Someone Emailed Me About Potentially Linking This Site to An App

[Arnox]

Any input on this would be good. The full conversation can be found below. They specifically want limited API access to Sanctuary some time in the future.

Hello!

My name is [REDACTED] and I'm developing the [REDACTED] app to help bring forums to mobile. The goal of this app is to provide users a portal to online forums through their phones. We're growing a decently sized group of forums and I wanted to see if you would be interested in integrating your site into our app.

You can see what the app's landing page here on our promotional site: [REDACTED]

If you have any questions or interest in joining the platform, please feel free to reach out to me at [REDACTED]

Not gonna lie, you look a little bit suspicious, man. Searching around for [REDACTED], it looks like your company is very new. While this is obviously not a red flag by itself, it's not super encouraging for me personally.

Assuming I was to go through with this, what would you need from me?

By the way, a small apology. As the maintainer of Sanctuary, I need to be very paranoid. It's my job.

We're pretty small. [REDACTED] only formed as a company back in September, but I've been doing software dev for more than 12 years at this point.

I'd be happy to talk with you on what the app would look like and how it would work. Really I'm just trying to see if there is any interest among forums because I can't really take this to stores until we secure a good group.

As far as what we need from you - at this point, nothing. The current plan is to build out a template of what each forum would look like in our app. We need to get an idea of how the app should look and feel to users. Once we do that, we'd start integrating each site into that template and pulling updates from the forums to display.

At some point we'd need to talk through how to get data from your forum to our app and vice versa so users can post and get updates on both ends. Ideally we could create some sort of middleware so that you don't have to expose your backend or whatever it is you use, but we'll just have to talk through it when it comes to that part.

We also want to look at setting up push notifications on mobile, but that would probably be a stretch goal for the first iteration of the app.

If you're up for it, I'll add you to the list of forums we can look to integrate and then help promote your site on the app when we launch.

Let me know if that works for you or if you have any other questions!

I mean, if you are OK with advertising Sanctuary entirely for free, I'm definitely not going to say no. Having any kind of internal access to the forum though... I'm afraid I can't allow that. Hell, even when I had an issue with our forum software and emailed XenForo about it, I wouldn't even give THEM login credentials for the server when they asked, so rest assured, you are not getting singled out here.

It sucks because I do like the idea of an app that coordinates together a lot of forums and allows admins to get the word out about their communities (assuming you do have honest intentions, that is), but at least as far as Sanctuary is concerned, we need to maintain a very high amount of security for several reasons, more than most other forums on the net, so no internal access can be granted at all.

I understand your security concerns so I'm trying to approach this without having to use your login credentials. Because I agree, I think there's something here having this app open up more of the internet and online forums to a larger audience.

Let's talk through some more because I did some digging and it looks like Xenforo does offer a rest API that could be used to send data between the app and your forum without us needing any sort of login info. I think all we would need is an API key from your end which tells the Rest API which site/page/post to work with.

This isn't something that we have to set up today or this week. If you're okay with it, I can keep you updated as we build out the app and then we could test integrating your site into it via the Rest API that Xenforo offers. At the very least, this would let users see your forum in app and have it work on mobile view. Then we can talk through signing them in and letting them post through the Rest API as well.

I'm also looking for other forums to integrate into the app. It looks like I have 3 or 4 other potential forums but TBD. If you know anyone else who might be interested in the project, I'm always open to suggestions!

It is true that XF does fully facilitate API access. It is, however, also true that opening up our API would increase our attack surface and perhaps also open us up to additional Denial-of-Service opportunities.

Again, is that just paranoia? Perhaps. And if I was running a less serious website, I wouldn't be so worried about these things. But Sanctuary is designed from the ground up to play host to all kinds of members and all kinds of content, from drugs to sports to reading to music to weaponry to politics.

Tell you what though. Let me ask the Sanctuary community what they think about all this. See what everyone is thinking.

By the way, they had made two small Reddit threads about their company some months ago, so they do have SOME presence on the net, but it is pretty minimal. Haven't checked their official site yet due to security concerns.

-

UPDATE: I emailed the person back yesterday, asking how they would deal with our incredibly NSFW content. The exchange can be read below.

After discussing this with some of my community, an interesting point was put forward. Are you even sure you want Sanctuary on your app in the first place? We ask because our content is VERY much 18+ only and hosts a lot of controversial stuff. You should know that while Sanctuary is very unique from other forums, it could also potentially be a liability to you. Google/Apple could, at any time, say that they don't like you hosting services for our site and deny your listing on their respective app stores until you remove us. Are you prepared to potentially deal with that?

It's a good point. Here's my thought on going forward:

We're going to build out our base MVP with a few forums that we have available right now to test the waters. We'll do our initial beta release and get feedback to see how users like the app and what they want in future updates. The initial release won't be much, but it should hopefully give us a good proof-of-concept to move forward. If everything looks okay, we can talk more on adding your forum to the app.

To your point, at a minimum, we would have to have age and content warnings for users who navigate your site and we would completely restrict the forum's visibility to any users under 18. We'd also comply with any Apple/Google requirements first. The two stores generally don't approve of NSFW content, but provided that 1. it's not advertised, 2. it is completely user-generated content, and 3. we have limitations in place to prevent unintended parties from viewing, it's not unprecedented that the app could still be approved.

All that being said, if you're still open to joining the app, we can always look at adding you down the road. If you think Sanctuary is too much for the general user or if you're not interested, then that's fine too.

 

[Gauche]

Tell them to fuck their mother lovingly

 

[Houseman]

It seems like a hub in the form of an app, so that people can access a variety of forums in one space with one unified user experience and set of credentials.

Are they okay with us allowing the n-word? With possibility of porn or other shocking content? Would they want to be associated with us? Would whatever app store hosts the app (and, indirectly, this forum), would THEY be okay with that? I've heard app stores have pretty strict rules on user-generated content.

If users made accounts and posts, would they appear just as regular users to us? I suppose whatever API key you provide to them would need to be able to create accounts, and then hopefully the real account could be handed off to the user so that they would no longer need to access the forums without using the API key.

Otherwise, if all reads and writes are through a single API key, that's probably not ideal, unless it's just doing something like caching the content once every so often and then serving that out for every other user to read. That would take care of the DoS problem.

But assuming that all the technology stuff works in common-sense ways, and there are no problems with the app stores or the devs on content grounds, sure, why not?

 

[gaijinkaiju]

why would i use an app, when its easier to just use my phones web browser

 

[Arnox]

why would i use an app, when its easier to just use my phones web browser

Well, I guess the idea here is that this app (again, if this person is being honest here) would be a sort of all-forums-in-one app that unifies a bunch of forums for convenience to the end user and allow greater discoverability for the more unknown forums out there. It would require a forum's site team though to explicitly clear the app to use the forum's API functionality so users could very quickly and easily register an account and post to a forum using just one app.

The idea is not entirely without merit at all. I have always said that actually getting a user to simply make an account on a site is one of the great hurdles, if not the greatest hurdle by far, of getting a user to actually use any given site. Registration is a pain in the ass that a lot of people just simply avoid altogether unless they really, really like a particular site.

 

[Vendor-Lazarus]

This forum won't be allowed on any official app store (Apple, google, etc), because of the nature of its content (https://www.bbc.com/news/technology-41306437). So it's rather a moot point sadly. If they'd done a deeper investigation, they'd know this and wouldn't have started negotiations.

 

[Arnox]

Bump. I emailed the person back yesterday, asking how they would deal with our incredibly NSFW content. The exchange can be read below.

After discussing this with some of my community, an interesting point was put forward. Are you even sure you want Sanctuary on your app in the first place? We ask because our content is VERY much 18+ only and hosts a lot of controversial stuff. You should know that while Sanctuary is very unique from other forums, it could also potentially be a liability to you. Google/Apple could, at any time, say that they don't like you hosting services for our site and deny your listing on their respective app stores until you remove us. Are you prepared to potentially deal with that?

It's a good point. Here's my thought on going forward:

We're going to build out our base MVP with a few forums that we have available right now to test the waters. We'll do our initial beta release and get feedback to see how users like the app and what they want in future updates. The initial release won't be much, but it should hopefully give us a good proof-of-concept to move forward. If everything looks okay, we can talk more on adding your forum to the app.

To your point, at a minimum, we would have to have age and content warnings for users who navigate your site and we would completely restrict the forum's visibility to any users under 18. We'd also comply with any Apple/Google requirements first. The two stores generally don't approve of NSFW content, but provided that 1. it's not advertised, 2. it is completely user-generated content, and 3. we have limitations in place to prevent unintended parties from viewing, it's not unprecedented that the app could still be approved.

All that being said, if you're still open to joining the app, we can always look at adding you down the road. If you think Sanctuary is too much for the general user or if you're not interested, then that's fine too.

Any further thoughts, everyone?

 

[Vendor-Lazarus]

Bump. I emailed the person back yesterday, asking how they would deal with our incredibly NSFW content. The exchange can be read below.

Any further thoughts, everyone?

If they're not going to "advertise" this site, is there any point in being on it?

How will they be limiting access? Will it require privacy-invasive Digital ID's? Will they require full API access?

 

[Arnox]

If they're not going to "advertise" this site, is there any point in being on it?

Somewhat, but I imagine it would require the app to take off in a big way.

 

[Lost-Zeneration-99]

I don’t know, I love the idea of it but with the way people and the internet is going seems to not be a good climate.

How will they be limiting access? Will it require privacy-invasive Digital ID's? Will they require full API access?

This is a good point as well. What we stand for unfortunately goes against well the status quo nowadays ironically.

 

[Houseman]

I assume an age-gate could be something as simple as "Are you over 18? Y/N"
But how THEY decide to limit access would be their decision, and not our problem.

So again I say "Sure why not?"

 

[Gauche]

Any further thoughts, everyone?

Tell them to fuck their mother compassionately

 

[gaijinkaiju]

I emailed the person back yesterday, asking how they would deal with our incredibly NSFW content.

what nsfw content?

 

[Arnox]

what nsfw content?

Clowns. There's clowns everywhere.

 

[Signa]

As long as there's a backup of the forum to revert to in case they are being duplicious, I see little down side to this. Maybe it's a scam from an angle I can't see, but it's an odd way to try to scam if it is.

 

[Arnox]

As per this official XenForo thread and looking around more, I'm mulling over just granting the app guest permissions. This means everyone using the app has all the same restrictions as guests on Sanctuary. Tell you hwat though, this guy lucked out. If we didn't offer that at all as a feature, then there would be no way to grant API access to them on Sanctuary. Not securely anyway.

 

[M0nke3]

Hey, sorry I'm just seeing this, but I would hold off on this. One of the old oFc sites was a member of something similar, and every time I went to the site on mobile it would want to take me to the app, became very annoying. None of the sites on the platform it was on were very interesting anyways, and it eventually tanked.
Do what ya want, but these kind of forum aggregate apps on mobile never did anything for me.

 

[Arnox]

Hey, sorry I'm just seeing this, but I would hold off on this. One of the old oFc sites was a member of something similar, and every time I went to the site on mobile it would want to take me to the app, became very annoying. None of the sites on the platform it was on were very interesting anyways, and it eventually tanked.
Do what ya want, but these kind of forum aggregate apps on mobile never did anything for me.

Oh you can still use our forum just like normal. It's just now there's another way you can access it.