Why doesn't java.lang.Object implement the Serializable Interface?
java, serializable
Solution
Potential security hole
All subtypes of a serializable class are themselves serializable.
In other words: all classes you ever create, were or will be created are all serializable. `transient` only excludes fields, not whole classes.
This is a potential security hole - by coincidence you can serialize e.g. your `DataSource` with database credentials inside - if the creator of this particular `DataSource` implementation forgot to make such fields `transient`. It's surprisingly easy to serialize random Java object, e.g. through inner classes holding implicit reference to outer `this`.
It's just safer to use white-list of classes which you explicitly want and allow to serialize as opposed to carefully examining your code, making sure no fields you do not desire are ever serialized.
Moreover you can no longer say: `MySuperSecretClass` is not serializable (by simply not implementing `Serializable`) - you can only exclude the guts (fields).
Problem
Possible Duplicate: Why Java needs Serializable interface? According to Serializability in Java docs : Serializability of a class is enabled by the class implementing the java.io.Serializable interface. Classes that do not implement this interface will not have any of their state serialized or deserialized. All subtypes of a serializable class are themselves serializable. The serialization interface has no methods or fields and serves only to identify the semantics of being serializable Why doesn't the Object already implement `Serializable`? Members that we wouldn't want to be serializable may be made as `transient`. Why prevent the default Serializability?