search

Alachisoft / NCache

NCache: Highly Scalable Distributed Cache for .NET
http://www.alachisoft.com
Apache License 2.0
647 stars 123 forks source link

BinaryFormatter has security flaws and requiring the paid version for JSON serialization is sketchy #71

Open bradlis7 opened 2 years ago

bradlis7 commented 2 years ago

Microsoft has deprecated BinaryFormatter (https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide), and it seems like bad practice to force users to pay to use another method, such as JSON or XML, to serialize objects.

Alex-Alachisoft commented 2 years ago

Hi @bradlis7, yes, this has been noted down and is being considered for the next releases of NCache Open Source. Also, note that Microsoft has not yet discontinued the use of BinaryFormatter and you can still use Binary Serialization (with a warning) in NCache OpenSource. Moreover, if you wish to use JSON serialization then you can use the NCache Professional or Enterprise editions. Additionally, as mentioned above, when BinaryFormatter is officially discontinued by Microsoft, our engineering board will review the provision support of JSON serialization in the NCache OpenSource edition.

Rich-Ott commented 5 months ago

With the announcement that BinaryFormatter is being removed later this year with .NET 9 (https://github.com/dotnet/announcements/issues/293), is this going to be put up for review?