Hacker News Reader

Comment by mrweasel | Hacker News Reader

Can you safely "pickle" Python objects across different architectures and Python version (assuming we forget about Python 2)?

View on HN

Pickle could in theory could be architecture dependent since __getstate__, and __setstate__ are user provided options. But you would have to try to do that on purpose.

And you don't even have to forget about Python 2! If you use format version 2 you can pickle objects from every version from Python 2.3+ and all pickle format are promised to be backwards compatible. If you only care about Python 3 then you can use version 3 and it will work for all Python 3.0+.

https://docs.python.org/3/library/pickle.html#data-stream-fo...

The reason against using pickle hasn't changed though, if you wouldn't exec() it, don't unpickle it. If you're going to send it over the network use MAC use MAC use MAC. Seriously, it's built in -- the hmac module.

We had a program that was sending a pickled session state as a cookie. We solved that by packing the cookie as a random string, a timestamp, the object, and a MAC. We validated the MAC, then checked the timestamp, and finally unpickle the object. It still bothers me that we are unpickling data passed by the client but I ran arguments against doing it.

There's a version on the pickle format, so you might be able to do it across versions but I suspect the version has changed for security reasons over time?

one big problem with pickle is that deserialization might fail if the object serialized evolve

Reply on news.ycombinator.com