Both, although I prefer outside. As was mentioned already, the roof really attenuates signals especially UHF and above. But I don't have enough room outside for everything I want, and a few things I don't really need an *excellent* antenna location so the attic works for those.
The central HVAC has a sheetmetal plenum the top of which is conveniently located near my radio bench, so it has sprouted a few receive-only UHF and 800MHz antennas for scanners. There are also a couple J-poles up there for ham radio, and at one point a 10M dipole but that's down. May see if I can fit a 30M dipole, I think I might have room for that. (My attic is huge!
)
Outside is a small forest of metal!
One nice advantage to attic antennas - if a nasty ice storm comes along, all the outdoor stuff gets a heavy coating and performance stinks. Especially for transmitting, the SWR goes sky high. The attic antennas will still work fine.