Yesterday, Facebook expanded the platform by silently introducing new extended permissions. The idea is a new one for the platform, and has a new point of integration with Facebook.

Previously, developers have been able to access all of the methods of the Facebook platform. By default, accounts had access enabled to these methods, but for users who opted out, developers would receive errors when querying Facebook. For example, if my application tried adding to the Mini Feed of one of my users, by default, it would work. If that user unchecked “Publish stories about this in my Mini-Feed” on their applications page, I’d receive a permissions error when I tried to update it. If I had been simply abusing the Mini Feed, publishing too many stories recently, Facebook would throw a different type of error at me.

As the platform expands to greater integration with Facebook, some more “sensitive” parts of user accounts need to be protected, so unknowing users and/or underhanded developers don’t abuse an account. This calls for the introduction of an opt-in system, which is exactly what is new with these extended permissions.

Facebook added two new methods for developers under this new permissions system. The first allows applications to set a user’s status, and the second makes photo uploading much less annoying. These are only the first two methods available to the system, but they show how as we allow applications to get even closer to our accounts, we pass a line where we’re comfortable granting applications permission to change our accounts. Imagine what would happen to your status if any the applications could change it. What’s that? Ten of my friends have changed their status to “I am a zombie?” Great.

Last week, we saw a temporary slip up where three upcoming methods were exposed. One of them, groups.join, was documented at the time. At first, it might sound like this is a way for applications to automatically add users to whichever groups the developer pleased, but in fact the documentation said that it was only a way to approve outstanding group invitations. It sounds small, but this is a pretty large leap for the platform. As of now, there’s no way have an application approve any other type of request (like a friend request or application invitation). That’s not the type of functionality I’d like some of the less noteworthy applications to have. However, groups.join would be a perfect candidate for the new extended permissions system. This opens up the possibility that there might one day be a full-featured desktop application for Facebook (if that was something people even wanted). Or you might, for example, be able to approve group requests with the Facebook Toolbar if you grant it the appropriate permissions. So, we’re now seeing a freer, more flexible platform, but with the appropriate privacy measures in place.

We’ve been seeing lots of progress in general with the platform lately. FBJS is now out of beta, The Data Store API, after a month and a half, is now an open beta, the platform team is responding on the developer forums, developers can work in teams on applications, invite abuse is on its way to being eliminated through a common invite system, lots of older, trivial bugs have been fixed, and the site, after a rough period, seems to be getting more stable. I’ll be focusing on other new developments in this weblog in the future, so stay tuned. ∞