@bradfitz ("Brad Fitzpatrick") replied to a tweet by @bradfitz:
One of the team tried to pass JavaScript in an from the browser to the backend to be eval()'ed server-side. I had to explain why that was a bad idea. He didn't like hearing it from a 16 year old.