Well, I thought it wasn't possible to parse JSON in a streaming fashion, but given the number of annoyed answers I got, that was obviously incorrect. Let me am

Well, I thought it wasn't possible to parse JSON in a streaming fashion, but given the number of annoyed answers I got, that was obviously incorrect. Let me amend that to the more qualified "the libraries I've used so far don't allow you to stream JSON". My point is still somewhat valid - most XML libraries I know offer stream-based parsing out of the box, most JSON libraries I know don't - but it's not the show stopper I made it out to be, since it turns out you can, after all, implement your own streamed based parser. As for JSONp, you're obviously and entirely right. My point was that, in case something happens on the client side (through an entirely different security hole - and let's face it, people who feel comfortable consuming JSONp are likely to take other insecure shortcuts), I'd much rather not be implicated at all than have to prove I had nothing to do with it.