Still obsessed with Java serialization. Wonder whether it really is implemented using only reflection and no backdoors.