Despite being individually wonderful, fresh-popped popcorn and hot coffee don’t go together at all. Bye bye, popcorn.

Jia Shen and Raymond (?) from RockYou! talking about launching and distributing your FB app. RockYou are the folks who brought Werewolves, Vampires, and SuperWall, as well as GlitterText.

Widgets for MySpace, Bebo, Friendster, are all like clothing – self-expressive, no user interaction.

Facebook supports this, but also offers user engagement. It’s like a MMORPG vs. the single-player games of the others.

Networks with engagement gives you ~7x more distribution.

(He showed quantcast web statistics)

RockYou is helping monetize now by offering an ad network on FB, both for use by developers to monetize their apps as well as seeking good matches between their apps and advertisers (e.g. Zombies & Resident Evil movie)

New application setup page walkthru:

Add FB Dev app, create a new app, *make sure it’s checked on to allow folks to add it*. You can limit that to developers only further down the config.

Picking a good name: expressive, short, and catchy.

Callback URL is your server.

Interaction is: FB App page -> your callback URL -> returns text (FBML) -> FB puts it on the page

You can do iframe within FBML, so there’s little advantage to doing iframe instead of FBML.

Developers of your app will be able to see debug messages (as comments in rendered HTML).

Post-Add URL: where you go when someone adds the app. Default is profile page; this is a great opportunity to move them into your app’s design flow – help them take the next step

Post-Remove URL: Isn’t called in user space, but at backend.

Adding left vs. right: right side’s wider, left will likely place you higher.

*BE SURE TO SET DEVELOPER MODE* They have a dev app with 300K users because they forgot. You don’t want to deal with this.

Side Nav URL: set this! users like to nav to the app from there; if you leave it empty, you don’t show up.

Private installation is good for dev mode – don’t announce you’re adding your test/dev apps.

Make sure to have a banner/splash/screenshot for the app when you’re ready to submit it. It shows on the profile page.

insert much configurational fun as we all make dirs on the rockyou dev server. If you want to see what my “app” is up to, it’s here.

Each request sends the following pieces in the session:

  • fb_sig_session_key: session key (hopefully infinite)
  • fb_sig_user: uid
  • fb_sig_added: boolean 1/0, is it added
  • fb_sig_time: current time, float sec since epoch
  • fb_sig_friends: comma sep’d list of uids

The wiki is a treasure trove. Keep it open all the time.


You need to know you’re tuning your app in the right direction. Here’s some good stats to track:

  • Infinite Sessions
  • Page Views
  • Installs/Uninstalls
  • Invites Sent/Opened

If you have infinite session key, you can look at their info for as long as you’re installed. Allows you to regen their profile regularly, etc.

Use Google Analytics, Quantcast to capture stats.

Not sure if FBJS allows Google Urchin yet.

Google Analytics doesn’t manage to capture good stats (gets bad total uniques/page views) sometimes if you’re doing “fancy things” where Quantcast is very straightforward, brute-force and rock-solid reliable.

Tracking via post-add URL: how are you getting installed? day-to-day growth is important for sensing how your user community is reacting. Set “next” parameter (&next=…) and send to something that reacts dynamically to that param.

Tracking via post-remove URL:  gets called at uninstall; just be sure you’re being pinged by FB and catch the user id. You don’t have to ditch their info, but note that they’ve uninstalled.


You must have a dev app and a production app.

FB Dev blog explains how to make test accounts which won’t be removed.

Use cases: They’re looking at your app but haven’t added; they’ve added; they’re looking at someone’s profile and have/don’t have your app, …. Be sure you consider them all.

Look at HTML for debug info; it shows you everything FB set and sent in a comment.

Firebug: use the console to see the AJAX calls to be sure that the request went out right and got a good response.

Test on all browsers, including IE 6 & 7. Use Fiddler (Windows only HTTP debugging proxy) to see all the calls in IE.

Be sure your browser isn’t caching content you expect to be updated.

MS Script Debugger for debugging JS. Allows you to break into JS and step thru.

File logging, email notifications in your app: you’ll see invisible errors and track production issues.


FB gives multi-selector for picking your friends.

fb:request_form tag gives you an easy

After the user clicks the action in invites (either to do it or skip it) you can take care of them (preview, thank, etc). FB tells you who’s been sent an invite (friend_ids)

Profile FBML is cached at FB, as are images. You can use API to invalidate cache data.

FB:Refs are also cached.


FB carries the bulk of the load. Usually scaling is a DB issue on your side.

Amazon EC2 and S3 are very useful for doing big FB apps.

And then we ran out of time. Jia and Raymond ran a tight session. It kept moving, they actively made sure everyone was moving along well, and I actually got an app running. They kept it really simple, from Hello World to some basic essential concepts, no DB, nothing unnecessary. An ideally structured hands-on workshop.

blog comments powered by Disqus


07 October 2007


facebook hacking social networks