Jon Stahl points out that Facebook is no longer measuring apps by raw number of users but by their engagement. There’s more info at the Facebook blog. So how does this play out for charity apps on Facebook?

Well as of 10:38 PM EST on 8/29/2007, here are the stats for charity Facebook Apps:

App Name	% of active users	Active users per day
Firstgiving		14%	34
Causes			6%	203,182
Change.org		4%	288
Razoo Speed Granting	3%	207
Chipin			1%	39

Clearly, there’s room for better user engagement within most of these charity apps. Causes is still the 800 lb. Gorilla of the Facebook charity app world. What’s even more interesting is that Causes is also the biggest political Facebook app by far. And yes, that statistic lumps in political Causes with nonprofit Causes. Let’s say only 10% of those Causes are political. It’s still leading the pack. That’s how huge the Causes user base is. Those of you in the political advocacy world had better start figuring out Causes quick. I hear there’s a very important election in 2008.

I’m very intrigued now by the activity of Firstgiving users. Does anyone have a hypothesis as to why they lead the pack? I certainly don’t. Could it just be a statistical outlier or does Firstgiving have some secret user interactivity sauce?

Oh yeah, if anyone can think of more charity Facebook apps to add to the list, please tell me.

With a network of over 10 million professionals spanning the globe, LinkedIn is an immensely powerful platform. A few of us here decided that we should be doing more to leverage the network to promote positive social change, and LinkedIn For Good is our first step in that direction.

You can now learn more about outstanding nonprofit organizations and donate directly from the new nonprofit pages on LinkedIn (see a few examples below).

In addition, you can add a badge (like a “digital bumper sticker”) to your profile to show your support and raise awareness for the causes you care about.

When another member of LinkedIn views your profile and clicks on the badge, they’ll be taken to the nonprofit page where they can donate or add the badge to their profile, resulting in a virtuous cycle!

I think LinkedIn’s business plan is…
Phase I: Use our existing social network!

Phase III: Profit!!!

They are leveraging what they do have and I think it’s been pretty inevitable that they approach this given that there’s been attempts by LinkedIn members to do an adhoc nonprofit network within LinkedIn already. It makes sense but there’s certainly a bit of social network and badge fatigue out there right now. Again, is there enough incentive for nonprofits to use LinkedIn? From what I can tell, there’s a bit of a reticence on the part of people to join LinkedIn because they’re afraid that people will think they’re job searching (which they normally are). Once non-profits get over that, I think they could see some benefit in using the free employment listings that LinkedIn is now providing for nonprofits.

So who are the winners and losers in this move? The winners are the nonprofits at the left and right hand sides of the bell curve. The nimble as well as large and talented orgs will get this and run with it.

The losers are Change.org and ChipIn for the obvious reasons and oddly enough, Idealist. This could cut into Idealist’s action in the nonprofit employment market. Idealist sits in the space once occupied by OpportunityNOCs.org and the same kind of niche shift could happen again. Alexa head to head rankings between Idealist and LinkedIn don’t bode too well for Idealist.

This is a major problem for Idealist. The new job notification e-mail alert on Idealist has always been late or next to useless and I understand this is a frequent complaint of other Idealist users as in. Rest assured that LinkedIn for Good won’t be making that kind of mistake. Idealist has to really get that job e-mail alert down pat as that is its main “UI” for most users on a daily basis. I’ve had an e-mail alert on Idealist that runs on technology jobs and I’ve never found it usable. I’ve always had to go to the site itself. I always end up looking at Deborah Finn’s job listings on her Information Systems Forum e-mail list instead.

Chipin.com announced their new white-label initiative with Dell today. Students can now use a ChipIn widget to ask Mom, Dad, relatives and friends to contribute to their new Dell computer. After all, 17 and 18 year olds are like little nonprofits of their own. This is a great deal for ChipIn and shows that business services that help nonprofits can also be repurposed for the private sector too. It also means that concerns about ChipIn’s long-term viability should be assuaged.

Just so you know, ChipIn is past their angel round of financing and are currently in Series A round financing. They are also signing up revenue generating clients and hope that ChipIn will be operationally break-even by end of year.

I have in my inbox a hot new press release about Papilia and Chipin now doing an integration that meets each other over the Salesforce.com field. It’s fascinating to see this kind of convergence:

SAN FRANCISCO, CA and HONOLULU, HI – February 26, 2007 – Papilia, a pioneer in donor-centered fundraising solutions for nonprofit organizations, and ChipIn, the leading provider of Web 2.0-based social fundraising widgets for nonprofits, today announced a technology partnership to integrate their offerings within Papilia’s donor engagement web-based application. The enhanced solution will provide Papilia clients with an integrated fundraising suite consisting of ChipIn’s Widget technology and services, as well as the personalization and communication power of Papilia.

“In the past, nonprofits’ fundraising staff has carried the burden of raising funds for their causes alone. Now, with Papilia and ChipIn, donors can easily raise funds on an organization’s behalf by engaging their social network,” said Stephane Giraudie, co-founder and chief product officer at Papilia. “We are very excited about guiding the future of Blograising and anticipate a huge demand in the combined functionality.”

Under the terms of the agreement, Papilia and ChipIn will co-develop a private-labeled version of ChipIn’s Widget Management System (WMS), and integrate it into Papilia’s existing service offerings. This will enable nonprofits to conduct viral, donor-to-donor fundraising campaigns seamlessly within Papilia’s existing donor-centered fundraising solution.

The level of integration available over salesforce.com just blows my mind…. now where’s my case management system in salesforce.com?

Way too many reasons to pick salesforce.com.

Let’s compare it to Convio, everybody’s whipping boy right now. Can you easily build your own custom application in Convio? That is, can you use Convio for MORE than just CRM features? Could you conceivably use it for case management and other kinds of databases? That’s a no, at least not without paying Convio’s consulting fees. With salesforce.com, you can build your own application with very little intervention from outside consultants.

With Convio, do you have the ability to programatically access the data your workers typed into Convio? No? You mean you have to do a manual datasync? You mean Convio’s auto-dump of data to an FTP server doesn’t work for you? Well, you can use salesforce.com’s open API to pull that data you want into any application that can access salesforce.com’s SOAP endpoint URL. What happens if salesforce.com goes down just like GetActive did a couple of days ago? Well, with salesforce.com, they have a RIA client that will cache your data entry for you. Your users can keep entering data despite salesforce.com or their Internet connection being down. As soon as connectivity is restored, the cached data is sent right back to salesforce.com. I doubt you could do that with any of the nonprofit CRMs right now.

Can other data stores work just like salesforce.com? Sure, you could conceivably host your own database, pay for your own hosting, AND make sure you have a DBA taking care of it but remember, my major constraint on my recommendations was that they were for nonprofits with less than $10 million annual revenues. I doubt nonprofits at this size can do the hosting well enough to make it as stable and as feature-rich as salesforce.com.

Joomla!/Apache/Linux/mySQL

I’m a big fan of this stack. Every ISP in the world knows how to keep it well-fed and maintained. Actually, I think I wrote this stack too quickly. It should be re-written Joomla!/PHP/Apache/Linux/mySQL. The new addition is PHP. PHP is what powers Joomla! However, if you’re going to hire someone to work on a Joomla! site, make sure they know Joomla! first before you hire them. It’s sufficiently complex enough that you should hire someone with both PHP and Joomla! skills if you want them to write custom code for you. Linux and mySQL are also chosen on the basis of popularity with developers and familiarity to ISP admins. There’s a tremendous amount of documentation written for this stack. Smaller nonprofits should not try to re-invent the web programming wheel (despite the fact that they keep doing it over and over again).

RoR frontend to salesforce.com via ActiveSFDC/svn

And now we come to the portion that Ryan found objectionable, the use of a Ruby on Rails front-end UI to salesforce.com. I think there’s a little bit of confusion here and it’s probably best to say that Joomla! is a great interface for your web audience to add their data into your CRM. That’s the strength behind the salesforce.com open API. And yes, Ryan has managed to make Joomla! work as a front-end UI to salesforce.com. However, I’m more worried about back office staff connecting salesforce.com. Is Joomla! a great front-end for your own users to work with on a day to day basis? I don’t know. Generally speaking, it’s not a good idea to be two hops away from your data which is what will happen if you use Joomla! to enter data. Two hops you say? Yes, one from you to your Joomla! installation and then from Joomla! to salesforce.com. That’s too sluggish and fraught with Internet weirdness. Either use salesforce.com’s site, use salesforce.com’s offline RIA, OR roll your own custom solution that connects to salesforce.com.

Joomla!/salesforce.com integration is probably a stronger solution than ANY of the nonprofit CRM/CMS combinations out there, with the possible exception of a Drupal/salesforce.com integration. And the cost for the software? Still free for the ENTIRE stack for up to 10 nonprofit users. Even IF Kintera could be a better CRM/CMS integration bet (which I highly doubt), Kintera’s cost alone is prohibitive for the smaller nonprofit.

Of course, now that we have the integration questions out of the way, why do I still insist on Ruby on Rails vs. PHP for salesforce.com integration? It’s a technical answer but suffice it to say that RoR is just prettier than PHP. RoR has an ORM as part of its feature set. This means that it maps objects into their equivalent fields in a database. And with the activesalesforce component in RoR, this means you can take that ORM feature set with you when you code to salesforce.com. This is very handy, trust me. PHP doesn’t have an equivalent package so you’d end up having to go with fairly ugly code that uses a lot of calls to PHP’s SOAP libraries. I said this was my dream stack remember? And prettier code is easier to maintain in the long run — there’s less to read and it’s easier to decipher.

chipin.com

This is another element of the stack that will need some explaining as it just kinda stands out there. It’s neither a technology nor a CRM. However, chipin.com has some plans up its sleeves that will lend itself well to a future nonprofit SOA. Basically, it’s going to be open and eventually lightweight enough for use as a website component. Over time, it could end up being a distributed architecture for finding out how much money your nonprofit is raising over the social web. Stay tuned. chipin.com’s architecture is intriguing enough to me that there’s a lot of potential if they can make it scalable.

As always, I’m interested in your comments about the stack of stacks… I think it’s a step towards building the SOA future for nonprofits, even the smaller ones. Could you imagine the interoperability between nonprofits that could result from nonprofits adopting SOA for every one of their applications?

We are repositioning our product as a Widget Management System that is blowing the doors off our early clients. We have people who want to buy our system and who have plans to roll it out big time. Let’s say Kool-Aid high is starting to wear off as we dive deep into a nourishing meal of revenues and clients.

This probably means that they’re the only guys who have the widget technology issues down pat. As I’ve pointed out before, all the other nonprofit campaign widgets have serious security deficiencies if they’re using IFRAME and HTML for their core technologies. Chipin has a head start on widget technology and I guess they aim to capitalize on that by being the backend for everyone else’s widget. They’ve gone from selling the blades to selling the razor. Nice. I hereby make the first-ever prediction on this blog (expires at end of this year) — mass adoption of Flash technology for nonprofit widgets by eCRM and donor services. This does not mean Chipin is necessarily going to be dominant in this technology. However, if Chipin also kicks butt in widget analytics then the next competitor gets no second mover advantage as that would be the only remaining major feature set left in the B2B nonprofit space. On the other hand there are other widget management systems out there but they don’t compete in the nonprofit sector.

Some competitors:

Widgetbox – http://www.widgetbox.com
Musestorm – http://www.musestorm.com
A good overview on widget management systems is here

Unfortunately, I found out within minutes that it’s remarkably easy to reverse-engineer a reasonable facsimile of any widget and create a donate button that does NOT point to the widget host’s donation processing facilities. I’ve tried it with Network For Good’s badge and Firstgiving’s widget. You can’t easily do it with Chipin’s widget but it’s possible. All you need is a little time with Flash but the other fundraising widgets are much too easy to duplicate. See my evil widget to the right?

Why is it possible to build something that looks like a legitimate widget? The links that are given to bloggers, MySpace denizens, website owners, et al. are built on IFRAME tags that point back to the widget provider’s web site. For instance, this is Network For Good’s HTML snippet (I’ve taken out the surrounding greater than and less than symbols):

IFRAME SRC=”http://www.networkforgood.org/pca/PersonalCharityBadge.aspx?pcaid=100050″ width=”160″ scrolling=”no” height=”528″ frameborder=”0″ style=”height:528px;width:160px”

Ok, now go to the URL in the SRC attribute — “http://www.networkforgood.org/pca/PersonalCharityBadge.aspx?pcaid=100050″. Now that you’re there, click on the view source button in your browser. With some very minor tweaks, you can change the destination address of the donate button as well as other parts of the code and in almost no time at all, you too can host your own evil widget. If you take a look at the right sidebar, you will see that the donate button points toward “https://www.evil_domain.org”. Now save that code with the changed URLs in it and place it on your site and call it “test.html”. Now take that original IFRAME tag and change it to:

IFRAME SRC=”http://www.yoursite.com/test.html” width=”160″ scrolling=”no” height=”528″ frameborder=”0″ style=”height:528px;width:160px”

And voila! you have the widget. You can go to http://www.nonprofittechblog.org/test.html and then hit view source so you can see how it’s done. I made some changes to URLs and you can easily figure them out if you’ve got even the most elementary CSS chops.

This means that these widgets can be turned into phishing sites fairly easily. My suggestions to the widget builders should be that they re-architect the site in various ways.

1. Switch to Flash. This will raise the barrier of entry somewhat for would-be phishers. This should keep them out for as long as it takes them to download the appropriate warez and get some Flash skills.
2. Authenticate everyone who wants to use a badge on their site. When they register the use of the login, send them e-mail with an authentication key that has to be installed as part of the IFRAME src tag.
3. SRC attribute in the IFRAME tag should not immediately return viewable code but instead look for some sort of authentication key that is part of step 2.
4. Consider packaging the widget as a downloadable that people will have to install on their sites. Re-architect the widget to use its location URL as part of the authentication key.
5. Switching the design of the widget every so often and asking people to double-check with the widget provider’s website for visual confirmation that the widgets match.
6. Create an internal utility that sweeps through all the registered URLs and ensures that the donation code is what was originally sent out. If it’s Flash, ask the app to perform some sort of CRC check and perhaps some sort of built-in integrity check.
7. Make sure that people know what the donate page is supposed to look like. In fact, make sure that people know what the proper donation URL is supposed to look like.
8. Implement SSL on the IFRAME src and a “check our cert” button if people click for more info on the widget’s cause. Or just simply a redirect straight to an SSL-enabled page.

Nothing’s perfect with these solutions because the one thing that’s really scary will be the ability of phishers to recreate these widgets and point their donate buttons at illegitimate web sites. We know donors won’t necessarily be looking to check for proper URLs but the widget providers will have to give them the tools to do so.

Kintera Inc. (NASDAQ:KNTA) today announced the immediate availability of gadgets designed to leverage constituents’ nonprofit fundraising involvement on social networking pages, such as MySpace, Facebook or blogs. The initial gadgets launch marks a broader Kintera initiative to enable nonprofit organizations to leverage the power of their constituents’ social networks for fundraising and engagement efforts.

I think both the Kintera and GetActive announcements complete the round of announcements started off by Convio when Convio announced a donation widget as well. So we’ve got four heavies, Kintera, GetActive, Convio and Network for Good all in ChipIn’s space. Yet, from what I’ve seen, ChipIn has the most usage and Network for Good is the 800 lb. gorilla in the room since they too don’t need a CRM to use their service. And NfG has got a huge number of contacts with other nonprofits so they can probably exploit that in the long run.