Private Blogger Blogs Not So Secret

Google's Blogger, the grand daddy of the modern weblog publishing platform, today unveiled a new beta version that among other things touts enhanced privacy settings. For the first time on Blogger you can specify if a blog is public, private or by invitation only.

I have been looking forward to Google rolling out private blogs. (As much as I criticize them, I am probably one of their biggest fans. I use many of their services.) Basically, I need a place on the web where I can a) post notes either from my computer or by email and b) have them searchable in a Googly way. I do not subscribe to the crowd mentality on private blogs. They're handy as personal productivity tools or to share more intimate thoughts with a small workgroup or your family and friends. Last but not least, corporate public blogs should be kept private until you're ready to announce to the world.

I signed up for the Blogger beta and found the changes to be very intuitive although evolutionary from the last big upgrade. However, already there is a big hole for private blogs. By default Google turns on feeds for all new blogs. When these blogs are private, the feeds are still totally public and therefore can and will be indexed by search engines. Google should treat feeds on private blogs the same way they do in Google Calendar.

Note the two screen grabs below from my test blog. The first shows what the Atom feed looks like in my browser for a blog I set up as private. The second screen shot shows what the blog looks like if I try to access it from the Web. In both cases I am not logged into my account.

This is not the first time that Google has had a major problem with privacy on its publishing platforms. Google Blogoscoped chronicled how Google's Picasa Web Albums have had privacy snafus. Meanwhile, Google is working to reassure us that our search data is safe. I don't doubt that it is, but as they stick their thumb in one potential vulnerability the water is leaking out the others.

::Later: Jason Goldman from Google weighs in that this is indeed a bug.

Tags: blogger, google, privacy

Comments

[Marshall]

Since it appears that none of the privacy features are turned on yet, I think it's hard to say that the feeds won't be protected. It would be nice to see Blogger support the Blogines standard for RSS privacy. http://www.techcrunch.com/2006/08/01/bloglines-will-block-your-feed-from-search/

[Steve Rubel]

Marshall, I am seeing the privacy features and was able to create a private blog. The feed was still naked. Granted, this is a beta. But beware.

[Jason Goldman]

Thanks for the bug report, Steve. The fact that the feeds are exposed is unintended and will be corrected.

[Wolfgang Luenenbuerger]

As far as I see, I can turn off the feeds in the "Site Feed" tab - or is this a new feature since yesterday?

[Pete Hopkins]

Just a heads up that this bug was fixed Tuesday evening.

[Pete Hopkins]

Just a heads up that this bug was fixed Tuesday evening.

[Peter T.]

It seems that now the feed of a private blog is not available at all ... are there any mean of logging in to subscribe to a private RSS/Atom feed? What about this standard that bloglines proposed?

[Paula]

I've set my blog to private just for the author, but I can still get in from everywhere. The function sucks.

[David Truss]

Pete said,
It seems that now the feed of a private blog is not available at all ... are there any mean of logging in to subscribe to a private RSS/Atom feed? What about this standard that bloglines proposed?"

I am a teacher and I just had private blogs set up for my students... but I want to have them see everyone's new posts in a feed reader. Can I make this happen without making my student blogs public?
They are all invited as readers for each other's blog and authors for our class blogs.
Please help...this is my 2nd attempt at setting blogs up for them- the first worked fine for me on firefox, but not with the old explorer for mac browser at school:-(

[Matt Charron]

Steve,

DO you know whether Google has corrected this privacy issue?

Do you know whether Typepad or Wordpress or another provider gives privacy blogging with feeds protected?