I stumbled across a blog post today using the RSS feed to show how Pogoplug works.

The post was fine but the one thing he didn't realize is that if you post an RSS feed to a picture someone can get the complete RSS feed folder's name from the pictures properties.

For example his pic was at: (real URL changed)

http://my.pogoplug.com/feeds/59TeB87e4VAHNAcXH6go/0EYYe9yQ1-7vX2iNNkcnZuysw=/1-May-091047PM.jpg

A smart user could then figure out his whole RSS feed was at...

http://my.pogoplug.com/feeds/59TeB87e4VAHNAcXH6go

and then see everything in his folder. Even the files he does not want to share.

Word to the wise. Don't put anything in an RSS feed and then post it publicly that you don't want the world to see. If you are working with a particular client or an individual than this would be fine to do. If you need info on what the whole RSS feed deal is about see here.