[michaelt]

I wonder whether the non-malicious applications of XML external entities outnumber the malicious applications.

Any HNers want to chime in with an account of actually using them for what they're meant for?

[tptacek]

Any HNers want to chime in on XML <<used as an interchange format>> (for instance, as the payload format for a protocol) ever using entity definitions for any purpose?

Right now, I'd put money on "malicious uses" outnumbering "legitimate" uses.

[wglb]

I certainly haven't seen any.

This is a holdover to the SGML days, where this was a pretty important feature, and used quite frequently in many document formats required for government contracting. As I recall, there was lots of consternation about stuff that was thrown away from SGML when XML was built, but this external entity stuck.