Pickle is likely still handy, as long as you created the data that you're deserializing. Zope's object database was a big pickle file, as I recall. But yeah, not a good idea if you're cracking open user-supplied files in any way.

Ha! People still remember Zope!

That was my first web kind of framework. The naivette of Zope still amuses me endlessly to this very day.

It tried to be cool, made ALL the wrong choices, and died silently with people just moving on.

I think it still exists, even! It has been a long time since I used it though, but it was interesting.

Interesting is one way of saying this...

I will never recover from debugging ZODB backed by Oracle. Well, somewhat backed.

Who, like, who thought it was cool to have a pickle-based, mostly in-memory, single process, aaalmost transactional database?!

Hahaha. Well, I didn't run into that issue, so it mostly "just worked" in the sense of where we had used it. I did mess around a bit with the Plone CMS that runs on top of Zope, and found it horribly slow and resource-hungry for the time. Someone must like it, it's still getting releases in 2026.

I was more traumatized by the Java-based product from Open Market (acquired from Future Tense back in the day), and all the horribleness that that entailed. Starting from XML as a template language, then seemed to get only worse. Nothing like having multiple content areas all rendered as 500 Server Error pages within one page, when it all goes sideways.

There are dozens of us. :)

Pickle is insecure by design, but definitely convenient if you can trust the input.

If you need something safe then you really need to identify your requirements and your threat model first anyway; I wouldn't blindly reach for a one-size-fits-all solution in any programming language.

(Although I would do a quick check to see JSON or TOML is sufficient and practical.)