LoginSign Up
← Back to all sparks
C

CommaFeed

COLLAB
Velocity5.0

Self-hosted Google Reader inspired RSS feed reader

www.commafeed.com ↗

A self-hosted RSS reader that now spends most of its release notes on security.

rss-readerself-hostingsecurity-hardeningapi-interopmobile-clients
◆Current state
CommaFeed is a self-hosted Google Reader replacement that has spent the 6.x-to-7.x stretch rebuilding its trust boundaries rather than its feature list. SSRF protection has been tightened in four consecutive releases, feed parsing now strips javascript: URLs before they reach the database, and OPML imports are filtered against import-time abuse. The 7.x line pairs that with client interop: Fever API, ReadKit compatibility, and now the Google Reader API.
◆Where it's heading
The project is positioning itself as a sync backend other people's apps talk to, not just a web reader. Each release adds another protocol or client fix while hardening the assumption that an instance may be publicly exposed with untrusted users on it. The 7.0.0 swap from JEXL to sandboxed CEL and the 7.3.0 flip of blockLocalAddresses to a secure default both trade self-hoster convenience for a safer out-of-the-box posture.
◆Prediction
Expect continued client-protocol coverage and further SSRF narrowing; the recurring pattern in these entries is that every new fetch path gets a follow-up hardening release.

◆Recent moves

  1. 7h ago

    Google Reader API support and secure-by-default local address blocking

    Adds the Google Reader API alongside the existing Fever support, opening CommaFeed to mobile clients that never implemented Fever. The same release flips blockLocalAddresses to a secure default, which will break subscriptions to local-network-only feeds until self-hosters opt back out.

    View source ↗
  2. 8d ago

    javascript: URLs now filtered at parse time, not just in the client

    Moves XSS filtering from the React client down into feed parsing, so malicious URLs are never stored or served through the REST API. That matters specifically because third-party apps consume that API and were not protected by the client-side stripping.

    View source ↗
  3. 1mo ago

    Feed-declared icons, starred-entry search, and image-proxy SSRF limits

    A mixed release that adds feed-declared icon support for RSS bridges and extends search to starred entries, while closing the image proxy as an arbitrary-URL fetcher. Pocket sharing is dropped because the service shut down.

    View source ↗
  4. 3mo ago

    Mobile unread count in the header plus a graceful refresh shutdown

    Fixes a real mobile gap where the unread count was invisible because the tree is hidden by default. The new shutdown-timeout setting lets the refresh engine finish in-flight feeds instead of being killed, which is the kind of detail that only shows up once people run this in earnest.

    View source ↗
  5. 5mo ago

    Filter expressions move from JEXL to a sandboxed visual query builder

    ⚡ SPARK

    The release that set the direction the 7.x line has followed since: replace a scripting-language escape hatch with a constrained, sandboxed alternative, and add push delivery so the reader can notify instead of being polled. Both themes recur in every subsequent release.

    View source ↗
  6. 6mo ago

    Starred entries are kept indefinitely by default

    Stops the cleanup job from deleting starred entries, with a setting to restore the old behavior. Small in diff, but it changes what starring means — from a temporary marker to an archive.

    View source ↗