There's been a very large amount of talk lately about Facebook being closed and a one way street for your data. Well there's two pieces of this that I think everyone needs to really look like (and here I said just yesterday I'd stay out of this).
- Application Terms of Use
- Application
Today this started with me on my morning show talking about it.
It was in Episode #6 that I decided to "challenge" myself to the whole idea and give it a go today.
So let's take a look at the two pieces and see what we can find.
1. Application Terms of Use
The honor code for all developers really, but is it anything more? Will it stop a malicious person from hiding a small little easter egg inside of their application? I like to think so it stops me so I hope it stops everyone else as well.
Here are some of the key entries from the Facebook Terms of Service.
- You can't use Facebook Platform for anything that infringes on anyone's rights or intellectual property, generates spam, phishes, or is illegal.
- You must treat users' privacy with the same respect we do. If you directly collect personally identifiable information from users, you must post a privacy policy detailing what you'll do with that info.
- You must be honest and accurate about what your application does and how it uses information from Facebook users. Your application cannot falsely represent itself.
- You can only show information from Facebook Platform to a user if you retrieved it on behalf of that particular user.
- You can only cache user information for up to 24 hours to assist with performance. The only exceptions are those listed in the Facebook Platform Documentation.
So that there is the bulk of the "legal" side of things to ensure that a developer requesting a key and submitting and application is aware that they can't do what everyone is complaining about - take user data out of Facebook. There is of course more to the TOS but those are the specific items that told me that 1) possible and 2) I shouldn't do it. If they added that in one would think that it must be possible, and since I believe in the fact that just about anything is possible I decided to give it a go and give Dennis a scare. I mean seriously if the US has to add "do not take orally" to Hemroid cream then it means somebody must have tried so I would think same case here.
They do get more detailed as well,
4) Except as provided in Section 2.A.6 below, you may not continue to use, and must immediately remove from any Facebook Platform Application and any Data Repository in your possession or under your control, any Facebook Properties not explicitly identified as being storable indefinitely in the Facebook Platform Documentation within 24 hours after the time at which you obtained the data, or such other time as Facebook may specify to you from time to time;
5) You may store and use indefinitely any Facebook Properties that are explicitly identified as being storable indefinitely in the Facebook Platform Documentation; provided, however, that except as provided in Section 2.A.6 below, you may not continue to use, and must immediately remove from any Facebook Platform Application and any Data Repository in your possession or under your control, any such Facebook Properties: (a) if Facebook ceases to explicitly identify the same as being storable indefinitely in the Facebook Platform Documentation; (b) upon notice from Facebook (including if we notify you that a particular Facebook User has requested that their information be made inaccessible to that Facebook Platform Application); or (c) upon any termination of this Agreement or of your use of or participation in Facebook Platform;
6) You may retain copies of Exportable Facebook Properties for such period of time (if any) as the Applicable Facebook User for such Exportable Facebook Properties may approve, if (and only if) such Applicable Facebook User expressly approves your doing so pursuant to an affirmative "opt-in" after receiving a prominent disclosure of (a) the uses you intend to make of such Exportable Facebook Properties, (b) the duration for which you will retain copies of such Exportable Facebook Properties and (c) any terms and conditions governing your use of such Exportable Facebook Properties (a "Full Disclosure Opt-In");
Then again here,
12) You will provide any information and/or other materials related to your Facebook Platform Applications reasonably requested by Facebook from time to time to verify your compliance with this Agreement. If any of your Facebook Platform Applications are available online, you acknowledge and agree that Facebook may crawl or otherwise monitor your Facebook Platform Applications for the purpose of verifying your compliance with this Agreement, and that you will not seek to block or otherwise interfere with such crawling or monitoring (and that we and/or our affiliates or agents may use technical means to overcome any methods used on your Facebook Platform Applications to block or interfere with such crawling or monitoring). If any of your Facebook Platform Applications are client-resident (including on a mobile device), you agree to furnish a copy of such Facebook Platform Applications and any supporting documentation upon request for the purpose of verifying your compliance with this Agreement; and
13) You acknowledge and agree that Facebook may include within the Facebook Properties "dummy" information that does not relate to any actual person, without specifically identifying such information, for the purposes of allowing Facebook to monitor compliance with this Agreement.
So with that I'm going to jump to the the second part now.
2. Application
Setting up the application took me about 3 mins, quick and easy form to request the API Key and the "Secret" (much better than most every other service I've tried) and I was able to lock the application to only "developers" meaning it won't be available for anyone other than someone assigned as a developer for the thing and it also won't post to your mini feed or anything so pretty much 100% under the radar.
Now there are some things about the API that you should be aware of, for example privacy of your data. Facebook dev guys are not stupid they didn't open things open and leave a big gaping hole in the back end to allow someone to skim your data even though you set it as not visible beyond a certain level.
Privacy note: For any user submitted to this method, the following user fields will be visible to an application only if that user has signed up for that application:
- meeting_for
- meeting_sex
- religion
- significant_other_id
In addition, the visibility of ALL fields, with the exception of affiliations, first_name, last_name, name, and uid may be restricted by the user's Facebook privacy settings in relation to the calling user (the user associated with the current session).
This means that my little "scare" to Dennis was more of a shock at seeing his data put back to him as opposed to anything else. (Screen shots are from own user)
Sorry Dennis didn't mean to scare you too much, especially since I went offline right after sending you the link. This took me only about 15 minutes to create, upload and give a test or two. Well as you can see from the following screen shots your data is actually still under your control.
So in the screen shot above (and Dennis saw something similar) you see I blocked out my User ID (not that it matters much since Scoble showed everyone how to find someone), all you have to do is look at the URL and you will see the user "id". Next you see my birthday (yep telling my age). But it's no surprise because according to my user profile I said show it!
But what happens when I change that setting to "don't show" or decide to only show the "month and Day"?
Well there I've made the setting change and then I run the small Facebook application again.
As you can see again it only outputs the data I allow to be shown the same thing the folks can actually get out of my profile anyway.
Now this is where it get's sticky though, you can't view my profile unless you are my friend, so is this a potential problem? Yes I think so - identity theft ring a bell? Of course with so many users being active and all that how soon before someone would begin to put the pieces together and be able to track you down? Fairly quickly as the application is running on my own web host.
Or what if I did email myself every time someone loaded that, bad yes but at the same time its only the data you allowed to be public anyway and there does have to to be some level of trust in platforms like this that those service providers are being responsible.
So let's move away from the negative for a moment and think "future", what I did with that very small little app was pull the birthday, education and work history of the user - now let's say the user is a new hire at a company and the company has a small Facebook application (of course they would need to discuss TOS with Facebook and all that first). This application would allow the new hire or potential new hires to simply copy their education and work histories as well as any other data of importance over to the companies internal system - for me that would be brilliant no more copying that data from LinkedIn to Facebook, to who knows where else. Considering this took me only the 15 minutes imagine if you really devoted some time to it certainly an Enterprise application in there I would think...
Technorati tags:
facebook,
open,
api,
danger
