There's another HN thread that says "Ruby's Marshal library is not quite as blatantly insecure as pickle..." http://news.ycombinator.com/item?id=813306.