http://channel9.msdn.com/clientaccesspolicy.xml

Actually I can't, although I do understand why you would want us to.

The danger of any client access policy is that it could be used to take an action on behalf of the user without their knowledge or permission. Assuming you have valid authentication cookies in place, a Silverlight app could send a http request to any allowed URL on Channel 9 and create a post, edit something, post a reply, etc....

That isn't a risk when we only allow access to /Feeds/RSS because that is completely a read-only path within our site, there is no ability to take any action at that location. If we opened up access to /posts/* for example though, then individual entries also fall within that path and the Silverlight app could create comments on your behalf. This would be solved if there was a more complex method of creating allowed paths within the client access policy file (something like regex or the simpler mapping syntax using in MVC routing), but as is we'd have to add a line to that file for each and every blog/show on our site. That isn't actually all that crazy, but I would definitely need to move the file to being a generated result instead of what it is right now, a static file.