This is a really interesting moment and is worth some introspection. On one hand, Facebook is clearly correct: If FB makes an API, and a user gives an applicat

This is a really interesting moment and is worth some introspection. On one hand, Facebook is clearly correct: If FB makes an API, and a user gives an application (written by a third party and run on a fourth party's device) their username and password, then FB cannot be blamed for the application using the username, password, and API to retrieve private data. Indeed, that's the point. On the other hand, appearances make it look like Facebook is hiding some things: why is this not a public API? What trust are you putting in these third parties, what are you giving them that not everyone would be trusted with? But most of all, people are waking up to the vulnerability of their private data. They are realizing that some things they've been taking for granted for years are dangerously insecure. So we have users, such as reporters, suddenly realizing that their device has access to all the data you view on it. Any third party app you give your FB uname/pwd to has access to everything on your Facebook, and the only limitation is whatever their terms of service are. (So does any software that app runs on top of.) Coming to this realization, we see backlash not always correctly directed. It would make at least as much sense to call out those third parties rather than FB, and ask them to prove they do nothing nefarious with this trust. Is it too optimistic to hope this will stir mainstream interest in free and open source software?