arcs

This feels like blatant sensationalism to me.

This particular patent describes the process for 3rd party sites to tell Facebook about something the user did (new Open Graph API, anyone?), which subsequently can be shown as an ad to the user's friends, i.e. "Your friend blah has bought something on This Service, do you want to do so too?" (some peer context for ads, which facebook already tries to do for things like fanning pages).

This is quite different from the meaning implied by this post, which the first 2 quotes were addressing, that Facebook tracks and correlates browsing patterns of users across the internet without their consent.

You're quite right. This is why apps have a new permission dialog to show you exactly what gets shared, which you have to click accept prior to using it. As long as the app isn't facebook only, you can always use it without the facebook integration. and if it is, there will probably A facebook-free competitor you can use.

Correct me if I'm wrong, but it seems that while using the client-side auth flow does not prevent a malicious program from pretending to be another facebook app, it forces the malicious application to be downloaded and executed as it must be able to catch the redirect to a different url with the access token, which a web app cannot do.

Once you are downloading and executing a malicious native app, you're screwed anyways since it can do whatever it wants like read your cookies and hijack running applications... (I'm not considering java or flash applets, depending on how their security works this may still allow drive-by spammage as a legit app).

It does allow a malicious user to easily write something that impersonates a legit application, though it's limited to spamming his own account.

Content from spammy apps are hidden when the app is disabled. If you think about this it sort of makes sense: if the app is sending lots of crap without user consent, merely disabling an app does not remove all the crap it has already sent out.

I don't think the posted content are actually deleted though, they should be unhidden when the app is unblocked.