Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Partly because JSON has the lovely feature of being able to just eval() it into an object in browsers.


That's not really a lovely feature in this day and age. If anything it's an unfortunate artifact, as the right way to deserialize JSON is JSON.parse().


That's not the right way to parse JSON, it's really insecure


And slow, JSON.parse is magnitudes faster than using user-javascript to parse it yourself.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: