Sujet : serialization
-
Temps écoulé en Go : la sérialisation perd la composante d'horloge monotone
Séparer la mesure de durée locale des horodatages persistés et des politiques de délai inter-processus.
-
Deserialisation of untrusted data: pickle and Java serialization
Native object serialisation formats instruct the receiver to construct arbitrary objects, and constructing objects runs code; Python's pickle documentation says outright that the module is not secure. Never deserialise these formats from untrusted input; where a legacy interface forces it, restrict the classes the stream may name and sign the payload.
-
Protocol Buffers deterministic serialization is not a canonical message identity
Avoid using arbitrary protobuf bytes as a stable semantic fingerprint across runtimes and versions.
Lisible par machine : JSON