Indeed, it is not wise to run third-party bookmarklets while logged into Facebook. This one may be benign, but the next one may not be. If you want to see the JSON we're talking about, just load

https://www.facebook.com/ajax/typeahead/search/first_degree....

with 'userid' replaced with your numeric Facebook account ID.

For mine to display scores, I had to remove the "[0]" after "filter": https://www.facebook.com/ajax/typeahead/search/first_degree....

With the "filter[0]" in the url, all scores came back as 0 for me.

Thanks, edited accordingly.

I just keep getting errors. Viewer is also supposed to be replaced with the numeric ID, right?

Nevermind, I misinterpreted. I just realized it's supposed to be "viewer=[ID]", I was interpreting it as "viewer=[ID]&userid=[ID]". I'm still getting errors, but presumably that's another matter.

how do you find your numberic facebok ID?

If your fb id is raptrex, https://graph.facebook.com/raptrex

There might be another way, but this is the one I use.

It's javascript. Read the source before running it. The obfuscated gook that's 80% of the script has 0 diffs from jQuery as downloaded at jQuery.com; and the rest of the script is easy to verify in 5 minutes.

It's also a great habit to get into. Reading source code is invaluable in understanding and learning. And it is a skill that can be cultivated just like others. For example, the Prey project is an invaluable piece of software, except it's potentially extremely sensitive. Probably worth reading the source first.

You also start to get very well versed in the "usual way of doing things", especially if it's a language/paradigm you're not programming daily in.

Unfortunately, while a good practice, reading the code is not an iron-clad defense.

http://cm.bell-labs.com/who/ken/trust.html

To give one example of how this could fail, the server could return different code when the request referer is facebook.