A huge reason anything accepting network (or other potentially hostile input) should use parser generators <i>and</i> validate the entire input before using any of it is security. Additionally, all of those grammars should, whenever possible, be no more complex than  deterministic context-free.<p>As Meredith and Sergey explain in their talk[1] at 28c3, Turing complete input and parsers that don&#x27;t validate the input are creating a &quot;weird machine&quot; just waiting to be programmed in malicious and unexpected ways.<p>[1] <a href="https:&#x2F;&#x2F;media.ccc.de&#x2F;v&#x2F;28c3-4763-en-the_science_of_insecurity" rel="nofollow">https:&#x2F;&#x2F;media.ccc.de&#x2F;v&#x2F;28c3-4763-en-the_science_of_insecurit...</a>