Sticky Notes

The Sticky Notes application contains a vulnerability that allows you to send a sticky note to any Facebook member, even if they aren't your friend. The application description suggests that this is not the designer's intention.

This can be exploited by writing a new note, and when you're asked to choose the recipients:

1. Enter the name of one of your friends.
2. Find the Facebook ID of the person you want to send the sticky to.
3. Substitute the form's recipient1 value with the ID of your target. (Firebug makes this easy.)
   

Too easy. Why are we letting amateurs write code for a social networking site of this stature?