You get a Facebook message from a friend, urging you to check out this video. You go there, and it's a YouTube phishing site (with your friend's facebook profile picture and name on it), which then urges you to update your Flash player. Don't do it — it fucks up your computer and then spams all your Facebook contacts (not sure exactly how it does that). But it's interesting that hackers are now using a supposedly "trusted" messaging platform such as Facebook to launch attacks

If the hackers' method sounds familiar — a third party attempts to get a user to click based on what looks to be the endorsement of a friend — that's because Facebook tried the same idea with Beacon last year. And it's trying it again with Engagement Ads, a new format coming this fall.

An example would be purchasing a ticket to a concert. Usually, a small subset of your friends would receive a notification of this action, however, in the future Cheryl Crow or Ticketmaster could pay for this to be distributed to your full friend group.

Kendall said Facebook will roll out the new plan in the next 6 to 12 months.

How's this different than Facebook's failed Beacon product? Not very. But we count at least three ways. For one, Facebook widgetmakers will be able to participate by serving the new Social Ads, though Kendall was light on details. For another: Marketers didn't pay to be a part of Beacon. They'll have to pay now. Finally, we're betting Facebook learned its lesson and will make it easy for users to opt in and out. We still say the best way for Facebook to turn its users into a team of product marketers 100 million strong would be to offer them a cut.

Brooks is employed by Seesmic, a videomail startup, so some of the "two dozen videos" she made could arguably be seen as all in a day's work. But the rest? The mainstream readers of the Times must wonder what people like Brooks do all day. One supposes they could sign up on FriendFeed to find out, but they, unlike the people of the Valley, have real jobs. Brooks, for her part, makes no apologies for her online chattiness: Her website sums up her career from a first-grade report card: "Cathy likes to participate in any project, so long as she gets to talk." In that, she has found a community of like minds.

"The question from our standpoint is, how you find signal in the noise?" asks Peter Fenton, a VC backer of FriendFeed at Benchmark Capital. That assumes that there is any signal. Such is the complaint of Michael Arrington, who bemoans his 954 unread Facebook messages, and demands that Facebook make changes to accommodate him. Has it ever occurred to Arrington that he is, in the argot of product managers, an "edge case"? Entrepreneurs desperate for coverage, and aware that he never reads email, are trying a new way to reach him — and Arrington, in his compulsive neophilia, actually tries out the new medium, for a while. He then quickly tires of it, and throws a tantrum. Catering to such a person's whims is no way to run a company.

Is information overload really anything more than a self-inflicted disease of the Valley? I doubt it. But to the extent it is, Facebook is far better poised to solve the problem than a startup like FriendFeed. The Times mistakenly reports that Facebook is playing catch-up in gathering up its users' online activities from across the Web. Balderdash. It's just done a lousy job of marketing its ability to do so.

The technology behind Beacon — the Facebook feature which ruined Christmas for some Facebook users, by revealing their online purchases, and has gotten Facebook sued for allegedly violating a Blockbuster video-renter's privacy — is now being used to report posts to Twitter, Digg, Yelp, and Flickr. Facebook CEO Mark Zuckerberg botched Beacon by presenting it as an advertising technology last fall. His recent spin that it was a technology meant for programmers, not Madison Avenue types, hasn't taken hold. It's likely Facebook will have to drop the Beacon name altogether before it successfully revives the technology.

But Facebook's News Feed is the most logical place to gather together the sum of its users' online activity. The users, after all, are already there. FriendFeed might make a logical acquisition for the likes of Microsoft, Yahoo, or most likely of all, Google (its founders are all ex-Googlers). But a radical paradigm for the future of communication? Sorry, Zuckerberg got there first.

(Photo by Brian Solis)

Facebook charged advertisers $300,000 a quarter for a sponsored group; its take from pay-per-click ads promoting Facebook pages is far less certain. But sponsored groups were sold by Facebook's small team of human salespeople; Facebook Pages ads are sold through an automated, self-service system akin to Google's AdWords.

Facebook's hire of Sheryl Sandberg, who oversaw AdWords at Google, was one sign Facebook would be betting on automated advertising. The abandonment of the lucrative sponsored groups is another.

Zuckerberg seems cocksure about the payoff from Social Ads. He has told employees that Facebook will bring in between $300 million and $350 million in revenue this year, a swift increase from last year, when revenues from sponsored groups sustained the company. He seems confident that change is coming. Perhaps so. But for the impatient young man, who will turn 24 in 12 days, will it come fast enough?

Beacon alerts appear in Facebook users' news feeds. That's valuable advertising inventory, where Facebook currently sells ads at a CPM, or cost per thousand impressions, of $5 to $7, or so we hear. Facebook's Beacon partners, however, get that placement for free.

It's understandable that Facebook would be cautious in charging for such a novel advertising medium. But it also displays a lack of confidence in Beacon that belies Zuckerberg's bluster. If he really believed in Beacon, why wouldn't he demand that advertisers pay for it? As it stands, Beacon has generated a ton of bad press for Facebook, the 60 Minutes interview included — and exactly zero million dollars of revenue.

• Why were Facebook employees allowed to access private user profiles for their own amusement? What have you done to stop that practice?
• Why did you bother to launch Beacon ads, and endure a roiling PR crisis over Facebook's disrespect for users' privacy, when you don't even charge for those ads?
• How badly, exactly, did you rook Microsoft when you renegotiated your ad deal and took their $240 million?

On that last point, there will be an answer soon. And on Valleywag, not 60 Minutes.

How hard could it have been for American Express, your partner in advertising bliss, to check off "female" on this order form? Answer: Not very. Next time, try a coupon for discount tux rentals at Men's Wearhouse.

5. Apple TV

Cable TV was going to be dead by Christmas. Instead, Forrester Research reversed its bullish forecast, placing Apple TV behind Jam Packs for GarageBand.

4. Googlephone

Valleywag editor Owen "Wrongway" Thomas repeatedly insisted all year that there was no Googlephone. He was almost right: Google's only built a phone software platform, one which launched with no killer apps or interface innovations. Don't drop your iPhone just yet.

3. Facebook ads

"Once every hundred years, media changes," Facebook founder Mark Zuckerberg declared moments before unveiling an overhyped ad system for broadcasting your purchases to your friends' Facebook pages. Even if Zuckerberg proves bizarrely right about media, he picked the wrong day. A hundred years from now, the history books — or whatever replaces them —will talk about YouTube instead.

2. DRM-free music

Cory Doctorow is finally happy, but face it: DRM-restricted music and video files weren't the repression of personal freedom that evangelists like Doctorow made them out to be. They're merely irritating when they don't play. Copyright crusaders are like medical marijuana advocates: You can't argue with them in theory, but in practice you know what they really want is the right to party hearty — or in this case, to download music not just free of DRM, but free of charge.

1. Tesla Roadster

The all-electric sports car really would change the mass public's attitude toward electrics. If only it would hit the road. The company missed its promised ship dates, and genius founder Martin Eberhard has been ousted. To be clear, Tesla's basic electric tech works just fine. Gossip says the motor is so strong that it breaks its gearbox. The company has acknowledged that its custom-made two-speed transmissions have proved a problem.

Special Achievement Award: Pownce

Never confuse celebrity with software. Videogenic Digg founder Kevin Rose announced a new company that would do something radically different. Lead developer Leah Culver topped an online beauty contest, despite posting dubious integer-rounding code to her blog. But to date, I still don't even know what Pownce is — NO DON'T TELL ME LA LA LA LA NOT LISTENING! Uncov writer Ted Dziuba explains it for me. As for Pownce's cyberlebrity status, Ted adds, "their daily traffic is now less than 2girsl1cup."

(Illustration by Uncov. Photo of Google Android by Mobile magazine. Photo of Leah Culver by Brian Solis)

Proposed Principles
1. Websites where data is collected for behavioral advertising should provide a prominent statement that (1) data is being collected for use in advertising and (2) consumers can opt out. Make this easy to do.
2. Companies collecting data should provide security for it consistent with laws and the FTC's data security enforcement actions.
3. Companies should retain data only as long as is necessary to fulfill a legitimate business or law enforcement need.
4. No bait-and-switch allowed. A company must keep promises that it makes about how it will handle or protect consumer data, even if changes policies later. Before a company uses data differently from how it said it would when it collected it, consumers have to say OK. Mergers count.
5. Collecting data for advertising purposes is only OK if consumers want to receive that advertising.

Still bored? How about a fun quiz? Count the number of ways Facebook's Beacon online ads would fail the FTC's proposals!

The woman in maroon is Facebook PR czar Brandee Barker. Here's what I want to know. Would Barker ever have agreed to being filmed for a video in which reporter Oliver Ryan and Fitzpatrick lay down slams like, "If I got the news that somebody had gone out and bought, say, a BMW 325, that would be great marketing." Or, worse, "[Facebook Beacon] might bring new types of advertisers into the Internet marketplace entirely." Harsh!

One in particular has become the object of derision among his supposed friends for talking up all of his purchases, including the price tag. Marcel Laverdet, a JavaScript expert whose prowess with hacking the social network, became so celebrated that Facebook finally hired him, posted the following note about a recent trip to New York, with plugs for the brands Apple, Timberland, and Peter Luger Steakhouse.

I was walking out of Peter Luger Steakhouse after spending $85 for my portion of dinner and the sidewalk had iced over. I was SMS'ing someone on my iPhone when I started slipping. Even $130 Timberland boots can't keep you from slipping in the ice. I fell but I didn't want to drop to my iPhone to break my fall with my palm, so I landed on my fist. That sucked.

Just click where the red arrow points.

Step 1

Step 2

Step 3

Step 4

That's the easy way. If you're really paranoid, technically adept, and have time on your hands, Lifehacker has a more complicated way involving a Firefox extension.

Zuckerberg says Facebook will add a setting so users can completely block the sharing of purchases made at third-party sites. This comes in addition to the opt-in changes already made. For some, the important thing is the apology itself. And for millions of Facebook users who haven't even heard of Beacon? They'll just keep on poking each other.

Bloggers like to compare the Beacon scandal to the mess Facebook made when it clumsily introduced its news feed last year. But let's be clear. The user revolts Facebook witnessed in September 2006 were on an entirely different scale — as in, they were much, much larger.

The day after Facebook announced the news feed, 587,715 members joined a protest group called "Students against Facebook News Feed." Keep in mind, Facebook only had 9 million members at that point. That means nearly 7 percent of all Facebook members joined the group in one day.

Compare that to the protest group MoveOn.org launched on November 20. Two weeks later, only 70,000 members have joined. That's only 0.1 percent of Facebook's 57 million active users protesting the product.

It's hard to quantify that because this isn't a short-term thing. If an event [like] this happens and our users get spammed then they trust the site less and they use it less, then that could affect us tremendously down the line, even if it doesn't affect it right at this point.

Whether or not Facebook sponsored the poll, which appeared on the site's San Francisco network today, executives at the social network should pay attention to the results. It asks whether users know what Facebook Beacon even is. If enough people answered "yes," in theory, CEO Mark Zuckerberg can point to responses and say "See, we don't need an opt-in policy. Our users already know what they're getting into." Well Zuck, so much for that theory. To date, 67 percent of respondents have not even the glimmering of a clue about Beacon — let alone that it broadcasts their shopping history to friends and frenemies alike. For Zuckerberg & Co., users' ignorance is not bliss.

CA's experts found that code embedded into Beacon-affiliated sites sends Facebook information about users' planned purchases. And if the user has ever selected "remember me" when logging into Facebook, the affiliate site sends Facebook the user's name.

If the member is logged into Facebook, a popup box will then offer the user an opt out. But CA says that by this point, private data has already been transmitted. Facebook executives dispute this claim and argues that the code only serves to check if the member is logged in. But Facebook CEO Mark Zuckerberg has been caught dissembling about Beacon before.

Facebook Update on Changes to Beacon No stories will be published without users proactively consenting

We appreciate feedback from all Facebook users and made some changes to Beacon in the past day. Users now have more control over the stories that get published to their Mini-Feed and potentially to their friends' News Feeds.

Here's how the Beacon changes work:

- Stories about actions users take on external websites will continue to be presented to users at the top of their News Feed the next time they return to Facebook. These stories will now always be expanded on their home page so they can see and read them clearly.

- Users must click on "OK" in a new initial notification on their Facebook home page before the first Beacon story is published to their friends from each participating site. We recognize that users need to clearly understand Beacon before they first have a story published, and we will continue to refine this approach to give users choice.

- If a user does nothing with the initial notification on Facebook, it will hide after some duration without a story being published. When a user takes a future action on a Beacon site, it will reappear and display all the potential stories along with the opportunity to click "OK" to publish or click "remove" to not publish.

- Users will have clear options in ongoing notifications to either delete or publish. No stories will be published if users navigate away from their home page. If they delay in making this decision, the notification will hide and they can make a decision at a later time.

- Clicking the "Help" link next to the story will take users to a full tutorial that explains exactly how Beacon works, with screenshots showing each step in the process.

These changes are in addition to those made earlier to improve the notifications on partner sites as follows:

- Users were sometimes moving away from a page before a notification could be fully displayed. We changed the process so that we confirm the full display of the notification before any information can be sent back to a user's Facebook account.

- The notification appears more rapidly and is more clearly displayed.

There has been misinformation in the market about some key aspects of how Beacon works:

- Participation in Beacon is free for all partner sites.

- Beacon only allows for the sharing of specific actions on the specific sites participating in Beacon.

- Beacon only has the potential to display actions to a selection of a user's friends through News Feed and on a user's Mini-Feed.

- Facebook is not sharing user information with participating sites and never sells user information.

As with all its products, Facebook will continue to iterate quickly and listen to feedback from its users.

Of course there's one main difference between Zuck and those two: redemption, or the lack thereof. Scared straight, Scrooge ended up buying the turkey for Tiny Tim and Bob Cratchit's whole family. And as for the Grinch, his tale ended with his heart growing three sizes that day.

Zuck? Well, we're still waiting for Facebook to confirm rumors that it plans to revise its Beacon ads policy. As the Ghost of Christmas Yet to Come might say, "..."

The point? According to our readers, you're a mean one, Mr. Zuck, you really are a heel. But it's not too late to change.

After News.com's Caroline McCarthy posted this evidence, Facebook responded to say it's listening to feedback and will soon make changes. Should be easy. From the looks of the screenshot, Facebook just needs to revert to an earlier version.