Private Blogger Blogs Not So Secret
I have been looking forward to Google rolling out private blogs. (As much as I criticize them, I am probably one of their biggest fans. I use many of their services.) Basically, I need a place on the web where I can a) post notes either from my computer or by email and b) have them searchable in a Googly way. I do not subscribe to the crowd mentality on private blogs. They're handy as personal productivity tools or to share more intimate thoughts with a small workgroup or your family and friends. Last but not least, corporate public blogs should be kept private until you're ready to announce to the world.
I signed up for the Blogger beta and found the changes to be very intuitive although evolutionary from the last big upgrade. However, already there is a big hole for private blogs. By default Google turns on feeds for all new blogs. When these blogs are private, the feeds are still totally public and therefore can and will be indexed by search engines. Google should treat feeds on private blogs the same way they do in Google Calendar.
Note the two screen grabs below from my test blog. The first shows what the Atom feed looks like in my browser for a blog I set up as private. The second screen shot shows what the blog looks like if I try to access it from the Web. In both cases I am not logged into my account.


This is not the first time that Google has had a major problem with privacy on its publishing platforms. Google Blogoscoped chronicled how Google's Picasa Web Albums have had privacy snafus. Meanwhile, Google is working to reassure us that our search data is safe. I don't doubt that it is, but as they stick their thumb in one potential vulnerability the water is leaking out the others.
::Later: Jason Goldman from Google weighs in that this is indeed a bug.







Since it appears that none of the privacy features are turned on yet, I think it's hard to say that the feeds won't be protected. It would be nice to see Blogger support the Blogines standard for RSS privacy. http://www.techcrunch.com/2006/08/01/bloglines-will-block-your-feed-from-search/
Posted by: Marshall | Monday, August 14, 2006 at 08:23 PM
Marshall, I am seeing the privacy features and was able to create a private blog. The feed was still naked. Granted, this is a beta. But beware.
Posted by: Steve Rubel | Monday, August 14, 2006 at 08:34 PM
Thanks for the bug report, Steve. The fact that the feeds are exposed is unintended and will be corrected.
Posted by: Jason Goldman | Monday, August 14, 2006 at 08:36 PM
As far as I see, I can turn off the feeds in the "Site Feed" tab - or is this a new feature since yesterday?
Posted by: Wolfgang Luenenbuerger | Tuesday, August 15, 2006 at 09:28 AM
Just a heads up that this bug was fixed Tuesday evening.
Posted by: Pete Hopkins | Thursday, August 17, 2006 at 12:51 PM
Just a heads up that this bug was fixed Tuesday evening.
Posted by: Pete Hopkins | Thursday, August 17, 2006 at 01:00 PM
It seems that now the feed of a private blog is not available at all ... are there any mean of logging in to subscribe to a private RSS/Atom feed? What about this standard that bloglines proposed?
Posted by: Peter T. | Saturday, January 06, 2007 at 03:41 PM
I've set my blog to private just for the author, but I can still get in from everywhere. The function sucks.
Posted by: Paula | Friday, January 12, 2007 at 11:57 AM
Pete said,
It seems that now the feed of a private blog is not available at all ... are there any mean of logging in to subscribe to a private RSS/Atom feed? What about this standard that bloglines proposed?"
I am a teacher and I just had private blogs set up for my students... but I want to have them see everyone's new posts in a feed reader. Can I make this happen without making my student blogs public?
They are all invited as readers for each other's blog and authors for our class blogs.
Please help...this is my 2nd attempt at setting blogs up for them- the first worked fine for me on firefox, but not with the old explorer for mac browser at school:-(
Posted by: David Truss | Sunday, January 14, 2007 at 12:49 PM
Steve,
DO you know whether Google has corrected this privacy issue?
Do you know whether Typepad or Wordpress or another provider gives privacy blogging with feeds protected?
Posted by: Matt Charron | Thursday, September 20, 2007 at 09:52 AM