BinaryFormatter security
Why is BinaryFormatter dangerous on .NET Framework (and disabled by default on modern .NET)? What should you use instead?
Answers use simple, clear English.
Quick interview answer
BinaryFormatter can instantiate arbitrary types and led to remote code execution when deserializing untrusted data. Modern .NET disables/removes it by default. Prefer System.Text.Json, DataContractSerializer (with care), protobuf, or explicit DTOs.
Detailed answer
BinaryFormatter can instantiate arbitrary types and led to remote code execution when deserializing untrusted data. Modern .NET disables/removes it by default. Prefer System.Text.Json, DataContractSerializer (with care), protobuf, or explicit DTOs. Audit legacy Framework caches/session stores still using it.
Real example & use case
Replace BinaryFormatter session blob with JSON payload + server-side store.
Pros & cons
Pros of JSON/protobuf: safer, interoperable. Cons: migration of old payloads.