Feed Access Control
More on the Bloglines Feed Access Control spec. Dare pointed out yesterday that one big problem with the spec as it stands is that there's no use case outlined. It turns out that the announcement on the Bloglines weblog does give some use cases:
...you may want to allow your friends and family to subscribe to your blog but you'd prefer your posts not show up in search results...
Setting the access restriction to 'deny' will indicate the feed should not be re-distributed. In Bloglines, we'll use this to prevent the display of the feed information or posts in search results or any other public venue.
In my own words, I'd say that if Bloglines encounters a feed tagged with this extension (and marked deny), they will let the user subscribe to it, but they won't let on to anybody else in the system that they know that this feed exists. Actually, this is currently how NewsGator currently handles password-protected feeds. We do get requests to remove certain feeds from our index, and we handle these on a case-by-case basis. So allowing publishers this option would take that burden off of us.
My only real technical objection to the spec is in the handling of the state transitions implicit in the <access:restriction /> relationship attribute. The spec says "The default relationship is to allow access. However, if a feed is currently set to 'deny', the relationship must be explicitly set back to 'allow' for it to be registered (Simply ommiting it from the feed is not sufficient to turn access back on)." - this implies that you need to model a state machine around a feed's access state, which is really much more complicated than it needs to be. I believe that the default value for the attribute should be "deny" - the vast majority of content producers won't even emit this element, and if you do emit it, you're likely doing it because you intend to deny access to your content.
However, with respect to the stated goal of making feeds truly safe for non-public information, I think this spec is somewhat dangerous. I commented at Dare's that the danger is that major weblog engines may put a checkbox on the weblog configuration screen saying something like "keep my posts from showing up in search engines". An RSS/Atom extension does nothing of the sort; it's a gentleman's agreement. If you really want to keep things private, you should password protect them. Search engines can't see that content at all, any server-based aggregator that indexes content from password-protected feeds has a serious bug. LiveJournal probably has the most extensive experience in handling weblogs with confidential content, I'd love to hear their thoughts on this whole thing.