[ab]

There's an enormous difference between serializers that make any effort at all to be safe, and those like Ruby's YAML library, which make no effort. Python's YAML, for example, exposes a safe_load() method.

It's really criminally negligent that no such method exists in Ruby's YAML library.

[ghostganz]

Python's Pickle lib had something similar to safe_load(), that they removed because it gave a false sense of security.

[X-Istence]

If you are accepting pickled objects from a remote and using it ... you are an idiot.