Comments on: Personalized Feeds

By: Kontes SEO

Kontes SEO — Sun, 13 Nov 2011 19:33:28 +0000

Kontes SEO hi, plz follow my link to support my seo contest artikel….

hi, plz follow my link to support my seo contest artikel….

By: How To Weld

How To Weld — Thu, 29 Oct 2009 14:33:33 +0000

I think that the web has developed a lot since this article was written, and that the progress fits into what you're looking for quite well! MIG Welding Techniques | Respectable Reviews | Training An Older Dog

By: Charlie Wood

Charlie Wood — Sat, 26 Nov 2005 16:28:07 +0000

The Spanning Salesforce feeds are personalized based on the user-ID supplied by the client in response to an HTTP Basic Authentication challenge. This moves the unique identifier out of the URL addressing Brad’s issues. Combine this with HTTPS encryption and you have a secure feed.

IMHO, this is the Right Way to do personalization (since aggregators don’t support cookies). The UI on the client end could use some work, but between NGOnline, NGOutlook, NGES, FeedDemon, and NNW, a single company could get a lot done on that front.

By: Joe Rosenblum

Joe Rosenblum — Sat, 26 Nov 2005 06:40:45 +0000

Brad,

I think your concern is partially valid, but only partially. Take the case of a personalized feed of my.earthlink.net (basically an RSS feed of a personalized home page). Any aggregator can implement a heuristic to the affect that if there is only one subscriber to a feed, the aggregator does lazy polling on the feed — that is, the aggregator only polls when the user logs in or starts a new session, and then only keeps polling while the user maintains a session.

If 10,000 my.earthlink.net RSS subscribers all have their personalized URL in Bloglines, Bloglines uses their lazy loading heuristic. If people start to share their personalized feeds, Bloglines determines a lazy loading v. prefetch tipping point (say 10 subscribers to a given unique feed).

In terms of the security concern: here’s my personalized My EarthLink feed. It has my local weather, some stock tickers I follow, my horoscope, and some other random stuff. Fairly boring to anyone but me. Not enough personally identifying information to do much damage, and no way to back out from that URL to a username and password for the actual personalized portal site.

As for your point about messing with tracking — I totally agree. Providers shouldn’t use a unique feed ID to assist in tracking unique subscribers. There are much better ways for that.

-Joe

By: Brad Feld

Brad Feld — Sat, 26 Nov 2005 05:16:41 +0000

Artem – you are right on the money with this issue. delicious isn’t using any real security on my for/bfeld feed – it’s simply putting private= and then the key. NewsGator actually handles a bunch of HTTP-based security – this is a case where the reader can’t anticipate what the service is going to do if the service is using non-standard security (how does an aggregator know that private= is the key? – how about using something standard.) I’m not terribly concerned about security on my for/bfeld feed – I also know that delicious knows they need to tighten up the secure stuff so they’ll get it at some point.

By: Artem Frolov

Artem Frolov — Sat, 26 Nov 2005 03:04:35 +0000

Brad, as an employee of company that cares about security, I immediately saw yet another problem with personalized feeds – you guessed it – security.

Looking through your list of subscribed blogs, I found that I am able to read your private del.icio.us feed. Your key is in a plain sight!

Well, I cannot know for sure (may be you intentionally made it public), but it is very likely scenario that people will expose their private feeds using blogroll tools without proper care.

It is classical security failure: none of the parts involved is directly at fault, but their combination is vulnerable.

delicious gave you a key, assuming you will keep it private. Newsgator did not recognize this as a private feed. Ultimately, the problem is in lack of authentication mechanism in RSS. Not that it is technically complex (after all, RSS piggybacks on HTTP, and there are authentication mechanisms for HTTP), it is just there is not much demand for feed security for a number of reasons.

It is also easy to imagine scenario when some smart service builds a combined prioritized feed based on your blogroll and your actual reading preferences. Now, for my paranoid self a plain blogroll is already a big privacy breach, leaking one of those personalized feed URLs would be a total disaster for me!

I am not sure if you want to let this comment through. I certainly would not – as a security researcher I should not believe in “security by obscurity” but my gut feeling is all for it.

On the other hand, you are a blogger with a big audience and investor in an RSS company, so may be my humble comment could help raise awareness about security issues in feed aggregation.

By: Barnaby James

Barnaby James — Sat, 26 Nov 2005 01:22:51 +0000

At least as far as counting subscribers, most of the big online aggregators support subscription counts in the User Agent header. I think it's unlikely that people will wholesale expose all of their aggregator feeds via an OPML Reading List especially as RSS becomes used more inside the enterprise and, as you say, for personalized content. You could imagine having public / private feed lists in your aggregator for example. Server based aggregators need to be smart about when they combine feeds together - i.e. URL is the same and no authentication is required. The GMail ATOM Feeds are a good example of something that can't be averaged together (and of something that I would never read in a server based aggregator...)