I don't think I'm running trunk code... I'm running version 1.95.1 (2011-04-25 15:04:14).
I copied views/generic.rss into views/default/news.rss (which seems more in line with the book example, since the show function shows the wiki page), and it still inserted ".rss" in after "show" So... if you're saying that this might be preventing a security vulnerability, maybe I should add ".html" to the "show" function name. Though, then the link would be "http://127.0.0.1:8000/mywiki/default/ show.html/2", which looks a little wonky but probably works, right? link = 'http://' + str(request.env.http_host) + URL('show.html', args=row.id),