You should never accept Pickle from remote connections, at least not without rigorous checks that the data can be trusted. As the [documentation] states:
Warning: The pickle
module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.
A pickle data stream is a simple stack language that can be used to create and execute arbitrary Python code. You can't guard against this on the receiving end. IF there is any remote possibility that an attacker can send pickle data of their choosing to your server, your process is compromised. The hacker could send os.execv('rm -rf /')
or marshalled code objects to set up a simple socket server awaiting further commands.
struct
may be harder to use, but it would only allow specific data types, and those are standardised. That would make it easier to write clients in other programming languages.
There are more alternatives that don't have the downsides of pickle, and are easier to work with. You could consider schema-less but standardised formats such as JSON (more verbose as it is a textual format, but compression can help), and BSON (Binary JSON) or use something like protocol buffers to handle your protocol data serialisation.