Wedge

Completely agreed.

But go tell a newbie to use rss/atom! To each their own...

If only SMF notifications could be made by rss... Oh that's an idea to develop ;)

A lot of people still use email because it's what's comfortable for them; I haven't used email subscriptions for new topics on any news/forum in years, just for sites that work with announcements when there is something occasionally new to notify me.

It isn't going away anytime soon, but I see its use dwindling as the old core of users fade out and are replaced with the newer tech-aware users, for whom Twitter, FB and RSS are commonplace.

RSS isn't going away any time soon though, it's too useful.


To answer the question, we have actually discussed it before, on the merits and problems of handing authentication in RSS, and we concluded that it poses a security risk.

Of course. We store a secret key for you. The rss feed has both the user Id and the key. Giving the URL away would be like sharing your account password anyway...

It's a security issue but technically I don't see why we couldn't offer this to aware users...

That's what I mean, I don't like anything that essentially allows you to compromise your account, even in a minor way.

But where could it be compromised?
- Online RSS reader services? What do they care about your particular rss feed when they've got billions to pick from? And what difference does it make with online e-mail services? If I trust GMail with my e-mails reproducing the contents of private PMs, why shouldn't I trust Google Reader with RSS feeds doing the same? And I actually read my feeds, while most of my e-mails end up in spam boxes...
- Sharing the RSS feed link? As I said, it's exactly like sharing your account's user name & password... You can do it if you want -- but don't complain.

Obviously, publishing a RSS feed link with credentials would require showing a disclaimer below the link, something along the lines of, "This is your private feed link, please do not share it with anyone or they can access your personal data."

I basically had some time to think of all that (although never got around to discussing it again), and I guess I think there are more good aspects than bad to this. Don't forget that such a feed would eventually be something like a Facebook wall -- any answers to a thought, any PM would be posted there for your convenience. Wedge would just need to 'log' any data into the feed and drop all older elements from the table, making it faster to retrieve any kinds of data for any user's rss feed.

I'm not saying it should be in Wedge 1.0, but this is something that we should keep discussing with the community -- it's an interesting feature to add, security can be taken care of by letting the admin disable it and the user choose e-mail notifications, and basically if the community wants it and it's fun to implement, why should we stop ourselves from doing it? :)

I personally prefer getting notifications of some sort when I visit the site.

I host my own minecraft server and I use bukkit.org's server software for it. I love their forums! They seem to do a lot of stuff right and I really like how to notify you of responses. It is just a javascript dropdown list, showing just a link (and subject) to the first reply after your last post.

But for less visited/posted sites I don't mind having email as a option. The current SMF option of having one email sent a day with a summary is pretty nice. Can't recall if I could have it sent slightly more frequently though...

Though using a service such as Feedly with your credentials would be a big security issue, it would still be quite useful...
I don't know if there could be a workaround for it ?

I'm trying to find a way to replace Tapatalk SMF notifications on mobiles by something neat.

This topic seems pretty old, does anybody still use RSS or similar features ?

AFAIK, there are only two ways of getting personalized RSS feeds... Either provide a user name & password, in which case UHHHHHH, or provide a security token provided to you by the forum, unique to your account, and revokable. (i.e. if you feel someone else is using your feed URL, just go to your profile, revoke the token, and update your feed URLs to use the new token.)

I added this to my to-do list years ago, but never got around to implementing it.
Anyway, RSS is becoming less popular these days; I'm blaming Google for that. Even I am spending about 10 times less time on RSS than I used to. Netvibes is nice, but I miss GReader.

And Tapatalk sucks big time. Dunno why you'd want to use it, but...

I use Flyne + Feedly  nowadays. Flyne is perfect because it can work offline, which is much better than Google Reader ever was while taking the metro.

The token way is a good solution :)

Either way, I just wonder on how could we get phone notifications other than email subscription.

Token will be implemented if there's enough interest, but I doubt there ever will...

Phone notifications? Err, I dunno... Does Chrome Mobile support the desktop version's notification engine..? Although you'd still need to have it opened, lol... Forget it.

Perhaps Chrome has push notifications for that kind of stuff ? I'll ty.

That's the reason any email client (at least those I know) and webmail (at least those I use, and if I don't use one, it's probably not worth using :P J/K) implements some sort of automatic filtering (also called rules sometimes) that can be used at several different levels (from moving all the emails from a certain source to another folder, up to filter based on almost any aspect of the email like body content, subject, from, to, reply-to, etc.).

My inbox is always (well, mostly O:-)) clean and minimalist, apart from spam the inbox contains only emails I'm too lazy to set up a filter that redirects them to the appropriate folder.

Feeds are something I don't use any more, I used feeds quite a lot (at least for my standards LOL) for news, but it's about 3/4 years I don't read any of them (I think I have folders of feeds with more than 10k unread messages lol).

On the token: I don't know, I feel it's a bit more difficult.
Let's imagine a scenario: you have here on the forum an hidden section where you post some sensible data, let's say a board you use as ticketing system, with the "privacy" function, and all the members of a certain group (those that do support) are allowed to see the topics inside. One of the member of this support group uses a feed to keep track of the activity on the board. By mistake (or by ignorance) he sends the feed url including the token to someone else (or even posts it on the internet). This will give anyone access to any "recent past" and future (up to when you discover it) post on that board. That access could include informations like admin passwords and ftp usernames and passwords.
Is this an acceptable risk?

Of course my example is a kind of exaggeration on the subject, but it's an example.
Of course you could reply that sharing username and password of an account is the same, true, but people are instructed daily not to share their data and use strong passwords, though there are still many that just use qwerty [1] and sends it to anyone that ask them the password.

1.

Heck, a web agency (actually I had to force myself to call it web agency, but okay), so someone that should be kind of aware of the risks involved in the web, sold an e-commerce website to a friend of mine and the access to the administration panel was admin/admin and it's not they didn't change it to "let the user secure it", they didn't even think about changing it.