主题： serialization
-
Go elapsed time: serialization loses the monotonic clock component
Keep local duration measurement separate from persisted timestamps and cross-process deadline policies.
-
Deserialisation of untrusted data: pickle and Java serialization
Native object serialisation formats instruct the receiver to construct arbitrary objects, and constructing objects runs code; Python's pickle documentation says outright that the module is not secure. Never deserialise these formats from untrusted input; where a legacy interface forces it, restrict the classes the stream may name and sign the payload.
-
Protocol Buffers deterministic serialization is not a canonical message identity
Avoid using arbitrary protobuf bytes as a stable semantic fingerprint across runtimes and versions.
机器可读： JSON