What the statement means is that if you want to collect user data from the friend or your friend, you will need to make one request to capture the contacts of your friend and then another to collect the contacts of the friend of your friend. Within the scope of an application, the user that you are trying to get contacts for must have granted your application permission to access their contacts (by adding the app) before you can collect their contacts.
The contacts API will require that you use OAuth to access it:
http://developer.yahoo.com/oauth but we have a number of SDKs available that abstract out the OAuth pains:
http://developer.yahoo.com/social/sdk/ . I would suggest using one of those libraries to create the OAuth calls to the contacts api.
Jonathan LeBlanc
Technology Evangelist
Yahoo! Developer Network
Twitter:
jcleblanc