1. No, they should be public. So post status will be published.
2. It's optional. Lets say you have twitter profile field and want your users to fill their twitter profile url, so you can pre-fill that field by inserting http://twitter.com/, so users need to give only their username in that field. Makes sense?