It definitely is the right thing to do. I applaud you guys for going out of your way to make it right.

I'm really surprised developers at Twitter and Facebook haven't made read-only permissions the default.