Java Serialization was a Horrible Mistake

Editing Monitors :

Follow on Facebook:

Subscribe to our other channel:
Telusko Hindi :

Donation:
PayPal Id : navinreddy20
Patreon : navinreddy20

[alexanderaric]

One of the most horrible ways to explain serialization vulnerability. Out of ~5 mins time the only relevant invormation was " some researches found some issues with serialization concept". Nice.

[DeepakSharma-iuwn]

How to we remove hudson.utils error comes due to two versions of java in linux.

[prasadhonrao]

so once serialization feature gets removed, how would you convert the object to byte stream and transfer it from one JVM to another?

[AnandChaugule]

If we don't have to use serialization then what will be the alternative to transfer my object to another place please suggest kindly already in Hibernate I am using serialization most of place to store object in db.

[aartigiblogs]

Sir why we use the serialVersionUID in spring boot? Please tell me sir

[anchitsharma]

In one of my project I'm serialize a complex object using Google gson library but at the time of creation it give me memory out of bound exception. Please help me .

[ramanapanku]

Hello sir,

I am not sure this is very silly reason as I know ...See attack can happen in main server also .Then what you will do ..

Here the thing is while deserialization retrive the info from class as what we have declared serialization_id I.e version ...

Here where exactly the issue ?

While passing the data from one server to another server ..Already we have deCription and encryption ?

Now how the object will be tempted ?

Plz suggest ?

[ferdibal]

As an amateur, i wanna ask this, Why can't we use directly class name in message while sending object's data?

[madhu]

then why SerialversionUid?
To eliminate such problems.
Although jvm creates it internally..but it is suggested we explicit define it.(you will also get compile time error)

[himanshuupadhyay]

02:12 JVM try to detect which class to deserialize, Is this one thing that makes de-serialization vulnerable?

[santhanamkrishnan]

What thing going to replace serialization?

[alansimon]

What did Oracle ever make of this issue? Has it been remedied?

[najoboj]

I recently started watching your channel. Excellent tutorials.

It would be great if you could cover the topic of obfuscation, basic ways of protecting code.
There is not much on that on topic on youtube.

[anchalkanungo]

How we can serilization filter can uh explain me in little more depth?

[aperson]

Now it's time to recreate our serialized classes using serializing filter.... Oh man thats a lot of work....

[DeepakKumar-qcrg]

Is it removed already from java or companies are still using it?

[adams]

4 years later and Java still supporting Serialization.

[phanindraitika]

Sir, thanks for the video. I have a question, what would be the alternative to serialisation at this point. If we stop using serialisation, is there a way by which we can get the same effect ?

[immortalhuman]

Instead of removing serialization from java, why we dont use end to end encryption in serialization and deserializarion?

[harshable]

Please explain serialization compatibilty and incompatibility issue?