> They do allow object deserialization, which is the insecure part. Only in the exact same sense that JSON allows insecure object deserialisation. Yes, if you

> They do allow object deserialization, which is the insecure part. Only in the exact same sense that JSON allows insecure object deserialisation. Yes, if you process a JSON object or S-expression, your processor can do all sorts of insecure things. But a non-buggy S-expression parser can't do anything wrong with (foo bar "baz"), just as a non-buggy JSON parser can't do anything wrong with ["foo", "bar", "baz"].