Try to give reasons for these Q's

Question

1. Why clone() method to be defined as 'final'? What is the security reason involved in this?
2.Why Interfaces should not be serializable? What is the security reason involved in this?

Answer 1

I wanna have the security reason behind them. 'If u
don't define clone() as final, what is the problem??".
I want this reason.There is no security benefit to declaring clone() final, it simply means that a subclass can't implement clone(). It doesn't stop the subclass from declaring a method bypassClone() that does the same thing. It does break the idiom that clone() is the way to make a copy of an object.
As same, reg Interfaces, You can instantiate classes
that implement an interface that extended
Serializable. Now, what is the security reason behind
saying' Avoid making your Interfaces Serializable'I have to restate this as "avoid making an interface that extends Serializable" for it to make sense. I suppose that there's a security consideration in that any class that implements Serializable -- directly or indirectly -- can be written to persistent storage. But the real reason is that it's sloppy coding: interfaces describe a capability of a class, and there's seldom a reason to make some capability dependent on serializability.
In general, "security" issues vis a vis the contents of Java classes are somewhat silly. With the right tools, you can access anything. The Java security framework limits your ability to actually do anything with what you've examined.