Are there future plans for removing binary serialization/deserialization?

Question

Given that starting with .NET 8 the BinaryFormatter class is being stripped away for security reasons, and considering that the package uses a BinaryWriter/Reader to serialize/deserialize object graphs, I'm assuming this suffers from the same security risks.

I'm wondering if there's any plan in terms of changing the implementation to get rid of the binary formatter or not.

I can envision plenty of apps that (wrongly) abuse session and store very complex object graphs. A different serialization mechanism could be an abrupt breaking change for those.

Answer 1

Hi @Cataldi Alessandro ,

As a Preferred alternatives for BinaryFormatter class, currently there is no future plan for removing using a BinaryWriter/Reader to serialize/deserialize object graphs.

Deserialization risks in use of BinaryFormatter and related types

Best Regards.

Jiachen Li

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.