The Social

What Twitter's homepage looked like before it went down on Thursday night.

(Credit: CC u07ch/Flickr)

Twitter stumbled again overnight on Thursday. But this time, it wasn't the work of the "fail whale," the cuddly cartoon personification of the site's excessive technical baggage. Rather, the site was replaced with a foreboding message from "Iranian Cyber Army" before crashing entirely, indicating that it had been the victim of a malicious attack that targeted its internal servers.

Co-founder Biz Stone posted a brief clarification on the issue late on Thursday night. "Twitter's DNS records were temporarily compromised tonight but have now been fixed," he explained. "As some noticed, Twitter.com was redirected for a while but API and platform applications were working. We will update with more information and details once we've investigated more fully."

At the risk of sounding like an evening-news anchor calling attention to exactly how dangerous your treadmill is or how many diseases you can get from the ball pit at Chuck E. Cheese, I think it's time to explore the question: Is it safe to use Twitter?

For one, Twitter's track record with security has been shaky at best. A security flaw this spring exposed the data of a number of employees and allowed a hacker to pilfer some internal documents. Several high-profile accounts, like those of Britney Spears, Ashton Kutcher, and CNN anchor Rick Sanchez, have been targeted individually. Twitter has been the victim of phishing attacks. Other hackers have proved that Twitter accounts can be set up specifically to corral botnets of infected PCs. And in perhaps the biggest incident of all, a politically motivated denial-of-service attack in August that targeted multiple social-media sites managed to cripple Twitter entirely.

Think of it this way: if Facebook, a far bigger and more mainstream site that's had concerns about user privacy splashed all over the news recently, saw its homepage replaced with a nefarious political message, there would probably be a fresh round of calls for CEO Mark Zuckerberg's resignation. Twitter's heavy users are, for better or for worse, accustomed to sporadic downtime and glitches. They're also less likely to ever visit the Twitter.com homepage, considering the service has so many points of entry--text message, as well as third-party apps for mobile, Web, and desktop. Users have become accustomed to logging into third-party applications with their Twitter credentials.

That, perhaps, makes the overnight hack a bigger concern. Even though it's unlikely that user accounts were compromised in this DNS redirect, it's yet another sign that Twitter's security operations have time and again proven weak enough that the service doesn't exactly seem watertight.

A political message, or just plain obnoxious?
On the other hand, we still don't know much about this attack and it may have been less sophisticated than some may fear. One, nobody's exactly sure yet who the hackers were. "Of course, just because a message saying 'This site has been hacked by Iranian Cyber Army' has been posted on a Web page does not necessarily mean that hackers from Iran are responsible for the defacement," Sophos security consultant Graham Cluley wrote on his blog Friday.

Additionally, Cluley said, the aim seems to have been to either get a political message through or to simply be obnoxious. "Fortunately there is no indication at this point that the page was carrying malicious code, and this attack appears to have had political motivations rather than being designed to steal confidential information from users," he wrote.

"It really looks like it was people were redirected to a 'hactivism' site," weighed in fellow Sophos analyst Beth Jones via e-mail. "There was no malicious code on the site claiming to be the 'Iranian Cyber Army' either. It looks like they just hacked the registrar to redirect traffic. So it's quite probable that none of Twitter's own servers were touched."

Another reassurance is the fact that Twitter simply doesn't have the kind of sensitive data that a Facebook or Google does. While it does have millions of mobile phone numbers stored to power its text-message app, not to mention archived private "direct messages" between users, Twitter does not index a whole lot more that isn't otherwise public. Facebook, for example, has many members' credit card numbers on hand (if they've ever used its "gift shop" feature), not to mention extensive personal data in profiles like addresses, birthdays, and family connections. Members who are still concerned about the security of their Twitter accounts can take the obvious step of changing their Twitter passwords to something that they don't use on their e-mail, Facebook accounts, or elsewhere--just in case.

Beth Jones says she has confidence in Twitter. "I wouldn't say their security is second-rate by any means," Jones said via e-mail. "As it stands, they weren't actually compromised, but I can see from a user point of view the questions and concerns. At Sophos we see a new site compromised every 3.6 seconds. That's easily close to 24,000 sites a day, and of those, the vast majority are legitimate sites that get hacked."

That doesn't mean that Twitter shouldn't start making it more clear that it takes security seriously. If the company, which is now beta-testing a "Contributors" feature that may pave the way to paid corporate accounts, begins storing financial information, we can only hope that their security operations are turned up a few notches. Or, ideally, an order of magnitude.

This post was expanded at 6:23 a.m. PT with comment from Sophos' Beth Jones.

Could the geolocation wars be the next browser wars? Maybe. There's a fresh $8.4 million in venture funding for Gowalla, a game-like mobile app that lets you "check in" to locations around the world, see where your friends are, and swap virtual goods along the way.

The Series B funding round, announced Wednesday, is led by Greylock Partners with contributions from Shasta Ventures, Maples Investments, previous investors Alsop-Louie Partners and Founders Fund, and individual investors Ron Conway, Kevin Rose, Gary Vaynerchuk, Shervin Pishevar, Jason Calacanis, and Chris Sacca.

Interestingly, at least two of Gowalla's individual investors--Conway and Rose--are also investors in Foursquare, another game-like "geo" app that lets you find your friends and collect "badges." And at least four of them--Conway, Rose, Sacca, and Vaynerchuk--have additionally backed location software company SimpleGeo, whose funding CNET first reported late last month.

This either means that there are some well-moneyed people in Silicon Valley who throw greenbacks around blindfolded, or that some prominent folks think there's room for more than one "geo" app out there.

Regardless of where the investment money goes, it's clear that geolocation is, after many tries and missteps, finally one of the hottest spots on the Web. Early players like Loopt and Brightkite are still around and kicking, but Foursquare and Gowalla's game-like interfaces have proven more press-friendly these days--not to mention more addictive among hardcore users.

Gowalla, available as an app on the iPhone and Android, was founded in 2007 but formally launched ten weeks ago (its iPhone app has been around since last spring). The company says it now has 50,000 users in 92 countries and logs 20,000 "check-ins" every day.

Foursquare, which launched at the South by Southwest Interactive Festival in March and which is rolling out its launch in packs of cities, says it has 146,000 registered users who have logged 3.4 million check-ins.

This post was updated at 10:47 a.m. PT with data from Foursquare.

An orangutan in the Vienna Zoo takes pictures that are uploaded to Facebook. No, she didn't take the self-portrait.

(Credit: Nonja's Facebook page)

She's like the Ashton Kutcher of the ape world: an orangutan in the Vienna Zoo now has a Facebook fan page to showcase the photos she takes with a digital camera. The orangutan, named Nonja, uses a Samsung ST 1000 point-and-shoot that automatically uploads the photos.

When this post was published, Nonja had over 9,000 "fans" subscribed to her page.

But there's a catch: coverage of the camera-toting ape in the U.K.'s Daily Mail explains that the camera has been modified to dispense a raisin whenever the shutter button is pushed. So Nonja is evidently more interested in tasty treats than in artistic endeavors.

The non-orangutan version of the Samsung ST 1000 was released this summer (though not in the U.S.) and is equipped with Wi-Fi, Bluetooth, and GPS.

Can't anybody tell that the fail whale is hungry?

(Credit: Flickr user Victoria Belanger)

Something has been rocking the boat over at Twitter, where stability issues on Monday afternoon caused the company to temporarily take down Twitter Lists, a popular and relatively new feature that lets members group Twitter accounts into categories.

"We began experiencing a very high rate of errors and we are working on the underlying problem," a post on the Twitter status blog read. It was later updated saying, "We are now recovering from this unexpected downtime. The Lists feature is temporarily unavailable as we diagnose the cause of the outage."

Many members had reported sightings of the "fail whale," Twitter's error message featuring a cartoon whale, earlier on Monday. It may have been more noticeable than usual because of the day's status as "Cyber Monday," a big day for holiday e-commerce deals--which in this day and age means plenty of people hunting on retailers' Twitter accounts for fire-sale promotions.

Obviously, amid all the seasonal shopaholism, somebody forgot to feed the whale.

An example of Brizzly's new tweet translation.

(Credit: Brizzly)

Web-based Twitter client Brizzly made a dual announcement Friday: first, it's opened up into a full public beta mode (previously, an invite code was required); and second, it can now translate tweets into your default language on the site.

To translate a tweet in Brizzly--which already expands links, videos, and photos posted to Twitter, creating a more visual experience--you can click on a question mark for an instant translation. This is interesting, as Twitter has made its first moves recently in launching translated versions of the service (starting with Spanish), meaning that there will potentially be many more non-English tweets flowing through the system. It uses Google Translate, so needless to say, it's not totally perfect.

Brizzly added Facebook Connect support last month.

The simple concept of having virtual-good payments in games sent directly to your cell phone bill has gotten a lot of buzz--and stirred up a lot of rivalry. One of the start-ups looking to pull this off, Boku, announced Monday that it has signed on a dozen new gaming partners, both a few based on the Facebook platform and some others that are either Web-based or desktop downloads.

The partner companies are Waves, Cie Studios, Cyberstep, GameDuell, IGG, King.com, NHN USA, Ntreev, Outspark, PerfectWorld, Snap Interactive, and Zoosk. Most of them aren't household names: they're game manufacturers, not the games themselves, and some of them are most prominent outside the U.S.

There are a handful of companies trying to grab market share in this space, but the two who have been most vocal about making inroads have been Boku and rival Zong, which last month announced that it would allow members to sync credit cards with their phone numbers, allowing for larger payments and putting the company closer to direct competition with the likes of PayPal.

Boku says it's sticking to the mobile-number-only strategy, choosing instead to ink more deals and emphasize its global reach: with the current round of partnerships, the company says it will have 200 million registered users added to its ranks (no word on how active they all are, or how much redundancy there is across games).

Additionally, Boku has made some infrastructure upgrades that it says will improve the user experience, including the ability to detect whether a phone number that has been entered is landline or mobile--and if mobile, what carrier it's coming from.

NEW YORK--You had two options if you wanted to hang out with Digg founder Kevin Rose at the Web 2.0 Expo conference this week: head over to the lobby bar of the trendy Standard Hotel on Monday night, where Digg was picking up the tab for several dozen of the city's blogger elite; or pack into Manhattan Center Studios on Tuesday night along with about a thousand other young, predominantly male New Yorkers for a live taping of Rose and co-host Alex Albrecht's "Diggnation" video show.

Geek heroes: Jay Adelson (left) and Kevin Rose in a screenshot from one of their regular 'Digg Dialogg' videocasts with Digg users.

Those are, after all, the two Diggs. There's Digg the company, the name that first put "social news" into the mouths of New York media both old and new, the BusinessWeek cover story that established the shaggy-haired Rose as digital media's poster boy, the start-up that was once talked about as a huge acquisition target for the likes of Current Media, News Corp., and even Google amid CEO Jay Adelson's coy insistence that it wasn't for sale. But then there's Digg the brand: haven for the wackiest of the Web, with a front page dominated by anything Apple, oddball science, insidery tech and politics news, and the latest YouTube sensations. It's a dual identity that seems to be tough for the industry, or the five-year-old company itself, to reconcile.

At the Web 2.0 Expo, both Diggs--and the tension between them--was on full display in a dual keynote by Adelson and Rose on Tuesday afternoon. And the executives were both vocal about the fact that Digg has got to change.

"We're about 40 million users today, (with) about 20,000 submissions a day going into the Digg system," Adelson said onstage. "It's certainly achieved huge things for us. It's what we've set out to do, but we have a ways to go."

Rose added, "We've pretty much stayed the same over the last couple years."

There's a revamped Digg coming, a complete overhaul using the Cassandra database management system, which was developed and then released as open source by Facebook. In the new version will be "instant Digging" that doesn't require registration or a login, better filtration of topics to fit any number of niche interests, and a "smarter" way to gauge story popularity so that both the number of "diggs" and the number of times a link was submitted in the first place are taken into account.

Adelson told CNET later on Tuesday, just outside the auditorium where hundreds of rowdy young Diggers were awaiting Rose and Albrecht to walk onstage for the live Diggnation taping (a co-production of Revision3, the video outlet that Rose and Adelson also co-founded), that this will arrive in the first half of next year. "I can't say with certainty when, because there are so many infrastructure components that have to come first," he said.

This talk of change and versatility is exactly the message that the San Francisco-based Adelson and Rose want to convey while they're visiting New York, the center of the global publishing industry. This is Digg the media company on parade, the Digg that picked up the tab for the cocktail-swilling media insiders at the Standard on Monday night; and this is the Digg that's taken a bit of a beating recently. True, its traffic isn't plummeting, and by most measures continues to grow at a decent pace, but as a news-sharing destination it's been eclipsed by both Facebook and Twitter.

Digg's once-gossiped-about valuation may have taken a hit simply because the market for social news has grown so saturated, and as a result the company is no longer a novelty. Take third-party Twitter app TweetMeme, for example, which takes the links shared all over Twitter in "retweets," and compiles them into something that looks an awful lot like Digg. Or the likes of Yahoo Buzz, which haven't proven to be as popular or ubiquitous as Digg but which proved that it's not particularly difficult to build your own social news service.

"It makes me very proud," Jay Adelson said of the Digg influence evident in TweetMeme buttons and, now, Facebook sharing buttons. He added, "I think that the sophisticated publisher understands the difference between sharing within a social network, sharing on Twitter, and sharing on Digg."

Influential, sure. But when it comes to making a lasting footprint in the media world, Digg hasn't yet been able to get past the common wisdom that the footprint in question will be from a beer-soaked Converse All-Star. And that's the Digg that was showcased on Tuesday night as Rose and Albrecht, both in trendy fitted plaid shirts, received a rock-star welcome for Diggnation.

More than a thousand people had showed up at the Manhattan Center Studios venue, a smaller crowd than the show's last taping in New York, but a company rep pointed out that the previous taping had been in the summer, and this one was on a school night. Someone in the audience excitedly waved a sign that said "WINDOWS 7 FTW!" (That's "for the win," in case you stepped in late.) Another sign read "I SKIPPED CLASS FOR THIS!" and still another, which Rose and Albrecht seemed especially proud of, was a green sign that read "GO HIPPIE!" with a massive, hand-drawn marijuana leaf.

Adelson says that the company's merry band of fanboys--yes, most of them are male--doesn't get in the way, strategy- or image-wise.

"Our core Digg enthusiasts frankly provide a tremendous amount of our feature ideas and feedback, and are the ones that we can count on to be there even when we screw up," Adelson told CNET on Tuesday night. "I don't think they hold us back. I think that's the power of the product."

Kevin Rose's essential Diggnation props: Mac laptop, open bottle of beer

(Credit: Revision3)

There have been some good signs. Adelson says that Digg's experimental advertising system, in which unpopular ads are penalized with higher costs ("We charge the advertisers more money when their ads start sucking," Rose explained in the Web 2.0 Expo keynote) have been a runaway success. The company also absorbed a Rose side project, Twitter directory WeFollow, which could have interesting implications.

Their mission is still precarious. The hordes of Digg loyalists propelled the company to fame, but they're known to be volatile: if they hate something, they'll make it obvious. In 2007, when Digg pulled down a number of news links in response to a cease-and-desist complaint (the links directed to instructions for cracking a digital rights management code in the now-defunct HD DVD format), avid users flooded its system with even more links to the code. Digg admitted defeat, and restored the censored links. Earlier this year, when a new URL-shortening feature called the DiggBar garnered a negative reaction, the company made some significant modifications. If they don't like the yet-to-be-unveiled Digg revamp, it could get really ugly.

But perhaps the most difficult part of Digg's dual-identity wrangling is the fact that the company's executives and figureheads really do seem to have an affinity for its mischievous roots. Take Tuesday night, when a few excited audience members at the Diggnation taping started waving around the pink tickets they'd received from local cops for downing booze while waiting in line outside to see the show.

"Open container in line? That is awesome!" Rose exclaimed, reaching for one of the tickets and displaying it in front of the crowd.

Co-host Alex Albrecht chimed in. "You should get that framed!"

Perhaps in a sign of how the plague of social media has numbed us all to the value of legitimate human connections, the New Oxford American Dictionary has picked the verb "unfriend," or "to remove someone as a 'friend' on a social networking site such as Facebook," as its 2009 Word of the Year.

At the very least, it's a testament to the ubiquity of Facebook, which now has well over 300 million members around the world.

Facebook itself takes the process of "friending" and "unfriending" very seriously. It once sent warning notes to players of a third-party game called PackRat because it encouraged players to amass huge friends lists (good heavens! they're polluting the social graph!), banned a Burger King ad campaign that let members "sacrifice" their friends to get a free cheeseburger ("Friendship is strong, but the Whopper is stronger"), and still puts a cap of 5,000 on personal profiles' friends lists.

Last year's Oxford word of the year was the decidedly less mainstream "hypermiling."

A correction was made at 9:25 a.m. PT on November 21. It was players of PackRat, not PackRat itself, that were threatened with account suspension.

For Madison Avenue, Facebook just got a little less free.

Last week, the massive social network announced that brands, advertisers, and marketers that want to run contests or sweepstakes on its platform have to go through an approval process first.

Getting that approval could be a new revenue stream for Facebook: according to multiple sources in the marketing industry, they're being told that running a promotion in a Facebook application or "fan page" requires buying ad space too.

It's pricey. The minimum ad buy is $10,000 for 30 days, using Facebook's self-service advertising system, according to documents seen by CNET, or $30,000 for 30 days of Facebook home page ads. Priority in the approval process will be scaled, based on how much advertising space has been purchased. It's a move that one marketing industry professional called, in perhaps a bit of hyperbole, "a little Death Star-ish."

A Facebook representative declined to confirm and said the company did not have any comment beyond official documents released on its Facebook Marketing Solutions page.

Let's step back. Cracking down on contests and promotions might seem draconian, but it's actually important for Facebook: the U.S. state and federal laws that govern sweepstakes are extremely complicated, and by allowing only approved contests, Facebook is making sure that its bases are covered.

"Any promotion that any brand, product, or company would run has to have a terms of service against it," said Gunter Pfau, CEO of the Stuzo Group, an agency that has developed numerous Facebook contests and sweepstakes for clients. "Also, depending on the prize value, they need to be filed with various state regulatory agencies."

What, exactly, is new for contests? If a brand is running a contest on its fan page, it has to be handled through an embedded, separately developed application--not, for example, in the page's "wall." Promotions also can't involve Facebook users manipulating their user photos or status messages specifically for the contest.

Legal experts agree that this is necessary. "The (new Facebook) guidelines really cover only a narrow subset of promotions, specifically sweepstakes, contests, and similar competitions," explained Thomas Williams, a partner at the Chicago law firm Howrey, who specializes in trademark law. "That type of contest or promotion is governed by a myriad of state and federal regulations, so what I think Facebook is attempting to do here is merely shield itself from liability that arises out of its users' potential violations of these laws."

Williams continued: "I think it's a prudent and reasonable step on Facebook's part. There are lawyers who specialize in sweepstakes law, and there really are a lot of twists and turns to it."

One thing it'll also do, Stuzo Group's Gunter Pfau explained, is keep dishonest campaigns and promotions off the Facebook platform. "I think it's great news for consumers," he said. "I think what Facebook is doing is really laying these guidelines in place for companies to protect consumers more."

But what about the new ad spend requirements? Facebook has historically pitched its developer platform and fan pages as a free way for advertisers and marketers to tap into the power of "the social graph"--its 300 million-plus active users and their connections to one another. And while it's clear that the company sees these free pages and applications as a stepping stone for ad dollars--Chief Operating Officer Sheryl Sandberg, for example, regularly gives Madison Avenue talks about the company's "engagement ads"--it doesn't have a long track record of requiring advertisers to pay for something that used to be free.

"It makes sense for Facebook, but (it's) a little discouraging to advertisers," commented Alisa Leonard-Hansen, who holds the title of social-media evangelist at digital-marketing firm iCrossing. "Facebook is continually trying to discover new ways to monetize, and they picked up on the trend that advertisers were using their pages to run contests and other promotions. I think Facebook was looking to be able to benefit from this marketing trend."

The ad spend requirements, too, could be considered partial compensation for the new human resources required in Facebook's approval process. Each company running contests on Facebook now has a designated advertising sales representative, and fan pages will continue to have to be policed for potential violations of both advertiser regulations and sweepstakes law.

There might not be a lot of friction as the new regulations go into effect. Companies that don't run contests on their Facebook fan pages or applications won't be affected. Even some that do, especially small-scale fan pages that could easily go unnoticed by Facebook, won't have to change much. "Of course, there are going to be savvy marketers who skirt this and run (contests) under the radar," Alisa Leonard-Hansen said.

It really goes without saying the obvious: this is Facebook's service, and it can do what it wants with it. That doesn't mean marketers will stop grumbling. As one put it in a phone call to CNET, "This is another example of Facebook saying, 'Sorry, eat it, you've got no choice.'"