Slashdot Mirror
Facebook Removes Firewall from Applications
NewsCloud writes "Last week, Facebook quietly removed sign-in restrictions that previously hid third party applications from the public Web. In other words, Facebook now allows its third party applications to be viewable on the Web by anonymous visitors and indexable by search engines. Web developers can now build an application using Facebook's platform usable by anyone on the Internet — not just Facebook members (e.g. the Lending Library). In doing so, developers can leverage Facebook's login and registration as well its other platform services, which are becoming increasingly substantial. Facebook may be trying to gain advantage as a universal authentication gateway for public Web applications. If successful, it could further hamper efforts to establish OpenID. This will also help the company break out of its earlier AOL-like walled-garden strategy."
Facebook users organize a mass protest against this change in 5... 4... 3... 2... 1...
Now we just need one or two careless fools coding myfirstfacebookapp to make a mistake and people can cleanup on information collection...
If successful, it could further hamper efforts to establish OpenID.
Wait, there were efforts? Last time I heard all users who really wanted to use OpenID were signed up. Both of them.
Perhaps Facebook (backed by Microsoft $) is now looking to get its apps in other places in order to compete with Google's OpenSocial, maybe?
Their next steps should be to create some new secure TCP/IP protocols to replace the outdated HTTP, SMTP, FTP, and so on, while signing in at the OS level.
Facebook is pretty much going to own.
To hell with the analogy to AOL's "walled garden", I envision some more akin to a burning garden if a major security incident were to occur after widespread adoption of this platform for single-signon functionality. This is the same reason I have always been opposed to Microsoft's ambitions for using their Passport system for wide authentication; my objections had very little to do with my political opinion of Microsoft (which isn't terribly high, but that's beside the point). Diversity in any system is good for competition, and limits the damage any one exploit can cause.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Does this strategy protect the Facebook users' data from being seen by non-Facebook users at the Facebook API level? By this, I mean that Joe Internet User cannot see my data on the Facebook application, and that Facebook is held liable for this, not the application developer? If this cannot be guaranteed, it looks like I might be removing most of my applications, no matter how useful they may be. I trust Facebook a whole lot more than I trust individual people.
Colin Dean Go a year without DRM
They made the mistake of organizing the protest ON Facebook. Oops.
Now if you'll excuse me, I hear that you can make big money fast by installing this Facebook app called SendMyPersonalInfoToMotherRussia. I wonder what it does?
My read on the above article is that it looks like facebook is making their network MORE OPEN. Through this openness more apps will be able to connect and communicate -- should mean more CONTROL and better experience for people both on and off facebook. The openness should also make it easier for users to move their information to new locations, non-facebook locations -- i.e. more ownership of one's own stuff. Looks good to me -- of course, based on my current understanding. ;-)
Jeremy Horn
The Product Guy
http://tpgblog.com/
Whenever I log into facebook (and I haven't logged in for several months now) I wince, because it appears that no secure protocol is being used. Anybody know if there's SSL login?
like me, started using facebook because it's a walled-garden with well segregated networks? I mean, I don't want to pervert457 or randomperson223 to be able to view my profile, or try to flood my inbox (or wall, I suppose). Maybe I am mis-informed, but that's how I perceive MySpace from a lot of media reports including here on /.. Now-a-day, facebook seems to become exceeding bloated with random apps. I just want to check what's up with my friend and his profile takes eons to load (partly his fault of course). I also start to notice that my "notification" are filled with (non-deleteable) items for ads (just saw a Blockbuster one).
Oh yeah, and this is hilarious...youtube video
The only possible interpretation of any research whatever in the 'social sciences' is: some do, some don't
A few days ago, I just deactivated my Facebook account just because of crap like this.
Wrote up a nice little thing about privacy, beacon, blahblahblah. This is yet another issue in likely a long line to come...
Frankly, IMHO their privacy setup sucks, but since no one (that the site really seems to appeal to) reads news sites that cover Facebook privacy issues, or reads the TOS about information they (the users) provide... People will continue to use it, then bitch when they show up with their personal information spread all over Google and 'affiliated sites'. Prospective employers already Google names, find MySpace sites, etc. This will be probably be just as bad.
Eh, mini-rant.
What's to stop the OpenID people writing something which uses a Facebook app as an OpenID server? Best of both worlds, I'd've thought.
This announcement is for APPLICATIONS. No one is going to see YOUR PROFILE! This allows people without facebook login's to see APPLICATIONS, not read your profile. If they want to use those APPLICATIONS, they will have to sign up. Even if they had a facebook profile, they still couldn't see your profile.
Ohh and another thing. Potential employers can't see your profile unless they submit a "friend request" and you accept them. So there's no issue with anyone searching google and finding your profile.
Applications are bound by Facebook's privacy policy, do not have access to your contact information (email, etc.), and are also bound by the application developer agreement which limits what they can do with your data further.
So, no, they cannot "go ahead and broadcast to the world that person's data".
From the article:
What about information that is included from your account in part of the application? Does this mean that information from Photos, Videos, etc., which Facebook now considers "applications" are indexable in Google or available to non-Facebook users?
I decided to stop stealing cynical quotes to use as a signature line.
Facebook may be trying to gain advantage as a universal authentication gateway for public Web applications.
Who WRITES these sentences? There is not an ounce of possibility of Facebook or any other private enterprise becoming a universal anything for anything but their own enterprise.
For instance, Google (not Facebook, but another intrinsically evil company) can try to scheme it all day if they want - but implementers and 3rd parties are not currently in such a sad state as to make deals with the devil without realizing it.
OpenID is an overly complex protocol that requires a bazillion interdependencies to work right. Worse, it doesn't actually solve the pain. It doesn't solve the trust problem! People want an authentication protocol that has trust. Random URL's are not trust!
Yeah, I hear you saying "Cory, OpenID isn't about trust". Well than whoopty fucking doo, go away and stop wasting my time. If I cannot have trust, what the hell is the point of OpenID?
And seriously? URL's as your unique login? What the fucking hell is that all about? 1) URLs are ugly. 2) Mom & Dad dont understand them 3) URLS!?!?
And a bonus seriously. Having the whole mess ride on top of HTTP as a friggen space age XML-RPC-SOAP-REST thing? Pick something more mature? Why not at least try to sink it down into the HTTP protocol itself? Maybe even invent a new protocol. But layering it on top of an XML RPC protocol on top of HTTP on top of TCP/IP? Are you insane?
How will this whole damn thing integrate into SMTP or IMAP - will postfix need to learn OpenID and open itself to all kinds of web base security risks? How will I use this to log into SecondLife or World of Warcraft? Do they now have to write a gog damn web stack to authenticate against OpenID? How can it integrate into LDAP or active directory?
And NONE OF THIS IS EVEN SOMETHING YOU CAN TRUST! It is all worthless!!!
OpenID does not need facebook for it to fail. OpenID will fail because it is complex, hard to explain, doesn't play with other protocols, difficult to implement, and it is misunderstood by managers, developers, sysadmins, and security experts.
http://www.youtube.com/watch?v=OwnTWZ1-UWY I recently deactivated my account, and have read concerns from several sources that facebook has strong ties with DoD and CIA investors.
What we need is a way to export your massive profile as one big XML file.
That way moving to new systems would not need to re-enter all the damn info all over again.
Liberty freedom are no1, not dicks in suits.
Google them, find out all the dirt and print it out, so when they mention your myspace page and say "whats up with the drunk girls" eh, you can pull
out the print outs and say, "Your file is more dirty Mr, or we could just let this go under the table"
Liberty freedom are no1, not dicks in suits.
You all have Oo.o and Firefox, so get World Wind.
1) facebook
2) microsoft
3) PassportBook
Slick.
Im going to go ahead and be a troll here, so you might just want to skip this comment-
Fuck anything that throws "open" in front of the name. Fuck openID. Do you want a goddamn pat on the back because you are "open?" On top of that people of slashdot are adamantly against Real ID, which is the same thing to my uneducated eyes, except for in the real world, but hey isn't giving your single password away nowadays the same thing as handing over your social security number, bank accounts, search history, et cetera?
Posting AC so I won't get a Karma hit, but I think a lot of problems with mods stem from the "use it or lose it" policy. When I get mod points, I feel compelled to use all of them rather than only modding good posts. I will catch a few good posts, but probably 3 of the 5 go to modding up an already modded post, or just modding funny.
Another Slashdotter who's also a Facebook app developer has explained how an app can't make your profile information available to the world.
The rest of my post about how a "friend request" is not the only way to see a profile still stands.
http://www.liveleak.com/view?i=da9_1189892568 http://www.1step4dollar.com/For More Info