Slashdot Mirror

The login page at: https://www.healthcare.gov/mar... includes at least 8 third-party scripts, any of which could potentially harvest your username and password: https://stats.g.doubleclick.ne... https://www.googletagmanager.c... https://cdn.mxpnl.com/libs/mix... https://static.chartbeat.com/j... https://connect.facebook.net/e... https://platform.twitter.com/o... https://c1.rfihub.net/js/bcP.j... https://www.googleadservices.c...

they should have not removed the old content but quarantined it, so users who request their photos back can have it.

They did so, according to one administrator.
Except that, the end-users are in no position to get their own pictures back.
Only the application writer (in KIPI's case Dirk Tilger) can request an appeal on the ban to have both the application and the uploaded content restored.

they should have not removed the old content but quarantined it, so users who request their photos back can have it.

They did so, according to one administrator.
Except that, the end-users are in no position to get their own pictures back.
Only the application writer (in KIPI's case Dirk Tilger) can request an appeal on the ban to have both the application and the uploaded content restored.

The way OAuth2 is handled by your platform allows in principle anyone to impersonate our application, as all that's needed is getting to know our application ID, which can be easily obtained from the URL of the application page. If you feel our application has been used to send spam to other users, it has certainly not been done by our code.

So, either a spammer did indeed impersonate the application, or Facebook noticed that the applicationID sits there in the open, and anticipated this might happen eventually.

A hard problem to solve for an open-source app... (and for a closed-source app too, given enough reverse engineering time by a spammer...)

Maybe there should be a way to have "restricted" app-ids which only work in conjunction with a user login? That way, even if an app-id is pilfered, there would still be the need to have a user login in addition, who could then be blamed. It's a photo uploader, for chrissakes, so you need to log in to facebook anyways if you want to use it in a meaningful way...

Once on Facebook, always on Facebook. Or at least on their servers. Those guys are really thorough when it comes to collecting information!

The forum moderators also said the facebook staff "has been ignoring them (and everyone on the forums too) for weeks or months".

Nope. An AC posted a link to a developer post about it below. It contains this line:

Note that no content has been deleted - if your application is re-enabled, all the content comes back.

So, don't worry. There's still no way to delete pictures of you someone posts to Facebook.

Found it.

Note that no content has been deleted - if your application is re-enabled, all the content comes back.

Lots of apps were suddenly banned due to "negative user experience". Appeals are being rejected with canned replies. Facebook developers (see link, scroll down) are basically saying "you deserved it, our only fault is not telling you earlier why".

I made an attempt to classify "truthiness" with opinion coming and going but the results being placed into permanent facts.

The Facebook page is: Here. And the mechanics page is: Here. It could definitely be improved but as a basis it is a "wisdom of crowds" type harnesser. I've always thought of it as a "classifer" for "truthiness."

I ended up AdBlocking a bunch of facebook URLs to solve this. Annoying, but it did work. The ones I blocked:

http://connect.facebook.net/*
  http://www.facebook.com/connect/*
  http://www.facebook.com/plugins/*
  http://www.facebook.com/ajax/connect/*
  http://www.facebook.com/connect.php/js/FB.SharePro/
  http://api.facebook.com/restserver.php?*

(PS: why does slashcode convert text-only URLs into hyperlinks inside a blockquote?)