On June 6, Facebook announced a set of “new” policies forbidding various forms of deceptive behavior by apps. Many of the tactics that Slide & RockYou have employed to build their forbidding positions on Facebook would be outlawed in these new policies. What’s astonishing, however, is:

1) most of these tactics were already violations of the rules. Instead of creating new rules to clarify the old rules, why not simply enforce the rules?

2) the new policy declares a potential system for punitive action, including temporarily handicapping an app or even permanently removing it. The big question is, what happens to the big guys who became big by breaking the rules for the past year?

The new rules take effect on June 17th, three days from now.  Might this actually succeed in cleaning up Facebook?  Will Facebook actually take action against the biggest violators?  Don’t hold your breath.

Ok, we’re now officially moved to wordpress.com. For those of you who patiently waited through the old system, this works much nicer as we’ve been growing in readership and contributors. I heart WordPress. Fortunately it was very easy to import the existing content. Please change your bookmarks and RSS readers!

The latest move by Slide is to compete directly with Facebook’s user profile page. Having successfully built the fastest-spreading viruses on Facebook’s platform, Slide is now using its position of power to build its own user profile pages (built on top of Facebook’s data), but with tactics to keep the traffic within the Slide apps and driving greater spread of Slide.

Until recently, the Top Friends module on user profiles was a useful navigation tool, providing a handy set of links from your profile to those of your top friends. Now, however, the new Top Friends module links to Slide’s alternate profiles for each of your friends, filled with Slide’s own actions (eg Moods, FunWall, Drinks, etc) instead of Facebook’s (Status, Wall, Gifts, etc).

If you try to click to see a user’s profile and you don’t have Top Friends added yet, instead of seeing the user’s profile you’re instead prompted to add the Top Friends application yourself. What’s worse is even if you are a Top Friends user, clicking on a friend’s picture will prompt you to invite that friend if they don’t have Top Friends installed, and will then simply redirect you back to your own Top Friends page.

How does Slide’s userbase react to the change? It’s no surprise.

Can Facebook do anything about it? Sadly, no, because it’s not breaking the rules. Besides, when was the last time they did anything to enforce the rules! The user reviews clearly tell a story (20 pages of non-stop complaints), but if history is any indicator, Facebook will probably find a way to reward this application.

Here’s a neat trick from RockYou’s quiz application, Likeness. The basic flow is that you get invited to take a quiz, you click to choose from 10 answers, and then submit your answers.

However, check out the sneaky little checkbox in the upper right area, a space normally occupied by banner ads that you’ve learned to ignore. If you leave that box checked (it’s checked by default), RockYou proceeds to spam all your friends on your behalf, notifying them that you’d like them to take this quiz too. Nifty, eh? That’s probably how you got invited in the first place.

Facebook recently announced and rolled out new limits on apps’ ability to send email to their users.

The idea is – if a lot of users are clicking the links to disable email from your app, then your emails will have the disable link moved to the top. Also, apps are getting limited on how many emails they can send on behalf of each user.

I see two problems with this:

1) Limiting how many emails apps can send on behalf of each user doesn’t actually do anything useful. When Joe Average accidentally spams all his friends while using Likeness, FunWall, Superwall, etc, these apps are sending each recipient an email using the RECIPIENT’s credentials. Even if these apps are limit to send “max 1 email per user”, they can still spam all of Joe Average’s friends. That sort of spam can’t be stopped using technology unless you take away from apps their ability to notify their own users, which, of course, would be ridiculously over the top. Why doesn’t Facebook just ask the bad apps to shape up or kick them out?

2) I am signed up for emails from FunWall, TopFriends, SuperWall, Likeness, and many more of these spammier apps. All of them have the “disable emails” links at the bottom of their email. If those apps aren’t considered spammy enough, then something is wrong with Facebook’s filter. What I think is happening is they simply changed their email sending logic to trick Facebook’s filters. I heard from another app developer that the smart spammy apps are either emailing only to younger users, or emailing their active users even more than before, or stuff like that just to mix it up and change the spamminess reading. Just because Facebook’s measurements think these apps are less spammy doesn’t mean the userbase agrees. Just look at the application review pages (previous blog post).

Below is a screenshot of user reviews of Facebook’s most “popular” application, FunWall (by Slide). The same sort of reviews also apply to the number 2 application, SuperWall (by RockYou). It begs the question: how can it be that something so universally disliked can also be so “popular”?

How is it that Facebook allows an application with almost unanimous 1-star ratings to achieve the number one spot of popularity? It certainly isn’t for lack of trying to build technology to reduce the spamminess of these applications. Facebook has changed the rules of its platform almost two dozen times in the last 6 months, and yet the spammiest applications can continue to spam away at Facebook’s userbase, undermining the Facebook user experience and trust, and devaluing Facebook’s much-hyped platform.

Why? Because each time one of these apps finds an exploit to grow at ten times the pace of other apps, Facebook knowingly lets them get away with it. The exploit may be stopped, but the application keeps the spoils.

As one venture capitalist confessed to me: “Imagine a stock market where illegal/insider trading isn’t punished: Each time somebody is caught insider-trading, they are asked to stop, but they can keep whatever money they took. Would that market see more illegal and insider trading, or less? That is the world of Facebook Platform.”

It’s no surprise that the most “popular” applications are those who have developed the greatest expertise at breaking the rules. But what is surprising is that Facebook has watched this story play itself out, over and over again, dozens of times, without recognizing the pattern.

Facebook’s profile redesign appears to be a massive flushing of the Platform ecosystem, effectively removing all application boxes from user profiles. According to Facebook: “up to five profile boxes can appear on the About tab… we aren’t providing a tab for all applications”. In other words, nobody can have more than 5 application boxes ANYWHERE on their profile?

Is Facebook reconsidering the value of applications to their overall user experience? Clearly the rise to power of spammy applications has made the Facebook experience worse, not better; it may even be part of the reason behind the recent slowdown in Facebook’s growth.

Instead of finding new policies to reduce the spamminess of the abusive apps, Facebook is choosing a more all-encompassing change, a dropping tide that will sink all boats: simply removing applications from user profiles. The net effect: a giant instant drop in visibility and traffic for all applications. On the plus side, for users who dislike applications, this will make user profile pages much simpler, cleaner, and faster.

However, what happens to the spam messages and notifications from applications? As long as FunWall and SuperWall retain the ability to send email or notifications to their unfairly-gained userbase, and as long as Facebook allows deceptive buttons like “Post” or “Forward” that are ostensibly synonymous with “send-to-all-my-friends,” absolutely nothing will change.

In fact, in a world where apps receive less traffic from clicks on profile pages, they will instead focus their efforts to get even more traffic via these spammy methods.

Well, it’s a great thing that Facebook is finally preventing the spammiest of games and scams like “invite all your friends to get poker chips”. This is among the first times we’ve seen Facebook issue policy to fight abuse (as opposed to trying to come up with clever technology). Go Facebook!!

Really, it’s great to see actual policy. In the past the Facebook tech nerds seem to have won the argument, i.e. “We can only police things with technology. Once we have 10 million app developers on this awesome cool Platform I wrote, how can we police stuff scalably?”

It appears as if there is a new Voice of Reason at Facebook, i.e. “Um, with all the crappy spam in the Platform we’re not going to see 10 million app developers anytime soon. Besides, the top 10 spammiest apps are probably 80% of the problem, let’s just police them, that will take 1 manager and a few admins, and be much easier”

Hooray for Mr. Voice of Reason, whoever you are. The only missing piece – why not publicly punish the most abusive of these spammers? Take away their notification privileges altogether, or simply remove them from the Platform ecosystem, and let them serve as an example so others don’t try to find new loopholes!

Seriously, the good applications in the world **WANT** to see a bad, scummy app get punished and wiped out of the system.

Yay! Two months after we documented this exploit, Facebook has finally announced that you cannot issue newsfeed stories on behalf of recipients of an action.

So if you have been wondering why your profile minifeed has a dozen stories saying “Jack received a video”, “Sally received a message”, or “George was invited to a quiz”, all things that YOU didn’t choose to do, well that’s about to end. You also will stop seeing newsfeed stories like “23 of your friends received FunWall posts” (which really means, one of your friends accidentally spammed 23 others of your friends).

This is great news. The sad news is, as usual, the spammy apps that doubled their userbase using these tactics will of course continue to stay on top.

Thousands of variations of this chain letter have been spread through millions of FunWall/SuperWall users, and probably contribute to almost a billion different “posts” that users have sent or received from each other.

It’s unclear who originates these posts. What’s clear is that Slide and RockYou are benefiting tremendously (and knowingly) from many, many, many variations of these messages. It’s great when you can say that your users are to blame for spamming each other, especially when it helps you grow to over 20,000,000 users.

The most common example of this chainletter is this one: “click Forward to see who views your profile the most” – this message is mostly seen on FunWall, and has probably alone seen a hundred million “sends”:

In general, this style of message (“click Forward to see what happens”) is now appearing in many many variations, some involving nudity and other obscene images to urge users to click Forward, only to realize that they have spammed all their friends. Screenshot from SuperWall: