The "permissive api" is facebook changing what words mean over time. People signed up, shared things, and then facebook changed default behaviors without communicating the change WELL.

http://mattmckeon.com/facebook-privacy/

In April 2010 basically everything a new user posted to facebook was public by default. They didnt "care deeply about peoples privacy."