That's always annoyed me: sure, XML can be heavyweight but if we're going to use it we should at least get the benefits.

Naturally that line of reasoning didn't get very far with the “maintainers” of an internal purported-SSO system with a SOAP endpoint which crashed on non-ASCII data or SQL special characters in the submitted username / password values.