[crispyambulance]

XML was a good, well-intentioned idea.

The problem, IMHO, was that rampant "xml-abuse" in the naughts. ws-* standards and over-engineered garbage like SOAP ("complex object access protocol") made people loathe XML.

I did like JAXB in Java, XLST, schemas, XPATH. Never got into XSL, but it seemed like good thing too. It worked best when your tooling manipulated it for you or at least helped you in an intelligent way. Much of the hate for XML came from situations where you had to deal with someone's over-the-top-one-size-fits all schema without the benefit of tooling to at least hint you in the right direction.

It still survives in WPF and c# *.proj files. If it were just me, I would still use it for object serialization. But json is king now even though it's inferior.

[dtech]

It's non-trivial to implement XML parser in a secure way, many stdlib ones are insecure by default. That should just not be a thing. XML has a bunch of vulnerabilities very specific to it, XXE is the most well known one, but you also have a bunch of DoSes due to expansions and XPath injection etc.

An object serialization format should not have a bunch of footguns and vulnerability categories specific to it.

[ElectricalUnion]

The funny thing is that JSON parsing is usually kinda unsafe in it's main target language JavaScript, and usually safe in other languages, because of the `__proto__` prototype pollution.

[inigyou]

It's trivial to make a secure parser. The problem is that the secure parser doesn't follow the standard because the standard mandates insecurity.

[ahartmetz]

I think XML's main problem is the ridiculous hype-wave that started in the late 90s. I really didn't want to see and hear XML anymore at the time. It was clear to me that it was no more and no less than a slightly awkward toolbox to build your own domain-specific language. Stupid as some of the later hype waves were, most weren't as stupid as the XML hype wave (with the notable exception of blockchain all the things).

XML is actually okay to work with, I don't mind it. XML schemas, XSLT and such are a little more... special, but also used much more rarely.

[p_l]

Honestly, some of the worst aspects of SOAP were legacies of XML-RPC. Some of the remaining messy parts were often "yes, you can not implement that, but then if you ever need functionality X, Y, Z - you will be fucked without this complexity".

Similar to how we have DER in ASN.1.

The rest in my experience was often related to crappy "generate me XML interface from my crappy Java/.NET class" because enterprise software demands speed of development over everything else, even if that speed is taken away by meetings

[frollogaston]

SOAP seems totally in line with the XML philosophy.