Java Serialization: Spooky Action at a Distance

Java serialization, introduced in Java 1.1 (1997), was designed to solve object persistence and distributed computing needs via RMI. Its ease of use drove widespread adoption, but the mechanism has significant problems: it bypasses constructors during deserialization, undermines encapsulation and final fields, enables polymorphism/confinement attacks via malicious class injection, creates thread-safety hazards, forces code duplication, and inhibits JDK evolution due to backwards compatibility requirements. Mitigations include configurable serialization filters (JEP 290, JDK 9) and special handling for records (JDK 16). The JDK team is working toward a serialization 2.0 that reduces reflection magic and requires explicit intermediate representations, though a full replacement is still in progress.