Slashdot Mirror
Facebook Removes Firewall from Applications
NewsCloud writes "Last week, Facebook quietly removed sign-in restrictions that previously hid third party applications from the public Web. In other words, Facebook now allows its third party applications to be viewable on the Web by anonymous visitors and indexable by search engines. Web developers can now build an application using Facebook's platform usable by anyone on the Internet — not just Facebook members (e.g. the Lending Library). In doing so, developers can leverage Facebook's login and registration as well its other platform services, which are becoming increasingly substantial. Facebook may be trying to gain advantage as a universal authentication gateway for public Web applications. If successful, it could further hamper efforts to establish OpenID. This will also help the company break out of its earlier AOL-like walled-garden strategy."
Facebook users organize a mass protest against this change in 5... 4... 3... 2... 1...
Now we just need one or two careless fools coding myfirstfacebookapp to make a mistake and people can cleanup on information collection...
Perhaps Facebook (backed by Microsoft $) is now looking to get its apps in other places in order to compete with Google's OpenSocial, maybe?
To hell with the analogy to AOL's "walled garden", I envision some more akin to a burning garden if a major security incident were to occur after widespread adoption of this platform for single-signon functionality. This is the same reason I have always been opposed to Microsoft's ambitions for using their Passport system for wide authentication; my objections had very little to do with my political opinion of Microsoft (which isn't terribly high, but that's beside the point). Diversity in any system is good for competition, and limits the damage any one exploit can cause.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Does this strategy protect the Facebook users' data from being seen by non-Facebook users at the Facebook API level? By this, I mean that Joe Internet User cannot see my data on the Facebook application, and that Facebook is held liable for this, not the application developer? If this cannot be guaranteed, it looks like I might be removing most of my applications, no matter how useful they may be. I trust Facebook a whole lot more than I trust individual people.
Colin Dean Go a year without DRM
Yeah both "AOL, Cordance, JanRain, Microsoft, NetMesh, Six Apart, Sxip, Sun Microsystems, Symantec, Verisign, Yahoo! [and] Google." http://radar.oreilly.com/archives/2007/12/openid_20_final.html Not to mention plugins already available for open source publishing tools such as WordPress.
They made the mistake of organizing the protest ON Facebook. Oops.
Now if you'll excuse me, I hear that you can make big money fast by installing this Facebook app called SendMyPersonalInfoToMotherRussia. I wonder what it does?
like me, started using facebook because it's a walled-garden with well segregated networks? I mean, I don't want to pervert457 or randomperson223 to be able to view my profile, or try to flood my inbox (or wall, I suppose). Maybe I am mis-informed, but that's how I perceive MySpace from a lot of media reports including here on /.. Now-a-day, facebook seems to become exceeding bloated with random apps. I just want to check what's up with my friend and his profile takes eons to load (partly his fault of course). I also start to notice that my "notification" are filled with (non-deleteable) items for ads (just saw a Blockbuster one).
Oh yeah, and this is hilarious...youtube video
The only possible interpretation of any research whatever in the 'social sciences' is: some do, some don't
instead of http://facebook/ use https://facebook./ They don't advertise it, but there it is. It doesn't protect anything but your password, however. After sign in you're off of SSL.
What's to stop the OpenID people writing something which uses a Facebook app as an OpenID server? Best of both worlds, I'd've thought.
This announcement is for APPLICATIONS. No one is going to see YOUR PROFILE! This allows people without facebook login's to see APPLICATIONS, not read your profile. If they want to use those APPLICATIONS, they will have to sign up. Even if they had a facebook profile, they still couldn't see your profile.
Ohh and another thing. Potential employers can't see your profile unless they submit a "friend request" and you accept them. So there's no issue with anyone searching google and finding your profile.
On the other hand, the sort of personal disclosure we see on facebook may grow into a cultural, society-wide phenomenon. Presumably most people are concerned about information disclosure because of consequences of that disclosure. If there are few consequences, how many people will care? Sure, the HR director who hired me probably looked for my facebook page. But I came across his facebook page entirely by accident, and his is way more revealing of his personal life than mine is. Once the college students of today rise to power, I think personal internet disclosure will be more socially acceptable.
Nah, MySpace could never be the new Usenet. They've had idiots on MySpace from the start. Usenet actually used to be good...
Damn I feel old.
OpenID is an overly complex protocol that requires a bazillion interdependencies to work right. Worse, it doesn't actually solve the pain. It doesn't solve the trust problem! People want an authentication protocol that has trust. Random URL's are not trust!
Yeah, I hear you saying "Cory, OpenID isn't about trust". Well than whoopty fucking doo, go away and stop wasting my time. If I cannot have trust, what the hell is the point of OpenID?
And seriously? URL's as your unique login? What the fucking hell is that all about? 1) URLs are ugly. 2) Mom & Dad dont understand them 3) URLS!?!?
And a bonus seriously. Having the whole mess ride on top of HTTP as a friggen space age XML-RPC-SOAP-REST thing? Pick something more mature? Why not at least try to sink it down into the HTTP protocol itself? Maybe even invent a new protocol. But layering it on top of an XML RPC protocol on top of HTTP on top of TCP/IP? Are you insane?
How will this whole damn thing integrate into SMTP or IMAP - will postfix need to learn OpenID and open itself to all kinds of web base security risks? How will I use this to log into SecondLife or World of Warcraft? Do they now have to write a gog damn web stack to authenticate against OpenID? How can it integrate into LDAP or active directory?
And NONE OF THIS IS EVEN SOMETHING YOU CAN TRUST! It is all worthless!!!
OpenID does not need facebook for it to fail. OpenID will fail because it is complex, hard to explain, doesn't play with other protocols, difficult to implement, and it is misunderstood by managers, developers, sysadmins, and security experts.
Peace sells, but who's buying?
Im going to go ahead and be a troll here, so you might just want to skip this comment-
Fuck anything that throws "open" in front of the name. Fuck openID. Do you want a goddamn pat on the back because you are "open?" On top of that people of slashdot are adamantly against Real ID, which is the same thing to my uneducated eyes, except for in the real world, but hey isn't giving your single password away nowadays the same thing as handing over your social security number, bank accounts, search history, et cetera?
I assume you aren't using any of those either since a lot of them have strong ties too.
Change is certain; progress is not obligatory.
(don't forget to top post over a full quote) Me too.
-kihjin