Why We Hate Java Serialization And What We're Doing About It by Brian Goetz & Stuart Marks