Serialization Is Still Java’s Biggest Attack Surface. What JEP 290 Actually Did and What It Didn’t
What JEP 290 actually did, what it genuinely left open, and how to write filters that hold up in the real world — not just on paper. Java deserialization has been described as “the...