I think Android's permission system works great. I saw Facebook's list of required permissions, considered whether these functions were necessary to provide the service I needed and whether I trusted Facebook to manage them for me, then declined to install the app.

I agree, but I'm not married enough to the native client to be upset about it when there's a perfectly good mobile site waiting for me.

If they tank their native site, well, then they won't get to harvest any more data from me.