Question

We work heavily with serialization and having to specify Serializable tag on every object we use is kind of a burden. Especially when it’s a 3rd-party class that we can’t really change.

The question is: since Serializable is an empty interface and Java provides robust serialization once you add implements Serializable – why didn’t they make everything serializable and that’s it?

What am I missing?

Answer 1

Serialization is fraught with pitfalls. Automatic serialization support of this form makes the class internals part of the public API (which is why javadoc gives you the persisted forms of classes).

For long-term persistence, the class must be able to decode this form, which restricts the changes you can make to class design. This breaks encapsulation.

Serialization can also lead to security problems. By being able to serialize any object it has a reference to, a class can access data it would not normally be able to (by parsing the resultant byte data).

There are other issues, such as the serialized form of inner classes not being well defined.

Making all classes serializable would exacerbate these problems. Check out Effective Java Second Edition, in particular Item 74: Implement Serializable judiciously.