Fosstodon

Jonathan BirchWhen giving <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> guidance to developers, be sure to impart an understanding of the underlying problem, not just which API's to use or not. If you don't do this, enterprising developers will often reintroduce the problem by adding the problematic capabilities to an otherwise safe API.To give a specific example, and to try to atone for some of my past sins:The underlying problem in unsafe deserialization that leads to remote code execution is user-provided data telling your application what type it wants to be. When data can choose what type it is, it can choose types that have exploitable side effects in their constructors, setters, or destructors. Polymorphic deserializers are inherently unsafe.In the past I've told people "use this API, it's safe". But when that API is safe because it doesn't allow polymorphism, developers inevitably modify the API to add polymorphism when it makes the overall design of the application simpler.The portion of the <a href="https://infosec.exchange/tags/OWASP" class="mention hashtag" rel="nofollow noopener" target="_blank">#OWASP</a> <a href="https://infosec.exchange/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> cheat-sheet on .NET is based on a talk I gave in 2017 before I understood this problem. (<a href="https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html#net-csharp" rel="nofollow noopener" translate="no" target="_blank">https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html#net-csharp</a> )It's much more difficult, but training developers to write secure code requires teaching them what the real problems are.<a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#appsec</a> <a href="https://infosec.exchange/tags/training" class="mention hashtag" rel="nofollow noopener" target="_blank">#training</a>

N-gated Hacker NewsAh, the age-old tale of a programmer who thinks they're the hero in a crusade against a tool nobody else cares enough about to even notice. 😂 Apparently, <a href="https://mastodon.social/tags/protobuffers" class="mention hashtag" rel="nofollow noopener" target="_blank">#protobuffers</a> are the Darth Vader of the <a href="https://mastodon.social/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> universe—except instead of lightsabers, they're armed with "gotchas" and "adhoc-ness." But sure, keep fighting the good fight against Google's evil empire. 🌐🥊 <a href="https://reasonablypolymorphic.com/blog/protos-are-wrong/" rel="nofollow noopener" translate="no" target="_blank">https://reasonablypolymorphic.com/blog/protos-are-wrong/</a> <a href="https://mastodon.social/tags/programmerhumor" class="mention hashtag" rel="nofollow noopener" target="_blank">#programmerhumor</a> <a href="https://mastodon.social/tags/techcrusade" class="mention hashtag" rel="nofollow noopener" target="_blank">#techcrusade</a> <a href="https://mastodon.social/tags/Googleempire" class="mention hashtag" rel="nofollow noopener" target="_blank">#Googleempire</a> <a href="https://mastodon.social/tags/devlife" class="mention hashtag" rel="nofollow noopener" target="_blank">#devlife</a> <a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/ngated" class="mention hashtag" rel="nofollow noopener" target="_blank">#ngated</a>

9Lukas5 🚂 🐧<a href="https://mastodontech.de/tags/DuckDuckFedi" class="mention hashtag" rel="nofollow noopener" target="_blank">#DuckDuckFedi</a>: How to easily serialize a class in Kotlin with explicit typename in the output?<a href="https://stackoverflow.com/questions/79732281/kotlin-serialize-simple-class-with-explicit-serial-name" rel="nofollow noopener" translate="no" target="_blank">https://stackoverflow.com/questions/79732281/kotlin-serialize-simple-class-with-explicit-serial-name</a><a href="https://mastodontech.de/tags/Kotlin" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kotlin</a> <a href="https://mastodontech.de/tags/kotlinx_serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#kotlinx_serialization</a> <a href="https://mastodontech.de/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> <a href="https://mastodontech.de/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#programming</a> <a href="https://mastodontech.de/tags/stackoverflow" class="mention hashtag" rel="nofollow noopener" target="_blank">#stackoverflow</a>

Larry GarfieldCrell/Serde 1.5 has been released, now with support for union, intersection, and compound types!Full details on the blog:<a href="https://www.garfieldtech.com/blog/serde-15" rel="nofollow noopener" translate="no" target="_blank">https://www.garfieldtech.com/blog/serde-15</a>Thanks to my employer, MakersHub, for sponsoring these improvements.<a href="https://makershub.ai/" rel="nofollow noopener" translate="no" target="_blank">https://makershub.ai/</a><a href="https://phpc.social/tags/PHP" class="mention hashtag" rel="nofollow noopener" target="_blank">#PHP</a> <a href="https://phpc.social/tags/Release" class="mention hashtag" rel="nofollow noopener" target="_blank">#Release</a> <a href="https://phpc.social/tags/Serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serialization</a>

HabrСериализация в Unity: известные атрибуты и их проблемыЛюбой Unity-разработчик знаком с атрибутом [SerializeField] , который позволяет сериализовывать непубличные члены класса и, соответственно, отображать их в инспекторе. Но, в силу его ограниченности, позже начали появляться и другие способы сериализации. Попробую кратко рассказать, какие альтернативы используются, зачем все они нужны, как работают и, о чём не любят писать в кликбейтных постах, какие подводные камни могут скрывать.<a href="https://habr.com/ru/articles/920398/" rel="nofollow noopener" translate="no" target="_blank">https://habr.com/ru/articles/920398/</a><a href="https://zhub.link/tags/unity" class="mention hashtag" rel="nofollow noopener" target="_blank">#unity</a> <a href="https://zhub.link/tags/gamedev" class="mention hashtag" rel="nofollow noopener" target="_blank">#gamedev</a> <a href="https://zhub.link/tags/%D0%B3%D0%B5%D0%B9%D0%BC%D0%B4%D0%B5%D0%B2" class="mention hashtag" rel="nofollow noopener" target="_blank">#геймдев</a> <a href="https://zhub.link/tags/%D0%B8%D0%B3%D1%80%D0%BE%D0%B2%D0%B0%D1%8F_%D1%80%D0%B0%D0%B7%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D0%BA%D0%B0" class="mention hashtag" rel="nofollow noopener" target="_blank">#игровая_разработка</a> <a href="https://zhub.link/tags/%D1%81%D0%B5%D1%80%D0%B8%D0%B0%D0%BB%D0%B8%D0%B7%D0%B0%D1%86%D0%B8%D1%8F" class="mention hashtag" rel="nofollow noopener" target="_blank">#сериализация</a> <a href="https://zhub.link/tags/%D0%B4%D0%B0%D0%BD%D0%BD%D1%8B%D0%B5" class="mention hashtag" rel="nofollow noopener" target="_blank">#данные</a> <a href="https://zhub.link/tags/%D0%B0%D1%81%D1%81%D0%B5%D1%82%D1%8B" class="mention hashtag" rel="nofollow noopener" target="_blank">#ассеты</a> <a href="https://zhub.link/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> <a href="https://zhub.link/tags/SerializeField" class="mention hashtag" rel="nofollow noopener" target="_blank">#SerializeField</a> <a href="https://zhub.link/tags/serializereference" class="mention hashtag" rel="nofollow noopener" target="_blank">#serializereference</a>

Nicolas Fränkel 🇺🇦🇬🇪Apache Fury (incubating)<a href="https://fury.apache.org/" rel="nofollow noopener" translate="no" target="_blank">https://fury.apache.org/</a><a href="https://mastodon.top/tags/java" class="mention hashtag" rel="nofollow noopener" target="_blank">#java</a> <a href="https://mastodon.top/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a> <a href="https://mastodon.top/tags/golang" class="mention hashtag" rel="nofollow noopener" target="_blank">#golang</a> <a href="https://mastodon.top/tags/javascript" class="mention hashtag" rel="nofollow noopener" target="_blank">#javascript</a> <a href="https://mastodon.top/tags/rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#rust</a> <a href="https://mastodon.top/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a>

Felix Palmen :freebsd: :c64:Seems a first step is almost done, adding <a href="https://mastodon.bsd.cafe/tags/JSON" class="mention hashtag" rel="nofollow noopener" target="_blank">#JSON</a> support to my <a href="https://mastodon.bsd.cafe/tags/poser" class="mention hashtag" rel="nofollow noopener" target="_blank">#poser</a> lib. This could be the foundation for <a href="https://mastodon.bsd.cafe/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> support in <a href="https://mastodon.bsd.cafe/tags/swad" class="mention hashtag" rel="nofollow noopener" target="_blank">#swad</a>. 😎 Need to do more thorough testing I guess, but at least the two example documents from <a href="https://mastodon.bsd.cafe/tags/rfc8259" class="mention hashtag" rel="nofollow noopener" target="_blank">#rfc8259</a> work fine ... the test tool does a full <a href="https://mastodon.bsd.cafe/tags/deserialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#deserialization</a> / <a href="https://mastodon.bsd.cafe/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> roundtrip (with specific internal representations of the data types supported by JSON).edit: Look at the "Longitude" value of the second object in the second example 😏 I only noticed myself right now, but of course that's the desired behavior.

N-gated Hacker News🤦‍♂️ Someone thought it was a good idea to mix Rust's crusty rigor with Python's whimsical magic, using <a href="https://mastodon.social/tags/Serde" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serde</a> as the glue. Because nothing screams 'user-friendly' like making <a href="https://mastodon.social/tags/Rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rust</a> dance to Python's tune through a <a href="https://mastodon.social/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> library! 🎻✨ <a href="https://ohadravid.github.io/posts/2025-05-serde-reflect/" rel="nofollow noopener" translate="no" target="_blank">https://ohadravid.github.io/posts/2025-05-serde-reflect/</a> <a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#programming</a> <a href="https://mastodon.social/tags/userfriendly" class="mention hashtag" rel="nofollow noopener" target="_blank">#userfriendly</a> <a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/ngated" class="mention hashtag" rel="nofollow noopener" target="_blank">#ngated</a>

🔏 Matthias WiesmannThe grumpy serialisation format <a href="https://wiesmann.codiferes.net/wordpress/archives/38143" rel="nofollow noopener" translate="no" target="_blank">https://wiesmann.codiferes.net/wordpress/archives/38143</a> <a href="https://mastodon.social/tags/json" class="mention hashtag" rel="nofollow noopener" target="_blank">#json</a> <a href="https://mastodon.social/tags/serialisation" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialisation</a> <a href="https://mastodon.social/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> <a href="https://mastodon.social/tags/Utf16" class="mention hashtag" rel="nofollow noopener" target="_blank">#Utf16</a> <a href="https://mastodon.social/tags/Utf8" class="mention hashtag" rel="nofollow noopener" target="_blank">#Utf8</a>

Hacker NewsMsgpack23 – A modern, header-only C++ library for MessagePack (de)serialization<a href="https://github.com/rwindegger/msgpack23" rel="nofollow noopener" translate="no" target="_blank">https://github.com/rwindegger/msgpack23</a><a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/Msgpack23" class="mention hashtag" rel="nofollow noopener" target="_blank">#Msgpack23</a> <a href="https://mastodon.social/tags/MessagePack" class="mention hashtag" rel="nofollow noopener" target="_blank">#MessagePack</a> <a href="https://mastodon.social/tags/C" class="mention hashtag" rel="nofollow noopener" target="_blank">#C</a>++ <a href="https://mastodon.social/tags/Serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serialization</a> <a href="https://mastodon.social/tags/HeaderOnlyLibrary" class="mention hashtag" rel="nofollow noopener" target="_blank">#HeaderOnlyLibrary</a>

Hacker NewsHexi, modern header-only network binary serialisation for C++ hackers<a href="https://github.com/EmberEmu/Hexi" rel="nofollow noopener" translate="no" target="_blank">https://github.com/EmberEmu/Hexi</a><a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/Hexi" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hexi</a> <a href="https://mastodon.social/tags/C" class="mention hashtag" rel="nofollow noopener" target="_blank">#C</a>++ <a href="https://mastodon.social/tags/Serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serialization</a> <a href="https://mastodon.social/tags/Network" class="mention hashtag" rel="nofollow noopener" target="_blank">#Network</a> <a href="https://mastodon.social/tags/Binary" class="mention hashtag" rel="nofollow noopener" target="_blank">#Binary</a> <a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/EmberEmu" class="mention hashtag" rel="nofollow noopener" target="_blank">#EmberEmu</a>

Hacker NewsStrictYAML — <a href="https://hitchdev.com/strictyaml/" rel="nofollow noopener" translate="no" target="_blank">https://hitchdev.com/strictyaml/</a> <a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/StrictYAML" class="mention hashtag" rel="nofollow noopener" target="_blank">#StrictYAML</a> <a href="https://mastodon.social/tags/YAML" class="mention hashtag" rel="nofollow noopener" target="_blank">#YAML</a> <a href="https://mastodon.social/tags/Parser" class="mention hashtag" rel="nofollow noopener" target="_blank">#Parser</a> <a href="https://mastodon.social/tags/Data" class="mention hashtag" rel="nofollow noopener" target="_blank">#Data</a> <a href="https://mastodon.social/tags/Serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serialization</a> <a href="https://mastodon.social/tags/Configuration" class="mention hashtag" rel="nofollow noopener" target="_blank">#Configuration</a>

Damir ArhA numeric field in a web API request can be changed to a string without breaking existing REST clients<a href="https://www.damirscorner.com/blog/posts/20250228-ApiCompatibleDataTypeChange.html" rel="nofollow noopener" translate="no" target="_blank">https://www.damirscorner.com/blog/posts/20250228-ApiCompatibleDataTypeChange.html</a><a href="https://mas.to/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> <a href="https://mas.to/tags/aspnetcore" class="mention hashtag" rel="nofollow noopener" target="_blank">#aspnetcore</a> <a href="https://mas.to/tags/dotnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#dotnet</a>

Özgür YükselAerospike says it has achieved a milestone in NoSQL OLTP performance - SiliconANGLE <a href="https://siliconangle.com/2025/02/05/aerospike-says-achieved-milestone-nosql-oltp-performance/" target="_blank" rel="nofollow noopener" translate="no">https://siliconangle.com/2025/02/05/aerospike-says-achieved-milestone-nosql-oltp-performance/</a> <a href="https://fosstodon.org/tags/database" class="mention hashtag" rel="tag">#database</a> <a href="https://fosstodon.org/tags/NoSQL" class="mention hashtag" rel="tag">#NoSQL</a> <a href="https://fosstodon.org/tags/ACID" class="mention hashtag" rel="tag">#ACID</a> <a href="https://fosstodon.org/tags/serialization" class="mention hashtag" rel="tag">#serialization</a>

Erik C. ThauvinKotlin Serialization 1.8.0 has been released!<a href="https://mastodon.social/tags/java" class="mention hashtag" rel="nofollow noopener" target="_blank">#java</a> <a href="https://mastodon.social/tags/kotlin" class="mention hashtag" rel="nofollow noopener" target="_blank">#kotlin</a> <a href="https://mastodon.social/tags/kotlinx" class="mention hashtag" rel="nofollow noopener" target="_blank">#kotlinx</a> <a href="https://mastodon.social/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a><a href="https://github.com/Kotlin/kotlinx.serialization/releases/tag/v1.8.0?utm_medium=erik.in&utm_source=mastodon" rel="nofollow noopener" translate="no" target="_blank">https://github.com/Kotlin/kotlinx.serialization/releases/tag/v1.8.0?utm_medium=erik.in&utm_source=mastodon</a>

Angel D. MunozAnnouncing JDeck, a small System.Text.Json F# wrapper for manual decoding in those cases where the automatic nature of the built-in serializer from the dotnet base class library is not enough!<a href="https://hachyderm.io/tags/dotnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#dotnet</a> <a href="https://hachyderm.io/tags/fsharp" class="mention hashtag" rel="nofollow noopener" target="_blank">#fsharp</a> <a href="https://hachyderm.io/tags/json" class="mention hashtag" rel="nofollow noopener" target="_blank">#json</a> <a href="https://hachyderm.io/tags/buildinpublic" class="mention hashtag" rel="nofollow noopener" target="_blank">#buildinpublic</a> <a href="https://hachyderm.io/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> <a href="https://hachyderm.io/tags/decoding" class="mention hashtag" rel="nofollow noopener" target="_blank">#decoding</a>

Richard MacManusTeam ReadWriteWeb attends SXSW 2011 in Austin. We host a BBQ for our sponsors, I meet Sarah and Seamus for the first time, and the RWW management team addresses writer concerns. (part 057 of my Web 2.0 memoir) <a href="https://cybercultural.com/p/057-sxsw-2011/" rel="nofollow noopener" translate="no" target="_blank">https://cybercultural.com/p/057-sxsw-2011/</a> <a href="https://mastodon.social/tags/InternetHistory" class="mention hashtag" rel="nofollow noopener" target="_blank">#InternetHistory</a> <a href="https://mastodon.social/tags/Web20" class="mention hashtag" rel="nofollow noopener" target="_blank">#Web20</a> <a href="https://mastodon.social/tags/Serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serialization</a>

Angel D. MunozFor the F# code of today, let's wrap a websocket connection in an IObservable<T> Personally, I don't like fire and forget async things, but I kind of wanted just to get it out I'll figure out later when I clearly need to change this, and I won't be able 😌<a href="https://hachyderm.io/tags/dotnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#dotnet</a> <a href="https://hachyderm.io/tags/fsharp" class="mention hashtag" rel="nofollow noopener" target="_blank">#fsharp</a> <a href="https://hachyderm.io/tags/bluesky" class="mention hashtag" rel="nofollow noopener" target="_blank">#bluesky</a> <a href="https://hachyderm.io/tags/websockets" class="mention hashtag" rel="nofollow noopener" target="_blank">#websockets</a> <a href="https://hachyderm.io/tags/serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#serialization</a> <a href="https://hachyderm.io/tags/json" class="mention hashtag" rel="nofollow noopener" target="_blank">#json</a> <a href="https://hachyderm.io/tags/async" class="mention hashtag" rel="nofollow noopener" target="_blank">#async</a> <a href="https://hachyderm.io/tags/observables" class="mention hashtag" rel="nofollow noopener" target="_blank">#observables</a> <a href="https://hachyderm.io/tags/observable" class="mention hashtag" rel="nofollow noopener" target="_blank">#observable</a>

Richard MacManusAs we continue to grow ReadWriteWeb over the second half of 2010, I struggle with our inability to hire US writers full-time because it’s a non-US company. This creates unease amongst our bloggers. <a href="https://cybercultural.com/p/055-rww-expansion-2010/" rel="nofollow noopener" translate="no" target="_blank">https://cybercultural.com/p/055-rww-expansion-2010/</a> (part 055 of my serialized Web 2.0 memoir) <a href="https://mastodon.social/tags/InternetHistory" class="mention hashtag" rel="nofollow noopener" target="_blank">#InternetHistory</a> <a href="https://mastodon.social/tags/Serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serialization</a>

Richard MacManusOn the first anniversary of launching my serialized book, I reflect on what I've learned — including the pros and cons of my pivot from Substack newsletter to indie website. <a href="https://cybercultural.com/p/online-serialization-thoughts/" rel="nofollow noopener" translate="no" target="_blank">https://cybercultural.com/p/online-serialization-thoughts/</a> <a href="https://mastodon.social/tags/Serialization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serialization</a> <a href="https://mastodon.social/tags/InternetHistory" class="mention hashtag" rel="nofollow noopener" target="_blank">#InternetHistory</a> <a href="https://mastodon.social/tags/IndieWebsites" class="mention hashtag" rel="nofollow noopener" target="_blank">#IndieWebsites</a>

Recent searches

Search options

Administered by:

Server stats:

#serialization