Question

Answer: Time to set your clocks ahead for Daylight Savings Time. *

Answer: Barbara Feldon’s birthday **

Answer: IFrame apps will be accessed through HTTP POST instead of GET.

That’s right kids, as Facebook has been telling us for some time now, your IFrame apps will be accessed from your customer’s clients by a POST instead of a GET. This is significant because it is most definitely a breaking change, e.g. one that has the potential to make your application stop working if you aren’t careful, so pay attention.

So why is Facebook doing this? Well, it has to do with a little something we call privacy. The problem is that a customer’s Facebook userid used to be passed in the URL (as part of a GET) so that the application could know which user a request was coming from. The problem is that subsequent calls would retain this userid in the HTTP Referrer header, and possibly allow third parties to get access to it. Privacy advocates rightfully have a problem with this, so Facebook looked for ways to fix the problem.

The solution to the problem is not to use a GET but rather a POST and pass the customer’s userid as a POST parameter. If all access happens over a secure channel (like Facebook now allows us to do) there’s no fear of exposing userids to third parties. Good solution, except for the fact that if your application expects a GET and receives a POST instead, you’re hosed.

So what to do if you have an IFrame application? Well, test it before Saturday comes lest things break. To do this, you must go into your application’s settings and enable the POST for Canvas selection.

Once this is done, Facebook will provide different HTML to the client’s browser so that your application is accessed through POST instead of GET. Be very careful though if your application is already live. If your application is broken by this change, then selecting this will effectively knock your app off of Facebook. So to be safe, register a test application and use that instead.

More technical information about this change can be found here. Facebook offers some simple solutions for how to do this migration on popular development platforms. There’s also some feedback from developers who’ve experienced some problems, so it’s a good place to start if you find problems yourself.

Good luck.

* Yeah, technically this happens on March 13, but better do it before you forget.

** We loves us some Agent 99 so much we won’t give away her age.

• Is it a good idea?
• Can I make a lot of money this way?
• How do I make a lot of money this way?

Now the process for starting a startup is a very widely written about topic, and that’s where you should probably begin your journey. However, there are some specific Facebook-centric issues that make a Facebook based startup a bit different. Some issues make life easier, some issues make life more difficult. That’s what we’ll discuss here.

When you create any type of software startup, there are 3 key roles that need to be filled.  It’s important to understand the role each plays to help you understand where the real challenges are going to be. Let’s take a look:

1. The Idea Originator
2. Software Development
3. Marketing/Sales/Strategy

The Idea Originator

The most misunderstood thing about creating a software startup is the importance and value of the original idea. Here’s the grim truth: The original idea is worth $0.00. Why? A few reasons: When you begin to validate your ideas and have them exposed to customers, the original idea will change. But more importantly, the value of the idea is far overshadowed by the value of the execution of the idea. There’s far more work and creativity required to do things like drive customers to your product and monetize the idea than to come up with the initial ”Million Dollar Idea”.

There’s even a whole scene about this in The Social Network where Mark makes an impassioned speech to the Winklevii’s lawyer about why they don’t deserve a piece of Facebook. He rightfully says that Facebook’s value came from all of the good ideas and hard work that went into the product. Since the Winklevii weren’t even capable of participating in this work, they deserve nothing. Surprisingly, Hollywood got it right!

Still don’t believe me? Read on …

Software Development

Everyone who’s ever done development in a big company knows that they’re the company’s crown jewels. Development is the engine that everything else revolves around, and so it’s the major contributor of value for your company, right?

Well sure, software development is really important, but is it the most important aspect? In a startup you also need to consider …

Marketing/Sales/Strategy

Sure you need a solid development team, but as a startup that’s only the beginning. Your big company had loads of luxuries that your startup doesn’t have like brand recognition, distribution, existing customers, money in the bank, and other things that make a difference. These things are key, and how your startup deals with getting customers and making money will determine your success. You can conjure up all kinds of fantasies for how you’ll make money, but in the end only a rational plan will do.

Here’s what you’ll need to think about:

Distribution

Distribution is how you’re going to get your product into the waiting hands of the teeming millions. In the olden days that meant producing a box and getting some shelf space at the computer store. But no longer, this is 2011. Since you’re building a Facebook app, you’re going to use Facebook to deliver your great product. Distribution problem solved, until …

Attention

Getting people’s attention is a much harder nut to crack than simply having a distribution strategy on Facebook. How you choose to do this is really important. Perhaps you’ll say “Of course people will pay attention to my product because it will be so great and unlike anything they’ve ever seen, they’ll come to us in droves, and the app will go viral.”

Bad plan. How many apps do you think people have access to on Facebook? Currently, it’s somewhere around 17 gazillion. And yes, according to Facebook Statistics, people are installing 20M apps per day, but that doesn’t mean they’re installing yours (actually most of those are probably going to the latest incarnation of *Ville). Getting people’s attention is becoming harder and harder. Simple virality is a thing of the past as Facebook is taking away many of the tools and tricks that developers used to use. The problem was that many of those developers used spammy tactics to boost their numbers and customers rightfully complained. Things that used to work no longer will, and anyone who thinks they can recreate the success of an application that went viral two years ago will be sadly disappointed.

Of course, you can always raise your app’s profile and get some attention by using Facebook ads. These ads can be targeted to whatever demographic you like, but they cost money. If you need a large user base to effectively monetize your application, then you’ll need to spend quite a lot on ads to get that necessary attention. You do have a big pile of money to spend on advertising, right? Hmm, didn’t think so.

How about free publicity, like being picked up by the Wall Street Journal, TechCrunch, or even Inside Facebook? Great idea, but how do you get that done? The fact is this is possible but will require some really great traction, perhaps some connections, and perhaps a bit of luck.

Monetization

How does one monetize their Facebook application? Good question. When you come up with a good answer, perhaps you can share it with the world and help out all of the developers milling around the Facebook Developer’s Forum asking the same question. In short, monetizing your Facebook app, even a good one, is not so easy.

You could try to monetize through advertising. Facebook even has an approved list of companies that will help you do this. Will you make money this way? Probably. Will you make lots of money this way? Probably not. It all depends on how popular the app is. You do have loads of users, right?

An alternative way to monetize is through some sort of in-app currency. Of course, Facebook has their hand in this after introducing the concept of Facebook Credits last year. Credits can be used to do things like purchase virtual goods within a game. Think the idea of purchasing virtual goods is stupid? Think again, it’s big business. The problem with in-app currency though is that your application must naturally require it. Whatever you use the currency for must meld with the idea of the app or it will just seem like a random idea bolted on as an afterthought. There’s no money to be made in bolted on ideas.

Of course, you can come up with other ideas for how to monetize your application, but that will require a large dose of cleverness. And remember, whatever you do must also stay on the compliant side of Facebook’s TOU.

Funding

At this point you may be noticing a pattern: when it comes to various tasks for your startup you can either come up with some really clever ideas, or pay some money. Since inspiration for great ideas may be low, you might think about looking for some funding to pay for what you’ll need. You might even be thinking, “Hey, I’ve watched Dragon’s Den or Shark Tank a few times. My ideas are much better than what I’ve seen there – surely getting some Venture Capital or Angel money won’t be so hard.”

Uhhhh… yes it will. Getting anyone to put money into your startup is incredibly difficult, even if you have some traction. What, you don’t have any traction yet? It’s going to be harder.

Now something you should know about is that there are some special circumstances for receiving funding as a part of the Facebook ecosystem as many investors are looking to find the next Zynga. Long ago (well, long ago in Facebook years) Facebook created the fbFund which was a funding source meant to help young companies in the Facebook ecosystem. Depending on when you were looking, this help could have come in the form of a grant or an investment that took a piece of the pie. Right now, it’s all academic as the fbFund as an entity no longer really exists.

When fbFund ceased to exist, fbFund REV rose from its ashes. This incubator program was run by Dave McClure of Founders Fund, and provided exceptional startups money as well as mentoring and great access to everything and everyone a startup could need. Sadly, this too seems to have lost its steam.

But that’s okay. There are sources for funding Facebook ventures popping up all of the time. You just need to take a bit of time to learn what they are. But more importantly, you need to plan for something that deserves venture funding.

Alternatively, a good dose of cleverness is always welcomed to create your own funding strategy. Give me 15 minutes and buy me a beer and I’ll tell you the story of how we funded the development of FriendRunner with mostly other people’s money. You probably won’t be in a position to do exactly what we did, but perhaps we can inspire you. Learn where the money is and the rules for how to get it. Throw in some clever ideas, and see what you come up with.

So, is it a good idea?

Absolutely, it’s a good idea to build a business around a Facebook app.

However, to be successful it’s critically important to focus on the right things. Zynga’s FarmVille didn’t just spontaneously happen. You can almost imagine early meetings where they discussed:

• How people will learn about the game
• How Facebook’s social aspects will be used so that players can suck their friends into the game
• How money will be made
• Alternative ways that money will be made
• How to tie the game into the real world
• Partnerships that can be entered into
• What to do if Facebook changes the rules in midstream (oh yeah, something important to think about)

You can also imagine that at the end of the meeting someone asking “But what will the game be about?”. After a bunch of blank stares, someone else throws out “You can pretend you’re running a farm or something.”.

Please leave a comment with your thoughts about starting a Facebook venture.

Facebook application development teams have always needed to register who was on the team with Facebook, so that those people could access, build, and test the application before it was released to the greater public. The problem was that belonging to the team was binary – you were either in or out, and only those that were in could access the pre-released app. However, all of the team members could view and modify the Application Secret, change the app’s URL, or throw everyone else on the team off. It didn’t matter what your actual job was, if you were on the list you had absolute authority.

The new Developer's Role dialog

Facebook has now changed that by allowing you to define the roles for the people on your dev team, and thereby limit what they can and can’t do. Here’s a list of the roles you can assign:

• Administrator – complete access to the application and all its settings
• Developer – can modify all technical settings and access Insights but cannot reset secret key, delete application, or add additional users
• Tester – can test the application in sandbox mode but cannot modify the application
• Insights User – can access Insights but cannot modify the application

This is great news, and is a step in the right direction to show that Facebook application development is growing up. I’ve done some consulting on testing Facebook apps, and have always been uneasy when I’ve been added as an applications “Developer”. I always felt uneasy about getting exposure and access to a company’s crown jewels, and asked to be taken off the list as soon as the gig was up. Now, I can be added as a “Tester” and gain access to only those priveleges that I need.

So let’s hope Facebook continues along this thread and provides more tools and services that acknowledge that Facebook application development is being done by teams that have real needs. For example, a real development team will want to stage any code changes before making them live (just like what Facebook does with the Beta Tier). Unfortunately, the only way to test this beta code is to register another application with Facebook so that the production and beta code can run in parallel. But registering a new application will cause a new Application ID/Secret to be created. This means that once the beta code is proven to be good it will have to be modified in order to be run as production. Bad bad idea, but it’s the only way that Facebook will let you do it. It would be nice if Facebook would provide some easy ways to deal with things like this, as well as other difficulties that large dev teams certainly encounter. Facebook – give me a call, I have lots of other ideas.

So what would you change to help your development team interact with the Facebook Platform more easily. Leave a comment to let us know.

My initial reaction is to answer “Huge!”, but I know that the question is really about quantity and not quality. Assigning numbers to these questions is often difficult, but the one “official” place to get statistics like this is Facebook’s Statistics page. Unfortunately Facebook updates the “big” statistics like the number of active users quite often, but the Platform stats has stayed static for quite some time. When I first began getting interested in the Platform two years ago, Facebook claimed that there were a million people worldwide developing for it. That number has stayed constant for a long time.

Until now. Facebook recently updated this page and now claims that 2.5 million of us are building on the Facebook Platform. However you look at it, that’s a pretty impressive number. They also claim that there are 20 million application installs done on the average day. Spread out over 500 million users, some quick math tells us that the average user is installing a new app once a month – also quite impressive.

Hopefully Facebook will update these stats a bit more often since they do show the viability for making a business case by working with the Platform.

• It’s a pretty good movie – Unfortunately, all of the hype and early reviews surrounding the movie screamed EPIC (think Casablanca, The Godfather, Pulp Fiction – movies that make you say ‘WOW’). It isn’t. It’s a  pretty good movie, well acted, good casting choices. That’s it.
• Is it really bad for Zuckerberg and/or Facebook? – A lot’s been written about Zuckerberg’s posturing about never wanting to see the movie, etc. C’mon, how long can you REALLY stay away from a movie that’s been written about you?? Apparently, for Mr. Zuckerberg et. al. the answer was 0 days as Facebook rented out an entire theater on the day of release, and Mark even showed up. My feeling is that even for a “hostile portrayel”, Zuckerberg doesn’t really look that bad in the movie. Maybe a bit abrasive, but loads of good qualities too. I don’t think it’s bad for him/them at all.
• Accurately portrays the real value of an idea - which is exactly $0.00. When Zuckerberg explains to the Winklevii that the only thing of value is the execution of the idea and not the idea itself, a whole lot of entrepreneurs around the world smiled and said “Someone in Hollywood gets it”.
• What added value did Eduardo Saverin bring to the table? – Much of the movie was from his point of view, or at least he was set up as the character you were supposed to have empathy towards. I spent the movie continuously asking the question “What did he really do of any real value??”. He wrote a check for $1k? C’mon, Zuckerberg in his Phillips Exeter Academy t-shirt and entrance into frickin’ Harvard could have found that money in lots of other places. In the end, it’s all about execution which was really about Mark. Eduardo – what exactly did you do? You WERE there in the beginning, took the risks, and should be rewarded in a grand manner. But don’t delude yourself and get greedy.
• What’s up with the Winklevii? - Okay, I know it’s a true story and all (despite the fiction), but are these people that bumblingly entitled? Really? Were they just there for comic relief? If someone should be embarrassed by this movie, look here.
• The big bad VC - Here’s a part that I thought was really unrealistic. When the big investment comes in and the corporate pie gets redistributed, the VC guy explains to Eduardo why Mark is being diluted, but he will end up with a bigger share. Given what was happening at that point and who was driving the growth/value (ummm, Mark + Sean) Eduardo should have run for the hills because something was obviously up. And, it was.
• Johns Hopkins! - I was probably the only one in the theater who appreciated this, but those exterior shots of “Harvard” were really JHU. Appropriate for those of us who think of Harvard as the “Hopkins of the Northeast”. When Mark comes out of Shaffer Hall and the camera pans left, I’m thinking “Lower Quad”!
• The motivations of geek entrepreneurs are sometimes deep-seated - The Erica character seemed so fictional and forced that I thought the beginning of the movie was kind of weak. But then, the last scene in the movie was the strongest. Not when Mark’s sitting alone in the boardroom trying to friend her. It’s the six seconds later when he refreshes his browser. I think what that scene says is very powerfully true. Most people look at people who start tech companies and think that the motivations are pretty obvious. Hollywood got this one right on. Again!

So what did you think of the movie? Leave a comment.

Now social networks are pretty worthless until lots of people are members, so it’s imperitive to make it as simple as possible for new members to recruit their friends and make them members too. Historically, this has been done by importing email address books, but now there’s a new way to find people’s friends: Facebook. Facebook even gives developers an API so that applications can programmatically get your list of friends – perfect for a service like Ping to ramp up its member numbers.

And alas, that’s what Mr. Jobs et. al. tried to do. This was quickly countered by Facebook playing their Terms of Use trump card to cut off API access to Ping and Apple. They rightfully claimed that a service like Ping would cause a huge load on their server infrastructure, and without a special agreement (as the TOU dictates) they had the right to cut Apple off.

So if you’ve been unsure as to whether Facebook really enforces their rules, the answer is yes they do, and they will act quickly. If your application puts undue strain on the Facebook servers you DO need to work with them to ensure that everyone remains happy. If you’re not sure about how much server interaction your application has with Facebook, you can test your Facebook application with a tool like FriendRunner.

No new FBML apps

Facebook will no longer accept new FBML Canvas applications by the end of the year. These are the types of applications that launched the Facebook Platform way back in 2007 (the same year that saw the iPhone and The Simpsons Movie). FBML apps have a lot going against them, most importantly is the fact that there’s really no good reason to write them anymore. It used to be that developers who wanted to write Canvas applications had to choose between FBML and the simpler but not-as-powerful IFrame method.

But IFrame has now caught up and surpassed FBML in terms of power, so there’s really no reason why a developer building a new application in 2010 should even consider using FBML. There’s also another issue at stake here. FBML Canvas apps require all of the data traveling between a user’s browser and the application itself to be routed through the Facebook servers. This is a legacy design from 2007 that was done to give Facebook more control, and allow for user authentication, but it’s costing Facebook a lot of money to run these servers that do very little but act as proxies.

Since new FBML Canvas apps no longer provide any real value, and they cost Facebook a lot of money to support, Mr. Zuckerberg et. al. would like to just sweep them under the carpet. Looks like that’s what they’re doing.

Parts of the Classic REST API are being deprecated

Whatever we said about FBML apps is doubly true of the Facebook “Classic” REST API. Born in 2007, it now looks like patches upon patches with no coherent vision. It’s been so far surpassed by the Graph API that Facebook never even bothered to mention any non-Graph API support for their very important location updates yesterday. It’s been clear for a long time that this API needs to be put to rest, and deprecating parts of it is definitely the beginning. We can all say Amen.

OAuth 2.0 will be required for authentication

Another nail in the Classic REST API coffin. OAuth 2.0 goes hand in hand with the Graph API that Facebook would like to push everyone towards. Enough said.

Facebook has historically moved very quickly, which contributes to a good part of their success. Moving quickly means getting things out to customers quickly rather than perfectly and dealing with the consequences later. Today’s Developer Roadmapupdate is a good example of how to deal with those consequences, and will ensure that Facebook developers will continue to have loads of things to do as Facebook continues to innovate.

Places seems to be all about “Checking In” to places, a’ la Foursquare, although Places doesn’t seem to have the concept of “mayor” yet. In fact, it really isn’t so clear what the relationship of Places to similar services like Foursquare or Gowalla even is. On the surface, they’d seem to be rivals, but representatives from these other companies were on stage at the launch event. Everyone seems to be scratching their heads and asking “Why?”. Inside Facebook seems to think that everyone will play well together. On the other hand, All Facebook seems to think that Facebook is simply playing the proverbial cat that toys with the mouse before eating it. We seem to agree – Facebook is several orders of magnitude bigger than Foursquare and really doesn’t need them. Bye…

In other relationship news, Facebook has chosen to use Bing Maps instead of Google maps for well, mapping. Not a big surprise here, Facebook’s relationship with Microsoft > Facebook’s relationship with Google.

Facebook also seems to be making a big deal about privacy for Places. As if we’re all worried about Facebook’s use of our private data … There are also some safeguards to protect you from your friends playing pranks by checking you into the local strip joint, the free clinic, or Country Kitchen Buffet.

The name that Facebook chose for this service is also very interesting. Places vs. Locations. When you think about it, it makes sense based on the service that Facebook is providing. This service uses places (Katz’s Deli) as their atomically addressable entity as opposed to location (40° 43′ 20.33″ N, 73° 59′ 14.41″ W) which is far more precise, but amorphous. Facebook is clearly shooting at getting people to check in and tag real places to help fill up their Open Graph. This choice also seems to encourage developers to build location-aware applications around places and friends (since that’s what Facebook is all about) rather than real-time precise locations that one would need for say a citywide gaming application.

Which brings us to developers, APIs, and testing, the Raison d’être of this blog. Facebook is exposing user’s checkins to applications that use the Graph API (sorry Classic RESTful API developers – time to change). Currently, the only thing applications can get is checkin info using one of the following APIs:

GET https://graph.facebook.com/[checkin_id]

Gives information about an individual checkin

GET https://graph.facebook.com/[place/Page/user_id]/checkins

Gives a list of checkins that this entity has made. BTW, why can a place perform a checkin??

GET https://graph.facebook.com/search?type=checkin&access_token=ACCESS_TOKEN

Seaches for checkins

We’re told that an API to create checkin information from an application is on its way, or actually is in Double Secret Beta. Look for it soon, and then things will begin to get really interesting.

In this case, the application was Facebook’s newly released Facebook Stories application. This application allows users to tell the story about how they got onto Facebook and how it changed their life. The application became overwhelmed and eventually crashed due to the load placed on it by …

… rabid Justin Bieber fans

That’s right, I just wrote the most unlikely string of words that can show up in a blog about technology. The crash was reported by Justin himself, ironically on Twitter.

 Kids, don’t let this happen to your application. Before deployment, load test it with a tool like FriendRunner.

Update

Ahhh geez! Okay, this will teach me to trust Justin Bieber. All Facebook is now reporting that the rabid Justin Bieber fans never crashed the Facebook Stories app. Instead, he was asked to remove the tab for the application from his page because he was using it to solicit stories about himself instead of using it for the purpose it was intended for (How has Facebook changed your life?).

Okay, I was fooled, but the original story did have a believable provenance. I originally heard it from Randi Zuckerberg, who after all is the sister of …. She got it from All Facebook, which is a reliable source of great FB information.

I apologize to you dear reader, and will now make the commitment that this blog will never ever disseminate any more news about Justin Bieber, regardless of what it is or where it comes from.

That’s right. Have you ever thought about how Facebook tests its own product? Well wonder no more as the good people at Quora have already asked that question, and Steven Grimm, Facebook’s test engineering tech lead has provided quite a good answer.

A few interesting take-aways:

• For a company that’s so grounded in PHP, it’s interesting to see that they’re so heavily invested in Watir, a tool from the Ruby world.
• “Facebook has no dedicated QA team.” Now for many people, this will come as no surprise. For others from a more traditional development background, no dedicated QA for something as large and mission critical as Facebook seems like a really bad idea.
• They don’t talk about load testing. From what we can tell, they probably don’t even do it. In a lot of respects, a proper load test of Facebook is probably far more trouble than it’s worth.