An RSS feed is literally the same as going to the website. A request is being made to the domain and anyone who can see the data between you and the website can see it. If you think you're secure going to the website normally, then an RSS feed would be secure, too.
this post was submitted on 13 Apr 2025
53 points (98.2% liked)
Privacy
37156 readers
272 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
There's a difference: Websites have JS and requests to CDNs. RSS feeds don't.
Why do you think an RSS feed can't sit on a CDN?
What I meant were CDNs such as Google's providing common resources like fonts or JS libraries.
Also, by using RSS you skip all visual garbage and more tracking that you might have to exposed.
PS: I dislike Google Fonts. It is the most insidious way that Google can track people as they are used everywhere and in almost all sites and even by some FOSS applications.
Have you heard of Local CDN? It provides at least some common things.
On, I have and have used it. Thank you.
But as far as the host server that you hit is comcerned, whether you block the fonts via uBlock or do not fulfill the server request via Local CDN, they will still use it to profile you, because you tag yourself in the minority of users in the world that do not hit the Google font servers. And Google knows this.
Since even most adblock users still do not block fonts or other assets like this.
Albeit I do as I use uBlock on Medium mode, including fonts. And I dropped using Local CND as to minimise my extensions footprint.
The main gain would be for the site's aesthetics as you host some assets locally, but from a privacy perspective, you are damned if you do, and damned if you don't. Albeit you are damned a little bit less if you do. LOL
The RSS feed is still fetched from their server. Whoever can watch your internet traffic would still see the connection to the site.
So if you put your RSS feed application behind a vpn it would be more private?
Then, only the vpn provider would see the very same traffic, the ISP would see without vpn.
The ISP would just see your connection to the vpn provider.
The sites themselve would just see the vpn ip.
So it's not the question about whether anyone sees the traffic, but who.
Only Tor would hide this traffic in a sense.
Private to whom? You've just moved the observer from your ISP to your VPN provider and whomever is upstream from them.
What if I only add the feed via floppy
How did you get the feed in the first place?
Burner terminal from 1990
And you burn the PC after each use.
They could observe a connection to the server, big difference. If the site is on a WordPress domain, that IP might lead to a load balancer that manages hundreds of sites.
Of course the reverse is also true, so for for example Facebook, of you hit one of their IPs, then its obvious what you're accessing
Privacy is not an aspect of an RSS feed. It's just a list of items in a standard format. Your reader requests it from the server, the server sends it. That's it.
The answer is absolutely yes
Keep in mind that RSS is just some XML sent over HTTPS connection. For anyone outside, it will look like gibbirish, they can say you are requesting and getting some things from that particular site but not what it is.
Your client downloads a XML file and parses it and then maybe downloads some images. There.
If the client itself doesn't track you, it's as private as online gets.
My first thought would be that it’s the same as using any other browser, so not a great way to be private. Am I wrong?
It is exactly the same. You can even open the RSS files in your browser directly. They're just XML files served via http(s)
The comment thus far are a little oversimplified... Yes, the feed is just an XML document, same as the HTML page, but there are several relevant differences. Yes, in theory, one could use server logs to determine which IP addresses make which requests for what documents, but in practice... Making things run and spying on people tend to be two different departments. With HTML, unless you block all javascript and have no images load, tracking javascript and tracking pixels will be invoked by your browser and those DO go to the tracking you department. If you hit a webpage it is FAR more likely that data goes somewhere for you to be spied on than just downloading an RSS feed (although individual items in the RSS feed may well have tracking pixels).
Depends on your threat model. If you use secure DNS and https for the RSS feed, then these people would know your IP and the IP you're connecting to:
- the DNS provider
- the RSS server
- your ISP/ VPN server
Your ISP or VPN will know you've made a TCP connection to that server at a specified port, but that's it. It's trivial for them to reverse lookup the IP back into a name.
Only the RSS server will know the specific URL you're visiting though.
Gonna give you a tip.
assume that 99% of anything you access online is visible to your ISP (and therefore your government and police) and the hoster of ther service.