3 ms·

> And possibly the autodiscovery needs tweaking too, as I observe it not finding the feed on my site https://chrismorgan.info/ https://chrismorgan.info/, which

> And possibly the autodiscovery needs tweaking too, as I observe it not finding the feed on my site https://chrismorgan.info/ https://chrismorgan.info/, which is properly specified; my first guess is that it’s not coping with the type=application/atom+xml attribute. I fixed that: https://mergefeed.net/Untitled?urls=https://chrismorgan.info/ https://mergefeed.net/Untitled?urls=https://chrismorgan.info... > In related news, MergeFeed is currently vulnerable to injection attacks because it mishandles Atom titles that are specified as text. If you specify a title as HTML or XHTML, it filters out a <script> element properly (good! and while retaining inline formatting too!), but if you specify a title as text, it doesn’t escape the HTML (which is what it should do) or filter it (which would have been wrong but would at least have closed the security vulnerability). Proof of concept: https://mergefeed.net/-?urls=https://temp.chrismorgan.info/xss.atom https://mergefeed.net/-?urls=https://temp.chrismorgan.info/x... I fixed that too. But for now I wasn't able to fix it without also removing formatting. I might be able to figure out how to keep formatting without allowing XSS attacks later, but I'm not sure that's even a good idea. It's kind of a link aggregator and link aggregators generally don't allow formatting. You don't want people to try to gain attention that way, leading to an arms race.

chrismorgan 5y ago
> I'm not sure that's even a good idea. It's kind of a link aggregator and link aggregators generally don't allow formatting. You don't want people to try to gain attention that way, leading to an arms race. Wait till you hear about Unicode bold and italics: https://yaytext.com/bold-italic/ https://yaytext.com/bold-italic/. (I hold that most tools being weak doesn’t mean that my tools should be weak, and I view text-only titles as weakness, one that can be solved without introducing problems, so long as you don’t get this encoding problem.)
chrismorgan 5y ago
I think that autodiscovery is only finding the first feed. Since you’re aggregating feeds, I’d expect it to find all feeds on all pages. Sample page with multiple feeds: https://chrismorgan.info/blog/tags/fun/ https://chrismorgan.info/blog/tags/fun/ has the site-wide feed and then the tag-specific feed. I say only “I think” at the start of this comment because the entries in the second feed are a subset of the entries in the first, though it has a different feed ID and title, and I can imagine it possibly merging them. Losing formatting makes me a little bit sad. The widespread idea that titles are necessarily plain unformatted text is just bad. Italics especially are very regularly useful.
- amadeuspagel 5y ago
  > I think that autodiscovery is only finding the first feed. Yes. > Since you’re aggregating feeds, I’d expect it to find all feeds on all pages. No, I don't think that would be useful. For example, a lot of blogs have autodiscovery for a feed of all posts and for a feed of all comments on their homepage. But if I want to create a multifeed of several blogs, I only want the posts. Generally, the way I expect autodiscovery to work is that a link to the most specific applicable feed comes first. For example on the page for the tag "fun", the feed for the tag fun should come first, because that's most likely what people are looking for on that page. If they wanted the general feed, they'd go to the homepage.

chrismorgan 5y ago

> I'm not sure that's even a good idea. It's kind of a link aggregator and link aggregators generally don't allow formatting. You don't want people to try to gain attention that way, leading to an arms race. Wait till you hear about Unicode bold and italics: https://yaytext.com/bold-italic/ https://yaytext.com/bold-italic/. (I hold that most tools being weak doesn’t mean that my tools should be weak, and I view text-only titles as weakness, one that can be solved without introducing problems, so long as you don’t get this encoding problem.)

chrismorgan 5y ago

I think that autodiscovery is only finding the first feed. Since you’re aggregating feeds, I’d expect it to find all feeds on all pages. Sample page with multiple feeds: https://chrismorgan.info/blog/tags/fun/ https://chrismorgan.info/blog/tags/fun/ has the site-wide feed and then the tag-specific feed. I say only “I think” at the start of this comment because the entries in the second feed are a subset of the entries in the first, though it has a different feed ID and title, and I can imagine it possibly merging them. Losing formatting makes me a little bit sad. The widespread idea that titles are necessarily plain unformatted text is just bad. Italics especially are very regularly useful.

amadeuspagel 5y ago
> I think that autodiscovery is only finding the first feed. Yes. > Since you’re aggregating feeds, I’d expect it to find all feeds on all pages. No, I don't think that would be useful. For example, a lot of blogs have autodiscovery for a feed of all posts and for a feed of all comments on their homepage. But if I want to create a multifeed of several blogs, I only want the posts. Generally, the way I expect autodiscovery to work is that a link to the most specific applicable feed comes first. For example on the page for the tag "fun", the feed for the tag fun should come first, because that's most likely what people are looking for on that page. If they wanted the general feed, they'd go to the homepage.