I'm working on a widget targeted for Facebook, MySpace, and perhaps others, probably in flash. Has anyone seen a summary of technical limitations on the different sites?
I'm being told that FB doesn't allow emebedded swfs to link out to external sites, and that MS doesn't allow JS. It's sounding a bit vague and sketchy, though. I can obviously go look at the API for each site, or build some test apps, but maybe there's a list someone's written. (Google didn't help.)
Unfortunately each of these platforms change frequently and impose unique and sometimes complex restrictions.
I'm not aware of any documents that discuss limitations of individual platforms, and such documents could become rapidly become outdated anyway.
The best way to come to understand what limitations to expect might be to build an understanding of the security issues involved. For example, MySpace does not allow widgets to run javascript because it would run in the context of the user's secure myspace session. Blogger allows javascript because each blog is on a subdomain and javascript is not able to access the root domain. Facebook allows a custom version of javascript that is carefully sanitized to prevent applications from hijacking the user's session.
The quickest way to get an idea of what can be done would probably be to just try out the widgets on each of these sites.