Nick Bradbury

Spyder Spots a Memetracker

Andy "Spyder" Herron writes about the "personal memetracker" that's hidden in FeedDemon 2.0.0.25.

I had hoped to complete this feature by now, but as Andy points out, it still needs some work (which is why I hid it and gave it a "beta" label). If you'd like to try it out, select "Popular Topics" from the Browse menu (or just add the "Popular Topics" toolbutton to the toolbar above FeedDemon's browser).

I should add that this feature will probably be useful only to people who subscribe to a lot of feeds since it relies on common links to determine popularity. So if you're not subscribed to feeds which link to the same articles, chances are it won't show you any results. However, if you're a real feed junkie, this feature should really help you discover what everyone is talking about.

Why the Title Doesn't Work

Dave Winer writes about relying on titles for de-duping items across feeds:

"You can do a decent job of figuring out if you've seen an item before and not show it to the user if you look at the title of the story....It ain't perfect, but then neither is anything else in the world."

Dave, I understand where you're coming from - as an aggregator developer, I've certainly seen enough to know that many feeds are far from perfect, and it's up to developers such as myself to handle imperfect feeds without involving the end user. But I disagree that title is reliable enough to use for de-duping. If you're subscribed to a lot of blog or news feeds, then yes, this likely works well enough (for the exact reasons you stated). But there are many other feed sources out there, some of which use the same title over and over again (and they often don't use guids, so you have to rely on various combinations of title, pubDate and link to determine uniqueness).

For example, I'm subscribed to a bug report feed in which all edits to the original bug come through with the same title. I'm also subscribed to a feed from a web-based forum in which all replies to a specific forum post have the same title prefixed with "RE:". We'll see many more feeds like this as RSS continues to break out of the blog/media world, so I don't think title alone is good enough for de-duping.

In other words, not only is the world less than perfect, it's even more less than perfect than we thought ;)

Chinese Language Files for FeedDemon 2.0.0.25

Long-time FeedDemon user Jedi has created Chinese language files for FeedDemon 2.0.0.25. To install them, just browse this page in FeedDemon and click one of the links below:

• Chinese (Simplified)
• Chinese (Traditional)

Thanks, Jedi!

ANN: FeedDemon 2.0.0.25

FeedDemon 2.0 build 25 is now available. This new build contains fixes for the security vulnerabilities I described last week, and it also includes the performance improvements I mentioned last month.

For complete details on changes and additions, be sure to read the release notes before installing this build.

Download FeedDemon 2.0.0.25 (3.18MB)

Note: Just install this directly on top of your current version, and your existing settings will be retained.

Feed Security and FeedDemon, Part II

In my previous post I wrote about FeedDemon's security features, the most important of which is the fact that FeedDemon's newspapers operate in Internet Explorer's "Internet Zone" instead of the less secure local zone. This means that even if someone finds a way to trick FeedDemon into running script, it can't access the local zone (so it can't touch your hard drive, for example).

It's a good thing that FeedDemon has this feature, because while I was on vacation, Sam Ruby and James Snell talked about ways to get feed readers to run script - some of which FeedDemon is vulnerable to.

I want to stress that none of these vulnerabilities compromise your local machine, but as James Snell discusses in a subsequent blog post, the fact that script can be run inside FeedDemon is still a problem, and it's one I take very seriously. If nothing else, these vulnerabilities could be very annoying if exploited. For example, if someone hacked a popular feed so that it contained an exploit which forced a JavaScript popup to appear to all subscribers, there would be a lot of unhappy feed consumers out there.

I also want to add that every feed reader I tried is vulnerable to the same exploits, but I realize that's no excuse for my own code and it's small relief to FeedDemon users.

I've spent the past week fixing these flaws, and James Snell has kindly tested a private FeedDemon build and found that every vulnerability has been addressed. We plan to release this new build (v2.0.0.25) as soon as we've completed testing it (which may take a few days).

In the future I plan to write about how the specific vulnerabilities were resolved, but I don't want to do that until I'm sure that other feed readers have patched them. In the meantime, if you're the known author of a feed reader and would like details on the solutions, please feel free to contact me - I'd be happy to share the logic behind the fixes.

As a side note, I'd like to thank those who let us know about the problems before making them public. This was a responsible way to get the vulnerabilities fixed without putting customers at risk, and we appreciate it.

Feed Security and FeedDemon

Looks like the RSS world is abuzz with talk about feed security due to SPI Dynamics' presentation at Black Hat USA 2006.

SPI Dynamics contacted us several weeks ago about potential vulnerabilities in FeedDemon, and I'd like to thank them for notifying us prior to their presentation. I spent quite a bit of time testing FeedDemon to make sure it wasn't vulnerable to any of the exploits they reported, and thankfully the only vulnerability I discovered was a minor one: specifically, a JavaScript alert embedded in a feed's title element could be displayed by FeedDemon in certain situations. This bug was fixed the same day it was discovered.

FeedDemon is not vulnerable to any of the more serious exploits they reported - so you can imagine my surprise at seeing news reports which listed FeedDemon among the vulnerable RSS readers. Because of this, I'd like to take a few minutes to go over some of FeedDemon's security features.

I've written about feed security a few times, and it's something I've been concerned about since 2003, when Mark Pilgrim's platypus prank illustrated the dangers of republishing HTML from multiple sources. Because of this, I designed FeedDemon to strip script blocks and script events from feed content, along with potentially harmful HTML elements such as:

• embed
• object
• frame and frameset
• iframe
• meta
• link
• bgsound
• marquis
• body
• style

This provides an initial layer of protection, but FeedDemon goes a step further. As SPI Dynamics pointed out in their presentation, RSS readers which embed Internet Explorer run the risk of permitting script to operate in the local machine zone, which means that the script is treated with a high level of trust - including the ability to access the local hard drive. However, FeedDemon is not vulnerable to this security flaw. FeedDemon makes use of IE's local machine zone lockdown, which forces local content to operate in the more secure Internet Zone. So even if a malicious feed creator somehow finds a way to trick FeedDemon into executing script, that script won't be able to do anything harmful.

PS: Apologies for not enabling comments for this post, but I'll be away from my computer this week and can't risk the comment spam.

Dumbass in a Sea Kayak

I spent the second week of my month off in beautiful St. Croix, and it was a memorable time. But there was a day that I'd like to forget about.

It started when I decided to take my seven-year-old son Isaac out in a tandem sea kayak, something he's enjoyed several times before. It looked like a storm was brewing, but I thought it would be a while before it reached us (yes, that's the "dumbass" part - I'm still kicking myself for having such lousy judgment).

Our destination was a small beach not far from our hotel. My wife and our five-year-old daughter Hannah decided to walk to the beach and meet us there, where we figured we'd collect shells and maybe do a little snorkeling.

The waves were choppier than usual, and we were paddling against the current most of the time, so it was a lot of work to get anywhere. But it was worth the effort - Isaac loved riding the waves, yelling "woo-hoo!" every time one hit us.

Shortly after we reached the beach we saw that the storm was coming quicker than expected, so we packed up and got back in the kayak. As we paddled away from the beach, the wind picked up and the water got even choppier. Isaac was still having a blast, but I was getting worried - for good reason, as it turned out.

A few minutes later a wave turned us over, knocking us both into the sea. I came up for air, but I couldn't see Isaac - and quickly realized that he was trapped under the kayak. I swam beneath the upturned kayak and saw him struggling to get out from under it, so I grabbed him and pulled him to the surface. Right then and there he looked at me and said, "Dad, did you just save my life?" I said, "yeah, I think I did." His simple reply was "thanks."

But we weren't out of danger yet. The current was taking us in right where the waves were crashing against some large rocks beneath a cliff. I knew that if I didn't get us out of there we'd be smashed against them.

There was no way I could get us both into the kayak without turning over again, so I told Isaac to grab onto the back of the kayak, and then held the front of it with one hand and swam as hard as I could. The only way to steer clear of the rocky shore was to swim against the current - hard enough by itself, but near impossible while pulling a kayak with a 70-pound kid attached to it (especially when waves are tossing you around).

I honestly wasn't sure if I could do it. I figured if I failed to get us clear of the rocks, I'd let go of the kayak, then grab Isaac and hold him in front of me and let the rocks hit me rather than him. Apparently the thought of that gave me enough motivation to swim even harder, and after about 15 minutes we were far enough away from the rocks that I could make a beeline for the beach.

To Isaac's extreme credit, instead of panicking he helped keep us moving by kicking his legs as he hung on. When we were close enough to the shore, my wife swam out and grabbed our son, hugging him with all her might. I pulled the kayak to land, then dropped to the beach exhausted.

Needless to say, we feared that Isaac would be pretty shaken up by the experience (he was). We reassured him a lot that day, and I laid next to him that night in case he had trouble sleeping (he did). But a few days later - when the weather was calm and the waves were small - Isaac surprised us and decided that he wanted to go out in a tandem kayak again. We've always taught our children to face their fears (within reason), and he didn't want to be scared of kayaking since it was something he enjoyed.

So, we got another kayak and paddled out to sea again. Thankfully, it was a much better experience this time :)