HoLyVieR

Well, that's interesting if Facebook server fails to deliver you the javascript API files, Color.com will only display you an empty page. Their application initial load depends at a 100% on an external website on which they have no control. If facebook has a downtime for that file, nobody can load their application. That's sounds like an awful idea.

Those hacks don't work on all platform (iframe for mobile is a good example) and often require you to have very particular setting on both sites. The only way for JSONP to work well on everything is to use script tag injection which only allows you to do GET request.

It would make sense in theory, but in practice you can't make POST request to a JSONP API. So that's why you have to stick to GET request.

Unless there is something I don't understand, how can this even be slightly reliable or useful, when everyone can read any key and write or replace any key at any moment ?

I have seen sites like meetup.com that disallow the "+" sign for spam reason. Instead of having proper spam detection and filtering they just added arbitrary rules like that.

Well you can always login with a BugMeNot account for Twitter (http://www.bugmenot.com/view/twitter.net). I don't have a Twitter account and it's working fine with that.

As developer it's even worst, it's possible to develop module for the Blackboard platform and I had once to develop a module for that. Be aware you will see the worst documentation ever, even if you have access to all of it. 2 websites for the exact same thing, in which you have a zombie forum, a wiki in which there are a lot of empty pages, a lot of document which repeat almost the same exact example, etc. The platform is in Java ... and they don't provide the JavaDoc. Good thing I was paid, otherwise there is no way on earth I would have torture myself to do that thing.

Note: I wasn't working for Blackboard, but an other company which had got a contract to do a module for the Blackboard platform.

Enforcing PIN style password for bank is not that bad, as long as they use other factor to identify you.

Have you tried searching for "site:pastebin.com mysql_connect" ? That's even scarier. There's people that do post their database password and username publicly.