Anticipating RSS Spam
Marc Hedlund
Mar. 23, 2004 05:47 PM
Permalink

We've seen Usenet spam, email spam, search engine spam, IM spam, and Weblog comment spam -- how long will it take before we see RSS spam?
My RSS aggregator looks for new items and lets me know when a new item appears on a feed I read. It's easy to imagine a very malicious feed that would just always make its entries appear "new" -- change them subtly, report that they were just written, or whatever -- so that its items would always show up in my aggregator -- but I'd just unsubscribe. This "Fake New Item" approach could be used more subtly, though, such that I'd be less likely to unsubscribe. Let's say a news site wants to include an advertising entry amongst its news entries -- they could set it up, say, so that the ad shows up as new four times a day.
The Fake New Item approach could be used more easily with superaggregators, sites that bring together many RSS feeds and republish them as an aggregate. Centralized distribution means centralized response, but if a simple feeder wants to show its articles as new (slightly changed) twice a day, that might be hard to detect.
My aggregator currently displays HTML and follows redirects. An RSS Web Bug is already completely feasible -- want to know how many people are really reading your feed? I haven't seen a pop-up ad out of a feed, yet, but that doesn't seem far off -- if the pop-up goes to the background, which feed produced it? (There are other types of attacks possible, too, if RSS readers become more like full browsers.)
Those are a few I thought of. Anyone have other ideas? More importantly, since this is still a young format, is there anything that should change now to stem whatever ideas we think will occur to the spammers a month or a year from now?
Marc Hedlund
is an entrepreneur working on a personal finance startup, Wesabe.
Comment on this weblog
You must be logged in to the O'Reilly Network to post a comment.
Showing messages 1 through 8 of 8.
-
only one thing will stop spammers
2004-03-24 02:37:31
jwenting
[Reply | View]
-
Report abuse
2004-03-24 03:36:27
manish_jethani
[Reply | View]
-
Safeguards against Blog Spam
2004-03-24 11:21:48
serat
[Reply | View]
-
Branded XML Readers
2004-03-24 16:05:25
charlwood
[Reply | View]
-
I don't get it
2004-03-25 21:55:03
aristotle
[Reply | View]
-
glad to see someone else thinking about this.
2004-03-26 13:03:03
slightlyoff
[Reply | View]
|
Showing messages 1 through 8 of 8.
|
Return to weblogs.oreilly.com.
Weblog authors are solely responsible for the content
and accuracy of their weblogs, including opinions they
express, and O'Reilly Media, Inc., disclaims any and
all liabililty for that content, its accuracy, and
opinions it may contain.
This work is licensed under a
Creative Commons License.
|
In other words, as long as it's less costly to spam than the probable income (however low, remember email spam is profitable from as few as one in a hundred thousand responses!) they'll continue to spam.
The only way I see to stem the flow is to incur a cost to sending traffic.
In the case of email it may be too late, and maybe for RSS also by now however yound it is.
Some sort of mechanism would have to be found by which the sender pays the receiver for each sent item. When the receiver is also a sender himself it could be set up so that the ballance is automatically calculated in order to prevent a huge number of microtransactions (this seems the most likely thing that could possibly work for email if enough ISPs cooperate).
Non-paid feeds would still be available, but use at your own risk.
If the sender pays that does several things:
1) it makes him more likely to vigorously check his systems for exploits that spammers could use to spam through him
2) it makes him think twice about spamming himself
3) it makes him think twice about posting trivialities.
All would reduce the amount of garbage sent.