-
Notifications
You must be signed in to change notification settings - Fork 196
Description
This was originally added by #43 from @master in 2016. Removal was suggested by @rmuir in #254; this comment from there by @uschindler seems a reasonable summary:
About the serialization: Robert is right, Java serialization should not be used anymore (at least not with Java's native framework) as it allows to cause RCEs or instantiation of arbitrary classes by modifying the serialization stream. It is mainly kept for backwards compatibility with very old code, but new projects should never ever introduce new classes with the marker interface. Apache Lucene dropped all occurrences of Serializable more than 10 years ago and only few people complained (at beginning). Serialization is also one of the reasons why final fields in Java cannot be treated as "final" by the optimizer, because seriealization (and reflection - but only because of serialization!) needs to be able to modify final fields after creating the instance.
Keeping the `Serializable`` marker interface and the ID does not do any harm, so I think the discussion should be a separate issue.