This Post was imported from Open Parenthesis » wpbook and was written by John Eckman
Back in January, I got an unexpected flurry of WPBook support requests, and ultimately discovered they were the result of Facebook’s decision to allow people to browse Facebook in HTTPS mode.
As part of that change, Facebook introduced some new settings: “Secure Canvas URL” and “Secure Tab URL,” which would enable https connections throughout your Facebook application.
WPBook mostly worked with these two variables properly set (thanks to cshiflet for this patch).
Now, however, Facebook has announced they will require ALL apps to support https:
Today, we are announcing an update to our Developer Roadmap that outlines a plan requiring all sites and apps to migrate to OAuth 2.0, process the signed_request parameter, and obtain an SSL certificate by October 1.
What will this mean for WPBook users?
Unfortunately, my guess is that many WPBook users are not prepared to install an SSL certificate and accept https traffic on their blogs. (SSL certificates typically require that your blog have a unique IP address and cost extra at shared hosting facilities).
If you are unable to install an SSL certificate for your blog, and enable https based browsing of it, you may be unable to use WPBook after October 1, 2011 (or whenever Facebook decides to actually enforce this migration step).
More to come as we get closer to that date.



The Future of WPBook
By John Eckman on October 4, 2011
This Post was imported from Open Parenthesis » wpbook and was written by John Eckman
I’ve been doing a lot of thinking about the future of WPBook, and wanted to give a quick update. There are two key factors making me rethink the whole approach.
Pittsfield in the Near Future (from Cameo Wood on flickr, cc-by-nc license)
The first is a change Facebook has made, requiring SSL certificates for “all Canvas and Page tab applications.” (They announced this change earlier this summer, as part of the bizarrely Orwellian “Operation Developer Love” but it went into effect as of October 1st).
This is a problem because many WPBook users’ blogs are not available via https connections (including my own), and with this new Facebook change their WPBook implementation will fail, though how exactly that will be manifest isn’t clear to me yet (see below). Getting an SSL certificate for your blog isn’t an insurmountable task, but if you run your blog on cheap shared hosting, the costs of an SSL certificate (and the dedicated IP it requires) can be nearly as much as you’re paying for hosting! It’s also a task that the non-technical user will find horribly confusing.
The second is a recent report showing that:
The study results suggest that one of WPBook’s core functions – posting automatically to your wall (or the wall of a fan page, group, or application) whenever new blog posts are published – might not even be a good idea to begin with.
Facebook posts direct versus via 3rd party APIs (Edgeranker study)
If third-party automated postings get de-prioritized by Facebook, you might be better off using a Facebook share button and manually cross posting to Facebook each time you publish. On the other hand, maybe the reason third-party automated postings get less attention is because people post more
crapweak content that way. (If what the 10 most popular third-party apps post is lots of nonsense about games, thinly veiled ads, and self-promotion, maybe that is what the study results show people are ignoring – not that good relevant content posted by automated applications gets ignored).So, what’s the way forward?
The scenario I’m imaging is to split apart the functions of the current WPBook and make some portions optional.
WPBook currently does four main things:
I believe that the Facebook requirement of SSL only affects numbers 1 and 2 of this list. Even in the current WPBook, if you set “use external permalinks” then users never need know your application canvas page exists – they will just click on the links in wall posts and be taken to your (external) blog. Users without SSL certificate capability (or interest) could still get the benefits of 3 and 4 without having to worry about 1 and 2.
(It’s not clear to me right now how this would impact setup of WPBook-based applications. Facebook’s developer blog clearly indicates that canvas and page-tab applications will require SSL, but that would seem to imply other kinds of applications will not. Is it just a question of choosing a different application type during setup in Facebook? The whole app creation flow has changed so many times it is hard to keep track – maybe it is a question of unchecking some of the boxes in the dialog below?)
New Facebook App Creation Options
So the question becomes, is it worth it to keep WPBook trying to do 1 & 2 above?
Originally this was all WPBook did, and it seemed to me quite useful and distinct from any other Facebook related plugin. In essence you could use WPBook this way to drive a whole in-Facebook experience and never require (or even let!) users go to the blog outside of Facebook (though preventing them from accessing the blog outside Facebook would require some extra work on your part).
Open Parenthesis, as seen outside Facebook (left) and inside Facebook (right) - click for full size
But most users, it seems to me, were confused by this “Facebook view of my blog” approach. They wanted cross posting, and comments import, but didn’t like the application view of the blog (which required all users viewing blog content to consent to application permissions) or worried about it taking traffic away from their external blog.
Should I:
My concern with option 2 (“make it optional”) is just that configuring WPBook is already too complex for many users, given the variety of ways Facebook can be used and the variety of ways WPBook can be configured. Adding yet another set of variants (which would change not just what you have to set inside WordPress but also what choices you make when setting up the corresponding Facebook application) will only increase complexity and therefore support requests, which I honestly just don’t have the time to answer as quickly or extensively as I’d like.
My concern with option 3 (“fork the plugin”) is similar – more work for me, when I’ve had difficulty keeping up with plugin maintenance and maintenance of the instructions as Facebook constantly changes their application settings pages. If maintaining one plugin is difficult, maintaining two will be more so, even if they share some segment of the code base.
So option 1 (“eliminate”) is perhaps the simplest. (I say “perhaps” because I haven’t looked into it in depth yet – how hard will it be to untangle all the permission setting and checking logic, which is currently using a canvas page to display the current permissions? How will that change existing applications built using WPBook?).
But once that’s gone, what distinguishes WPBook from all the other Facebook posting plugins?
The fourth option would be to just declare WPBook obsolete. Existing WPBook installations work, if the user’s blog supports SSL. Currently if users browse Facebook in https mode, my own WPBook-powered applications just don’t work, because I don’t have SSL certificates for any of my blogs – just not worth the effort. But I’m ok with that.
It
may beseems that new WPBook users will find they can’t set up a Facebook application (necessary to use WPBook) without an SSL certificate, and if they want to have cross-posting and comment import they’ll need to use an alternative approach, but a quick search of the plugin repository suggests other options are plentiful.I’d love to hear from you all – especially if you are WPBook users (it’s had over 100,000 downloads, but I’ve no idea how many are in active use).
As always, comments (and patches!) welcome.
Posted in comments, facebook, import, Open Source, Plugin, Post, Syndicated, WordPress, wpbook | Tagged openparenthesis.org