>> How can it be that Facebook with all their engineering prowess can't even tell who accessed what, let alone put adequate permission controls on their APIs?

>> How can it be that Facebook with all their engineering prowess can't even tell who accessed what, let alone put adequate permission controls on their APIs? > Probably laziness Facebook is a lot of things, but they're not lazy. As far as can be seen, their decisions are largely intentional. If they didn't do something, it's because they didn't want to or it would hurt their bottom line, not cause they're lazy.