Hacker News Reader

Sadly, I stopped reading when they got to recommending eval as a method for running js received over xhr.

With XHR's same-domain policy, the JS had to come from you -- using eval introduces no exploits that weren't already present.

What's so bad about using eval in this context?