Path is a lovely app. It pushes all the right buttons. It's mobile, it's tactile, it's personal, it's full of people we love and moments that matter to us. It makes us feel good. It's got all the greatest hits a post-Facebook social app should have. It's also free.

"Facebook will always be free," it tells us, so free is now the standard. Free apps are expensive, though; we pay with our data. Whenever Facebook or Google messes with our privacy, this is the cost of doing business for free. Path is no different. It's already using our personal data in ways we didn't expect. Arun Thampi discovered today that it uploads the entire iPhone address book to its servers. Surprised? Don't be.

Sponsor

Thampi was using a cool new tool to observe Path's API calls, just out of curiosity. The first thing that surprised him was a POST request to https://api.path.com/3/contacts/add. When he looked into it, he found that the entire address book - names, email addresses, phone numbers, everything - was being sent to Path's servers. He created a new Path and duplicated the results.

It's a secure exchange of information between Path's servers and your phone, and it's not necessarily doing anything flat-out wrong with the information. But Path never asked its users if it can do this. It may be using our contacts for the benefit of our user experience, for finding friends on Path, for example. But we need an explanation.

Why didn't we know about this until an enterprising hacker stumbled over it by accident? Is this a sign of how Path will treat user data in the future? What do Path's adoring users do now? Well, they should get used to it. This is the price of free.

We've reached out to Path for comment, and we'll update once we hear back.

All I want @Path to say is "Oops, our mistake. We'll update the app and our servers to keep only hashes, and be opt-in. We're sorry."

— Matt Gemmell (@mattgemmell) February 7, 2012

UPDATE 11:53 a.m.: Path CEO Dave Morin replied to Thampi's post in the comments:

"We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends and family join Path. Nothing more.

We believe that this type of friend finding & matching is important to the industry and that it is important that users clearly understand it, so we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval."

Translation: We did it first, and we'll ask you for permission in a little while. Also, this makes clear that Path uploads Android contacts as well.

Developer/blogger/legend Matt Gemmell raises three questions missing from Morin's explanation:

"1. Why are you uploading the actual address book data, rather than (say) generating hashes of the user's email addresses locally, then uploading just those hashes? You'd be able to do friend-finding that way, and similarly if you uploaded hashes of all email addresses in the user's address book, you'd be able to do your notifications of when a friend joins. At no point would your servers ever need to see the actual email addresses or phone numbers from our contacts.

2. Why wasn't this an opt-in situation to begin with? Isn't that against Apple's own T&Cs?

3. How can we have our contact information deleted from your servers, if we wish to do that?"

We'll see how Path responds to those eminently reasonable questions.

Are you using Path? What do you think about this news?

Path is a lovely app. It pushes all the right buttons. It's mobile, it's tactile, it's personal, it's full of people we love and moments that matter to us. It makes us feel good. It's got all the greatest hits a post-Facebook social app should have. It's also free.

"Facebook will always be free," it tells us, so free is now the standard. Free apps are expensive, though; we pay with our data. Whenever Facebook or Google messes with our privacy, this is the cost of doing business for free. Path is no different. It's already using our personal data in ways we didn't expect. Arun Thampi discovered today that it uploads the entire iPhone address book to its servers. Surprised? Don't be.

Sponsor

Thampi was using a cool new tool to observe Path's API calls, just out of curiosity. The first thing that surprised him was a POST request to https://api.path.com/3/contacts/add. When he looked into it, he found that the entire address book - names, email addresses, phone numbers, everything - was being sent to Path's servers. He created a new Path and duplicated the results.

It's a secure exchange of information between Path's servers and your phone, and it's not necessarily doing anything flat-out wrong with the information. But Path never asked its users if it can do this. It may be using our contacts for the benefit of our user experience, for finding friends on Path, for example. But we need an explanation.

Why didn't we know about this until an enterprising hacker stumbled over it by accident? Is this a sign of how Path will treat user data in the future? What do Path's adoring users do now? Well, they should get used to it. This is the price of free.

We've reached out to Path for comment, and we'll update once we hear back.

UPDATE 11:53 a.m.: Path CEO Dave Morin replied to Thampi's post in the comments:

"We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends and family join Path. Nothing more. We believe that this type of friend finding & matching is important to the industry and that it is important that users clearly understand it, so we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval."

Translation: We did it first, and we'll ask you for permission in a little while.

Developer/blogger/legend Matt Gemmell raises three questions missing from Morin's explanation:

"1. Why are you uploading the actual address book data, rather than (say) generating hashes of the user's email addresses locally, then uploading just those hashes? You'd be able to do friend-finding that way, and similarly if you uploaded hashes of all email addresses in the user's address book, you'd be able to do your notifications of when a friend joins. At no point would your servers ever need to see the actual email addresses or phone numbers from our contacts. 2. Why wasn't this an opt-in situation to begin with? Isn't that against Apple's own T&Cs? 3. How can we have our contact information deleted from your servers, if we wish to do that?"

We'll see how Path responds to those eminently reasonable questions.

Are you using Path? What do you think about this news?

In 2008, a UK-based Adobe Acrobat engineer remarked, "I believe in striving to minimize the use of paper, but I do believe that we will probably never reach a position where paper is eliminated from our workplaces." This morning, his predictions were clearly confirmed by a study published by the information professionals organization AIIM.

The study shows that while the exchange of PDF files as e-mail attachments has reduced the volume of paperwork traded between IT professionals, that reduction is not only minimal, but quite possibly made up for. Over three-quarters of IT professionals surveyed say one of the first things they do with a PDF-based invoice... is print it out.

Sponsor

And after those 77% of AIIM's 395 respondents print out their invoices, some 16% then scan them right back into the system for use as PDF attachments... some 77% of whose recipients print them right back out again.

Of the 358 respondents who provided detail for AIIM's study, entitled "The Paper Free Office: Dream or Reality?" some 10% said they actually print out their PDF invoices multiple times. And 10% say they print out at least one copy for archival purposes.

"Although many of the larger companies are pressing to have all-electronic billing and payment systems, we are still a long way from this ideal," the study reads. "Around a quarter or respondents are able to feed PDF invoices and fax images directly into a capture and/or workflow system. Another fairly common paper-intensive practice with faxes, especially with contracts and application forms, is to print the fax, sign it, and feed it back into the scanner or fax machine."

Ironically, some 45% of the documents being printed on paper originated, respondents said, not from scanned paper to begin with but from a word processor.

AIIM's respondents tended to fall into two groups: those whose companies do not scan their paper-based forms (including invoices) prior to being processed, and those which do scan them. Both groups were asked to list all the costs involved in the handling process, including labor. For the former group, the average cost for processing each paper form prior to being mailed was $3.63 per form. For those who do scan their forms, the cost falls to $2.83 per form.

So companies look at the 80¢ they're saving per form, and conclude they have the right to proclaim themselves "green." As AIIM noted, these businesses are failing to recognize that their business processes continue to revolve around paper. One astounding finding is that almost 30% of respondents scan their mail upon arrival, ostensibly for archival purposes, but many of them with the intent of printing out the scans since businesses tend to believe paper storage to be more permanent than electronic.

The study makes this... fairly obvious suggestion: "Keying the data at source into a Web form or a mobile device, rather than filling out a paper form, will save all of these costs."

When developers think of application testing, it always centers around how an app will perform on a particular device. This is especially important in the Android ecosystem that has upwards of 300 devices from a variety of original equipment manufacturers worldwide. From the inverse perspective, nobody ever thinks of the testing needs of the carriers and OEMs.

Cloud-based testing platform Apkudo thought about manufacturers and carriers with a new release of device analytics platform. Manufacturers can now test devices against the top Android apps before releasing. The idea is that if a device is tested from the supplier side, less handsets will be returned by consumers, potentially saving manufacturers billions of dollars.

Sponsor

Apkudo tests with what it calls a "device cloud." The configuration of more than 300 Android devices are set up in the cloud and mobile app developers can run their projects through that cloud to make sure it will work across OEMs and Android system versions.

For Apkudo's device analytics, the opposite approach is taken. Manufacturers and network operators can test their apps against the contents of the Android Market. Apkudo will run a device against the top 200 apps in the Market to test functionality with the touchscreen, keyboard, audio, device access (accelerometer and GPS, for instance) along with performance characteristics.

The idea is to provide both developers, network operators and manufacturers with tools against Android fragmentation. As we noted last week, there is actually less fragmentation on of Android devices as many think, with the optimal Android handset running on a 4.3-inch screen on version 2.3 Gingerbread. Yet, with the sheer volume of devices and applications available in the Android ecosystem, testing is still one giant headache.

Apkudo can speed up on the process that OEMs must go through to test devices. According to CEO Josh Matthews the process normally takes 6-8 weeks. Apkudo says it can do it in three days.

Device analytics will break down the results into two categories: characterization and optimization benefits. Characterization benefits help operators target competing devices while expanding their own portfolios. Imagine it as a bench mark against the rest of the ecosystem. Optimization benefits recommends how devices can be made better before release to be truly competitive in the market place.

The first U.S. carrier to sign on with Apkudo is MetroPCS. Apkudo also has agreements with "most major OEMs" in the Android ecosystem.

App developers should be happy with Apkudo's testing abilities because it means that the OEMs could have a more efficient testing program to make sure apps work on their devices. When it comes to app functionality on Android, developers need to work the manufacturers and carriers to ensure a quality experience. The end of fragmentation, after all, is a two way street.

It's an attention economy, and the good people at Jones-Dilworth have built a tool that will help you get some. Totem launches today, a free app that helps anyone build a great press page. Whether you're a giant company, a start-up, or even a solo act, you shouldn't have to think too hard about a press page. For that matter, neither should I.

A press page is a place for you to put all the info a reporter needs about you, your company, your product and your news. It's not the whole story; it's just the colorful details. But you'd be amazed at how hard it is to find that stuff sometimes. Jones-Dilworth has a wealth of experience, it has worked with reporters, and Totem reflects all the right priorities. If you want to make a good impression on the press, this is the way to go.

Sponsor

Free Totem users can build unlimited press pages with all the right info, bios, articles and image resources in all the right places. The pro version costs $99 - a one-time upgrade - and it lets you host Totem at your own domain (press.YourNameHere.com) or embed it as an iframe on your site. Pro users can customize the color and background and remove the Totem branding.

Here's an example. This is the press page for Totem itself.

The front page includes the basic gist, links to social feeds, and all the video and image resources a reporter will need to grab. There's a separate page for full team bios. The press contact is always in the upper right corner, because that's the person a reporter needs to get to quickly if something is wrong or missing.

The right side also features a few feeds to keep things fresh, such as company press releases and featured blog posts. It also has a ticker of recent articles, which can be viewed in full on the articles page.

The back end of Totem lets moderators input stories there, but there's also a browser bookmarklet that lets you add new articles with one click as you find them online.

Have you noticed those nice rows of publication logos at the bottom of start-ups' websites highlighting good coverage? Totem lets you easily create one of those and embed it on your site, linking to these articles.

Business depends upon good storytelling. The press (yours truly) is the filter through which the stories get to the public. If you want to tell the public your story, you have to get through us. But lest this sound self-important, let me tell you, we're lazy people. If you can make that story easier for us, we're much more likely to tell it.

I saw the Totem-built press page for Parse.ly before I knew what it was, and believe me, I noticed it. I spend so much time in Google Image Search looking for the least-crappy logo I can find. This time, there was just one link, and there I found everything I needed laid out exactly where I wanted it. If your boss needs more evidence that this is really worth doing for reporters, this is me saying, "Yes."

Check out Totem at totemapp.com.

Sponsor

Before you run off thinking I'm advocating the destruction of PaaS platforms, please realize that I am not. Rather, I'm referring to the shift away from monolithic, one-size-fits-all PaaS systems towards more open, loosely coupled platforms that makes it easy to consume code and services provided by third parties.

Early PaaS offerings, circa 2007-2009, were conceived of as all-in-one affairs. In fact, a big part of the value proposition that providers envisioned was its delivery via proprietary services and custom APIs that developers would use in their applications. Examples include App Engine's data store and Memcache services, the Force.com data store, the distributed cache and storage systems we built at Appistry and many more.

The fact is, the early players in the space had little choice but to roll their own. At the time, there were critical gaps in the market that needed to be filled in order for developers on PaaS platforms to be able to deliver rich, scalable applications. Fortunately for PaaS users, this is no longer the case for most application-level services.

REST Assured, We've Got Git

In order to build modern, scalable, connected web applications, developers must have access to a wide variety of third-party components and services upon which to build. With the proliferation of open source and SaaS services, these are now readily available on the open market. While both open source and SaaS predated the earliest PaaS offerings, in recent years the advent of GitHub and the popularity of REST-based Web services has played a significant role in expanding the selection of building blocks available to developers.

GitHub, by dramatically lowering the barriers to collaborating on and sharing open source projects, has become an "App Store" of sorts for developers, and is home to over one million projects. Likewise, the popularization of Roy Fielding's REST model for web service APIs has simplified developer access to the many application- and app-infrastructure-oriented SaaS services now available. It's now possible to store files, query and analyze data, send emails, create maps, subscribe to messages, encode videos, and much more, just by sending simple HTTP-based commands. (If you've never visited the ProgrammableWeb API Directory, the selection will blow your mind.)

This Cambrian explosion of high quality components and services has made web application development a much more productive affair for developers. And because the market has removed the burden of providing these low-level building blocks, those PaaS providers ready to embrace openness stand to gain great advantage.

Modular PaaS is Better for Providers, Too

While the end-user benefits of an open approach to PaaS, namely increased choice and reduced lock-in are apparent, the advantages of a modular approach to PaaS are two-sided, benefiting providers at least as much as users. This is because, as a PaaS provider, it's simply too hard to deliver both a solid application platform and the services that plug into it.

Specifically, offering both the platform itself and the application services that plug into it is a challenge for all but the largest providers because they lack the necessary domain expertise and because it spreads their development resources too thinly. In addition, because the open source and SaaS genies have left their bottles, trying to do it all puts the provider at odds with their customers.

By building and offering an open platform able to easily consume third-party components and services, and by cultivating a thriving ecosystem of the tools' providers, second-generation PaaS vendors can improve their own chances of success while creating a better world for their users.

In a world envisioned by a partnership between Microsoft and 24/7 Inc. announced on Tuesday, you'll someday receive a text message that your flight has been canceled, call a customer service number and be able to view flight options on your tablet as you discuss rebooking your travel with the customer service agent on the other end of the line.

It seems pretty basic, considering all that we're capable of doing in tech. But as anyone who has been put on hold for tech support, received a robo-call about suspicious activity on their credit card, or tried to deal with sudden travel changes can attest, dealing with customer service still seems to be stuck very much in the pre-Internet age.

Sponsor

That's where the Microsoft and 24/7 partnership comes in. Together, they will develop a Pedictive Experience (PX) paltform capable of handling 2.5 billion online and telephone customer service interactions each year.

"From speech to touch to gestures, consumers expect and demand more natural and intuitive ways to interact with technology," Zig Serafin, general manager, Online Services Division at Microsoft, said in a statement. "This same demand will change how consumers interact with businesses, and it creates an inflection point for how people will expect businesses to provide customer service. "

The firms say not only will they help companies link customer service over multiple platforms, but they'll help companies figure out what your preferred platform is and make it easier for you to get the fixes you need.

"All of us are quickly coming to expect companies to communicate with us in proactive, more natural and intuitive ways, and on the devices we use in our daily lives," Serafin wrote about the deal on Microsoft's official blog. "We should expect businesses to reach out to us when we need service, and to do so in a way that anticipates how we want to be communicated with; whether that's through our smartphone, our PC or through our TV if we happen to be in the living room."

Of course the deal isn't all about altruistic good will to consumers: the market for customer service applications like the ones proposed by Microsoft and 24/7 is huge and expected to grow. The announcement also follows a long-building trend of Microsoft working to offer more, specialized b-to-b solutions.

The deal also includes the shuffling of some Microsoft employees, as well as Micrsoft taking an unspecified ownership stake in 24-7, according to ZDNet.