I am interested in using protobuf-net to serialize/deserialize data sent across my TCP applications. I learnt of protobuf-net a few weeks ago and downloaded it from [here](https://github.com/mgravell/protobuf-net) and plan to use it in my network applications. Although I've used the XML serializer before, I've never considered the issue of security in serialization as the programs I was creating were private and didn't send data across a network.

After some reading on [Security Considerations for Data](https://msdn.microsoft.com/en-us/library/ms733135(v=vs.110).aspx), I understand that careless implementation of serialization could result in a custom client sending malicious data to the server which is a major security flaw.

However, as I don't fully understand the process of serializing/deserializing an object and am not completely aware of the capabilities of `.net`, I don't know what precautions I should take to ensure that an attacker won't find any way to make the server act in an unintended way. I don't want to implement serialization until I'm sure that all of the necessary precautions have been taken in my code.

I understand that the possible threats an attacker could pose are:

1. Unintentional information disclosure. I'm not sure on this, but if I'm not mistaken, this is only a security concern for the sender which is not a problem for the receiving end. As long as sent confidential data is encrypted, this shouldn't be a concern?
2. Denial of service. This can be stopped by putting a limit on the size of the object being deserialized.
3. Malicious code execution. This is the possibility I'm most worried about especially due to my lack of complete knowledge on serialization and `.net`.

Are the only things which are serialized variables (both private and public) of the object? So events and functions cannot be transferred across in any way? Since functions cannot be set as variables in VB (unlike other languages such as Swift which has closures), this shouldn't be a concern, but I'm not entirely sure if there is another way to circumvent this which is why I ask.

If the above is the case, then can I ensure that no malicious code is run if I only deserialize the data into an `Object` or a class which has no 'potentially dangerous' functions?

When an object is deserialized, is `New` called? If so, then I would have to make sure `New` is 'safe' to call?

In addition to the above, are there any other ways in which an attacker could destabilize my server (eg. taking advantage of inheritance or events/handlers)?

Are the answers to the above questions the same for serializers other than `protobuf-net`?

---

Moved from SO as it was deemed to be more suitable here