Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Updated RSS Feed SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Updated RSS Feed
We updated the RSS feed from 0.91 to 2.0 this morning, and added partial diary content in addition to the headlines. There are a couple of reasons why we did that:
  • RSS 2.0 should now be understood by most aggregators. When we originally started offering the RSS feed two years ago, RSS 0.91 was the most commonly used standard.
  • RSS 2.0 allows us to include a 'TTL', which indicates to the RSS reader how frequently to refresh the feed. Lets see if this helps a bit with overly busy readers
  • We do get regular requests to include full diary content.
For a lot of readers, RSS has become the way to go to stay up to date. However, from a web site operator point of few, RSS does have a couple of problems. The "pull" nature of RSS can cause high loads to the side, even if nothing actually changed, as the RSS readers keep polling the site for updates. For example, yesterday we had about 12,000 different IPs accessing our RSS feed, polling it 250,000 time. So thats about 20 "polls/user/day".

Now the advantage is of course that the RSS feed is a static page, and doesn't take a lot of resources to serve.

Another problem with RSS feeds is less technical: The ISC site does not want to be just a "news feed". In order to work, we do need you to interact with the site, and support us by providing reports about incidents and other feedback. Using an RSS reader will remove you from the actual site and lead to a more passive use. This is one reason why we will not offer full content of diary entries. For now, I added a "teaser" (first 100 characters). A technical problem with adding diary content is the fact that we have to strip links and characters that are not supported by the RSS standard.

Special note for Firefox users: You may see an odd character at the beginning of each headline but the first two. This is due to the fact that there is a new line at the start of each subject. For now, this is necessary to support the "iscalert" taskbar application. The feed is valid according to the validators I checked, so as far as I am concerned this is a bug in Firefox.

And don't forget that you can always get alerts of new diaries via e-mail: sign up here I will be teaching next: Intrusion Detection In-Depth - SANS London May 2021


4112 Posts
ISC Handler
Dec 21st 2005

Sign Up for Free or Log In to start participating in the conversation!