Google play store / Android user generated content policy flagging

Hey @tom ,

Just to cover myself, this information is being provided in my personal capacity as a cybersecurity guy. This should not be taken as an official response from inSided, nor is it security advice.

Personally, I’d recommend just removing inSided from the entire app for security reasons. The inSided API is not intended to be used for something like this and if I were to crack open your app and grab the inSided API Key for your community, I could do a LOT of horrible things with it. The lack of reporting UGC would literally be the least of your problems - especially since that precious API Key would LITERALLY make me an unstoppable Super Admin.

My strongest advice is to remove all inSided related code and functionality from your app ASAP and revoke the inSided API Key you used to power the app with.

Once you know that ALL inSided code has been removed from the app, you can submit an updated version of the app to the Play Store and request an appeal/review to clear the policy violation. If Google is satisfied that there’s no further UGC in the app, they’ll grant the appeal and allow the update to go out.

Hey @Blastoise186 

Personally, I’d recommend just removing inSided from the entire app for security reasons. The inSided API is not intended to be used for something like this and if I were to crack open your app and grab the inSided API Key for your community, I could do a LOT of horrible things with it. The lack of reporting UGC would literally be the least of your problems - especially since that precious API Key would LITERALLY make me an unstoppable Super Admin.

Ofc we have not been as stupid as to embed the insided API key into our app 🤡 The latest community posts are provided by a service. The app simply asks the service for the latest posts via GET HTTP, the service is responsible for authenticating and responding with a list of the latest posts.

Ah ok, that’s good then. I’ve seen way too many people fall into that trap, it’s become my default stance for a lot of things.

I think this one might therefore sound like a good Idea suggestion. Are you able to access https://community.insided.com/ideas ?

Nope, I don’t have access to ideas. 

Gotcha. It sounds like you are a verified customer but I’m not an inSided employee myself so I can’t verify your status or grant you the customer roles.

But I do know a few inSided staff who do have that power. Could I borrow some of it @Julian @Alistair FIeld ?

Thanks for looping me in here, @Blastoise186. @tom, welcome to our community and thanks for sharing your feedback. You should have access to our ideas section now. Could you post your request there please? I could also convert this to an idea, should you prefer this.

Will converting this to an idea will help get an estimate for when we’ll get this functionality in the API?

Hey @tom (great name btw 😆) - so i’m wondering if the following workaround works for your integration perhaps? 

Content can be moved into a private category via the API with one of the move endpoints: https://api2-eu-west-1.insided.com/docs/community/#operation/moveArticle - this then mirrors how the platform works where 'flagged' content is moved into a certain category that only moderators + above can see.

The category just needs to have the appropriate permissions set where normal registered users cannot see the content.
 

Hi Tom 😀

It’s a good idea, but I think it has a few downsides

• It doesn’t flow with the actual flagging workflow that we’ve trained our moderators on, so it would be another process to their already busy workload.
• It means a bad actor user could theoretically flag lots and lots of topics very quickly and make the forum very confusing where topics disappear. 
• When you actually add the API method we need to make more changes
   

The above would work for “Block this post” but wouldn’t work for the “Block this user” as posts from the same user might still be visible.

Yes and no: While the product team surely will post a response and give some insights as to if and how we could be realizing this, they probably will not share a clear ETA before they actually have added it to their roadmap. We currently plan ahead roughly 3 months in advance (when it comes to specific features).

Due to the amount of requests & the way we plan ahead, it is impossible for them to make such an indication unless it is either super important for many customers & urgent. So you most likely will hear an ETA once the improvement will be planned as part of our development cycles.