#Safe Serializable?

1 messages · Page 1 of 1 (latest)

signal cave
#

I wonder if there is a way make java Serializable secure
or is it secure already?

devout quiverBOT
#

<@&987246399047479336> please have a look, thanks.

chrome ferry
#

javas own serializable cant be helped

#

forget about it

#

dont use it

#

uae jackson/json and dont look back

signal cave
#

isn't it json parser?

chrome ferry
#

(or similar alternatives to that. the actual format doesnt matter)

chrome ferry
#

and it can autotransform ur java objects to json and back

signal cave
#

what is Serializable used for?

chrome ferry
#

to persist data

signal cave
#

if its useless for some people
why do we need transient?

chrome ferry
#

for example if u want to save sth in a file or send it across the network

chrome ferry
#

jackson for example uses them as well

signal cave
#

okie

chrome ferry
#

(so do other similar tools)

signal cave
#

does java xml serialize?

#

or jackson json

chrome ferry
#

serialization means transforming sth abstract like a java object to a data format that can be persisted. for example text or some binary format

#

so jackson does serialization. so do many other things

tawdry yacht
#

transient means that a field is not serialized

#

which is useful if an object references its parent

chrome ferry
#

yeah. its simply skipped

#

ud mark fields transient that u dont want to be part of the serialization process and for example rather want to construct fresh

signal cave
#

or keyword itself

tawdry yacht
signal cave
#

okie 👍

#

so i just use jackson for storing data in secure way?

tawdry yacht
#

note that if you want a more compact format, don’t use JSON

signal cave
#

compat format?

#

like what?

tawdry yacht
#

binary format

signal cave
#

o

#

well i want in binary format

#

my data, information in binary format

#

doing it in json is overkill

tawdry yacht
#

there are some solutions such as writing to a byte buffer, but you have to be more careful than just using a json writer

signal cave
#

implementing it manually? or what

chrome ferry
#

theres bson, theres protobuf

#

but it all sorta works the same way ultimately

#

the format doesn't matter much for the principle

signal cave
#

is it still json?

tawdry yacht
#

no

chrome ferry
#

no

tawdry yacht
#

it’s not even text anymore

#

it’s just a file of pure data

chrome ferry
#

and jackson itself also supports multiple formats. such as xml or csv

signal cave
#

even bson?

chrome ferry
#

yes bson is also not json anymore

#

its like protobuf compiled against a schema

tawdry yacht
#

json has the benefit of being readable in a text editor at the expense of file size

chrome ferry
#

and hence just the pure data without structural info in it

#

so its minimal size

#

json is also extremely compatible as its the industry standard

#

so ull have a super easy time integrating it in other langs, systems or services

tawdry yacht
#

if you are dealing with very large datasets then binary is better, I have a file exported in a binary format and JSON and the binary is 72 KB and the json is around 300 KB

chrome ferry
#

which both is small enough unless u need to send that around a lot

#

or similar

#

it depends on the use case ultimately

#

but yeah, u got ur options

stiff drift
tawdry yacht
#

depends on what's in those records