More RSS Stuff (I’m still not convinced)

OK, so there was some fiery banter over the weekend (half of which got lost
because of the server restore) about my picking on SPI – or more specifically my
picking on Caleb’s comments to the press – about the potential for significant
malware that utilizes RSS (at least in the near-term).  Anyway, I thought
I’d follow up on that and pass along a link that SPI sent around to a whitepaper
that they’ve put together that further outlines their position on this. 
The whitepaper, "Feed
Injection in Web 2.0" makes for an interesting read, but I’m still not
getting it entirely.  As far as I can tell, the point of the paper seems to
be:

• You can download content that’s created by a potentially dangerous person
• That content can get rendered by your reader and potentially execute
  scripts
• Sometimes readers don’t implement security the right way

It seems to me like the first two bullets are sort of the point of
syndication: somebody creates content for others to view – that content might
include client-side functionality (scripts.)  The third bullet – while both
true and interesting – is also equally true of web content, flash, email, and
all sorts of other communication methods. So why is it unique to RSS?

Anyway, not to stir back up the bee’s nest, but I’m still not convinced that
there’s anything unique to RSS that makes it more dangerous than other
protocols/communication vectors; I don’t think it’s more likely to facilitate
malware, I don’t think it’s more likely to engender end-user attacks, and I
don’t think it’s likely that it’ll be a common attack vector in general. 
But that’s just my two cents…