Brad Feld blogged yesterday about a new FeedBurner effort to place ads on more feeds through the creation of aggregated feed networks. A single curator selects a few feed URLs to create a mega feed for a topic or musing. FeedBurner sells targeted ads inside of the aggregated feed and its various forms of syndication — HTML, RSS/Atom, JavaScript widget, etc. — on a CPM basis.

Who other than FeedBurner gets paid for these ad impressions? It seems like another attempt to mine the seemingly free gold laying on the riverbed named user-generated content. The idea isn’t much different than Squidoo, a company donating a percentage of profits to charity to make it seem a bit less like photocopying the work of other writers for profit.

In the literary world there are established means for paying writers for aggregation of work. A network such as FeedBurner could have all publishers opt-in to the possibility of network selection and provide such publishers an approval process for new published channels. Payments could be made on a per-use basis when a page using the content turns a profit. Authors with a Creative Commons By-Attribution license and a valid e-mail address in their feed could receive an opt-in e-mail for channel alerts.

Perhaps it’s best to use a network of venture capitalists as a test group, since they may not notice the pennies dropped in their hats from the crowd passing by, but the network seems like an under-thought launch announcement plan from FeedBurner and its VCs.

Robert Auger and Caleb Sima of security firm SPI Dymanics gave a 50-minute security briefing on RSS and Atom feed vulnerabilities at yesterday’s Black Hat conference in Las Vegas. Their talk, Zero Day Subscriptions: Using RSS and Atom feeds As Attack Delivery Systems, detailed how many blogging systems and feed aggregators do not block against malicious code insertion by third parties and often run at elevated permission levels on a user’s machine, exposing an entire operating system to a potential scripting attack. I wasn’t there, but News.com summarizes some of the topics covered in the talk.

Auger listed Bloglines, RSS Reader, RSS Owl, FeedDemon, and SharpReader as feed aggregators vulnerable to one or more of the attacks.

Malicious JavaScript code could be included in a feed item’s main content. It’s a good idea to strip out and sanitize this markup, or at least whitelist known and allowed sources of such code to prevent local code execution from alert boxes to much worse. Mark Pilgrim’s sample RSS 2.0 feed from Universal Feed Parser is one example.

An author might lose control of his or her blog, but some blogging systems such as WordPress generate comment feeds for every post. If the blogging system does not properly sanitize the third-party comment problems could pop up not only in the rendered web page but also in the corresponding feed rendered inside of an aggregator.

Sidenote: a trusted blog today could become someone else’s blog tomorrow. It’s a good idea for aggregators to listen for a 410 Gone response and unsubscribe from the feed since the domain or hosted account can be reused by someone else in three months or less.

The presentation also mentioned desktop aggregators binding to Internet Explorer and running at unnecessarily high security trust levels. This behavior gives downloaded JavaScript full access to your PC for extra nasties.

Update: A whitepaper on the exploits, including example feeds, is available from SPI Dynamics.

Mihai from the Google Reader team just posted some interesting data about observed namespaces across all feeds tracked in their system. The namespace data provides information not only about popular ways of expressing data, but also gives insight into blog software market share within a sample such as Google Reader subscriptions.

Dublin Core as the top namespace is not too surprising. What jumps out is the number of feeds using the default configuration on a variety of platforms, giving a glance into market share.

1. Blogger – 12%
2. FeedBurner – 4%
3. Windows Live Spaces – 4%
4. LiveJournal – 2.5%

Technorati and Google Calendar feeds appear to have equal subscription numbers among gReader users. Feedster and PubSub subscriptions each have about 1/4 of the popularity as Technorati.

Note: some sites such as MySpace declare the iTunes namespace even if their members never podcast.

Overall some pretty good data. Thanks for sharing Google!