Not to be flip, but if you're using a parser written by competent individuals post-2010 (really, post-2008), billion laughs is a nothing. And that follows for

Not to be flip, but if you're using a parser written by competent individuals post-2010 (really, post-2008), billion laughs is a nothing. And that follows for most XML stuff. If you are getting most bloggable with your tech stack, yes, there are certainly risks to XML (also to YAML, also to JSON--and there are definitely JSON parsers that have had some capital-I Issues out there, and a good number of the popular ones also parse not-JSON too). That said, if you're using anything remotely mainstream you can feel reasonably secure against the sorts of attacks you are likely to see because, TBH, your RSS reader is just not that valuable a target. (Or, in my case--the podcast service I'm writing.)