I'm really surprised developers at Twitter and Facebook haven't made read-only permissions the default.