security risk that programmers writing distributed systems in Python should be educated about.
I understand the risk is basically because you're evaling when unpickling. What formats are safe then?
Pickle (or any use of eval) is a security risk only if you're using it in the context of untrusted code. Basically any distributed task queue is going to have that risk if it can execute arbitrary code.
I thought the risk was if the data came from an untrusted source, as it might contain code?
I think shooting it over the network is considered untrusted. Man in the middle becomes a problem.
Pickle doesn't really use eval, but there is still the potential for users to execute arbitrary code[1]. JSON, YAML, MessagePack, etc are safe in this respect (assuming a well-implemented parsing library) because all the parser does is convert the data into simple data structures.
I was just using eval loosely. The eval I particularly meant is that an __init__ is run for classes with a .__getinitargs__ method defined [1]. And I guess json et al. is the reasonable answer I should have expected. I was hoping for something that mimicked the functionality of pickle but maybe signed the information so that it would be safe to use across a network.