title: Safe usage of eval() on server-sent JavaScript code
body: <p>I'm using Node.js and Socket.io. I've written an application which can send JavaScript snippets from the server and execute them on the client. The JavaScript is sent via Secure WebSocket (WSS), and the client has a listener which will execute any code passed to it via the server.</p>
  
  <p>This short script demonstrates the principle: <a href="http://jsfiddle.net/KMURe/" rel="noreferrer">http://jsfiddle.net/KMURe/</a> and you can think of the onScript function as the socket listener.</p>
  
  <h1>Question</h1>
  
  <p>What security protocols can I put in place to make this transaction safe? Would a secure websocket channel make it difficult for a third party to act as a middle man (altering the code before it's sent to the client)?</p>
  
  <h2>Some Use Cases..</h2>
  
  <ul>
  <li>Dynamically assigned distributed computation.</li>
  <li>Browser client can dynamically learn from the server.</li>
  <li>Update browser behavior in unison.</li>
  </ul>