Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

8
  • 19
    Whoever gives the advice, would be great to tell you what to do instead. Commented Apr 17 at 8:40
  • 2
    I think the real advice is, you should never ever ever use readObject to do deserialization. Serialization by itself is fine. Commented Apr 18 at 15:27
  • 1
    @SteveSummit how else would you deserialize what you wrote with writeObject? Of course you can write your own deserializer for safe compatibility with someone else who serialized with writeObject, but you'd do better to replace both the writing and reading if you can. Commented Apr 18 at 15:30
  • 2
    @StackExchangeBrokeTheLaw It was a tongue-in-cheek comment, but the point is that saying "you should never ever ever use readObject to do deserialization" is not only more accurate (because serialization truly isn't the unsafe part), but also less confusing, because it's more likely to point you to where the real problem is. You heard "You should never ever ever use Java serialization" and you had to ask about it here, because it's kind of a meaningless statement by itself. Commented Apr 18 at 15:35
  • 2
    But, never mind, I see it was a self-answered question, so you knew that. Commented Apr 18 at 15:38