Shopping at LEGO or Amazon?
Please use our links: LEGO.comAmazon
As an Amazon Associate we earn from qualifying purchases.

BrickLink Hacked!

DadsAFOLDadsAFOL USAMember Posts: 617
edited June 2012 in Buying & Selling Topics
«13456789

Comments

  • 111ins111ins Member Posts: 265
    now what am I going to do tonight??
  • korkor Member Posts: 392
    I guess I'll make it through one night without spending money....
    icey117
  • ACWWGal2011ACWWGal2011 Member Posts: 534
    now what am I going to do tonight??
    http://www.chatzy.com/BLCHAT Here's the temp chat. How in the world can someone just hack the site like that U_U
  • AFFOL_Shellz_BellzAFFOL_Shellz_Bellz Member Posts: 1,263
    hackers are such creeps!
  • mrseatlemrseatle Member Posts: 410
    I really wish i could reach through the screen and strangle them sometimes... It's so easy to destroy, but takes a lot more to create.
  • SupersympaSupersympa SwedenMember Posts: 534
    ^exact!

    such a bunch of a## holes those hackers...
  • Si_UKNZSi_UKNZ NZMember Posts: 4,179
    edited June 2012
    Bricklink seems to be broken when trying to add sets to inventory - for me anyway. Anyone else have this problem?
  • HuwHuw Brickset Towers, Hampshire, UKAdministrator Posts: 7,014
    edited June 2012
    It was hacked on Friday and Eric is still clearing up the mess, so a lot isn't working at the moment.
  • Si_UKNZSi_UKNZ NZMember Posts: 4,179
    Wow, didn't realise it'd been hacked, thanks Huw.
    What a nightmare for Eric.
  • LegoFanTexasLegoFanTexas TexasMember Posts: 8,409
    Removing items from existing orders isn't working either...

    I've just contacted my current deals on Bricklink and said, "why don't we just give them a few days to sort it out.". It isn't a big operation, they may need time to just get it sorted...

    It is Lego, we can all wait a few days. ;)
  • Si_UKNZSi_UKNZ NZMember Posts: 4,179
    edited June 2012
    I found it - that site's screwed! He has so much to fix.
    http://www.bricklink.com/message.asp?ID=641027
    Its the 'inventory_verify.asp 1102' error.

    Shame, as I can't really wait a few days - I'd put today aside to list a large amount of inventory on Bricklink, so I'm stuck with putting it onto fleabay and scamazon instead.
    odshowtime
  • EnbricEnbric Member Posts: 64
    I'm having trouble deleting wanted lists, there's still a lot of kinks to work out. I believe he's also working on the back-end to bulk up the security to prevent the SQL injections and attacks that started this mess.

    He's been updating on his progress on the new Twitter account if you want to see how it's progressing.
  • LegoFanTexasLegoFanTexas TexasMember Posts: 8,409
    He has posted that there are 400 pages to manually check the security on, that they are using a security firm to help, that is going to take time.

    They have run unsecured for a very long time and have gotten away with it. I completely get the issues involved, they are a small family business that doesn't have the resources or budget to pay for real site development.

    Sad to say, but a lot could be accomplished by raising the commission to 5% and paying for real site development. No one wants to hear that of course, but it would solve the problem at hand.

    Just my opinion...
  • Si_UKNZSi_UKNZ NZMember Posts: 4,179
    edited June 2012
    I agree, it's about time it they treated it more seriously and put some investment into it rather than treating it as a cash cow. The whole site is outdated and clunky.
  • LegoFanTexasLegoFanTexas TexasMember Posts: 8,409
    One lesson that I've learned from business over the years, all businesses require reinvesment of capital to improve and change with the times, or you will become out of date and passed by.

    A simple example is the auto industry, the cost to redesign a car and retool a factory is very expensive, hundred of millions of dollars, sometimes billions of dollars.

    So trying to keep an existing model on the road makes a lot of sense, they can profit off a car design for longer, making money without spending money, but sooner or later that backfires as the car is out of date and sales slow down and require ever larger price discounts to move vehicles.

    At some point, you aren't making money on your existing cars because of the discount, and without those profits you don't have the money to redesign.
  • FollowsCloselyFollowsClosely Member Posts: 1,181
    I have been tempted often to launch a competitor to bl...
  • emilewskiemilewski CT, USAMember Posts: 476
    ^ Go for it.

    Note that it seems that the Bricklink people were/are planning on a relaunch of their site with current web technology. This was posted by Eric Smith after the hacking event:

    "We are working with a third-party security firm to help identify as many security holes as possible, covering SQL injection, cross-site scripting, etc. These patches are being done regardless of the fact that we are already making plans for a new ASP.NET based site with security baked in from the beginning. We simply can’t wait."
  • LegoFanTexasLegoFanTexas TexasMember Posts: 8,409
    I'm quite sure Eric is doing the best he can, I am grateful that Bricklink exists at all, it is nice to have a place like it, separate from eBay.

    It does need to be updated, and you're right, it sounds like that has been a work in progress...

    It always seems so easy to do it, but having run more than one business myself, it is always harder in the trenches than it is on the 50 yard line yelling at the coach on what to do. :)
  • legomattlegomatt Member Posts: 2,548
    I've never used bricklink myself so not totally up on the costs, but even if they only take a few % of fees, it must surely add up (given that there's people making a living as bricklink sellers), to enough money to afford some security, right? If only from a self-motivated sense to protect their income and not open the door to competition... which this may just invite.

    But i don't know. It's not my field. Plus i suppose if someone is determined enough, they'll break anything eventually... though it'll smell a bit fishy if a competing legosite springs up in the next week or two! I certainly wouldn't trust it.... :os
  • AFFOL_Shellz_BellzAFFOL_Shellz_Bellz Member Posts: 1,263
    I am grateful that Bricklink exists at all, it is nice to have a place like it, separate from eBay. :)
    I have learned a tremendous amount about Lego elements on bricklink, and am very appreciative that it is available.
  • jadedancjadedanc USAMember Posts: 1,303
    edited June 2012
    I would definitely agree to either a % from sellers or even a "subscription" fee. As much hard work as the admins do, plus everything I have bought and learned over there, in my opinion, would be worth it
  • DiggydoesDiggydoes Cologne/GermanyMember Posts: 1,079
    ^sellers already pay 3%of any sold item!
    I think it's a pretty fair amount for both sellers/site owners/admins!
    Like @legomatt stated above,this percentage that's already given shall be enough to keep the site secured!
    If the sellers-fee will be raised i'm pretty sure a lot of sellers would jump off the BL-train (so would i do!)! I know ebay fees are higher but ebay is way way much better known than BL,so usually you'll fetch higher prices when selling stuff on ebay!
  • EnbricEnbric Member Posts: 64
    I know ebay fees are higher but ebay is way way much better known than BL,so usually you'll fetch higher prices when selling stuff on ebay!
    I doubt it. There's no other site that has such a large database of pieces or sets that makes it so easy to sell in such large quantities. Ebay just doesn't work well for pieces. Plus, many of the established sellers value their feedback records too much to just walk away and try somewhere else.

    We don't know what BrickLink's finances look like, but I'm sure if they were strapped for cash increasing the fee from 3% to 5% or even more would alienate only a very small portion of sellers.
  • LegoFanTexasLegoFanTexas TexasMember Posts: 8,409
    ^ And keep in mind that sellers don't pay the fee anyway... buyers pay the fee...

    If Bricklink fees went up 2%, the prices would follow... but if it meant a better designed web site that was secure and easier to use, that would more than make up for it.
  • caperberrycaperberry LondonMember Posts: 2,226
    I love BL too and the lovely sellers on it. I am glad to hear of the changes coming; much as I like spending time on it, I have to spend far too MUCH time on it because it's a bit clunky and most importantly, doesn't do exactly what I need it to. Which is to tell me the cheapest way of getting a Wanted List; something which @atxdad has been writing a separate program for.

    If someone opened a competitor site that had that functionality baked in, I think BL would have quite a challenge on their hands... so long as sellers also see benefits in joining.
  • DiggydoesDiggydoes Cologne/GermanyMember Posts: 1,079
    I'm aware that BL's database and inventory is way larger than ebay BUT take for example a Lego buyer like parents or people in general that are not "deep"into Lego(following blogs/pages like brickset etc.),they know ebay but they usually don't know BL,and honestly i think this is the main market for sets and even for Minifigures!
    When i sell a figure on ebay i usually fetch a higher price than the one i would get at BL! Of course buying and selling single parts on ebay doesn't really make sense these days but especially sets&figures go very well on ebay!
    I have a pretty small BL-shop and it's really a hassle to compete with bigger stores especially internationally(i'm from germany)so if the fees would go up to 5%or even 9%(like ebay) i guess i would close my store. As soon as i add the higher fees to the price of my inventory i guess i wouldn't sell anything no more because i couldn't compete with bigger stores!
  • EnbricEnbric Member Posts: 64
    As soon as i add the higher fees to the price of my inventory i guess i wouldn't sell anything no more because i couldn't compete with bigger stores!
    You are an example of the minority I talk about. Smaller stores from countries that are not the UK or the United States. If you don't sell many parts you might even be better off selling on Ebay.

    But, for the majority of established sellers, particularly those with a large inventory of parts, Bricklink (right now) is the only option. Right now it would take a very large project to rival BrickLink, and I just don't think anyone wants to take that on at the moment.
  • dougtsdougts Oregon, USAMember Posts: 4,129
    The biggest problem of course would be getting enough critical mass of buyers and sellers to join any newly opened Bricklink competitor. That would not be easy to do at all...
  • davee123davee123 USAMember Posts: 832
    I'm aware that BL's database and inventory is way larger than ebay BUT take for example a Lego buyer like parents or people in general that are not "deep"into Lego(following blogs/pages like brickset etc.),they know ebay but they usually don't know BL,and honestly i think this is the main market for sets and even for Minifigures!
    BrickLink is the specialty market-- Hobbyists that know exactly what they want go to BrickLink because the sellers know what they're doing (generally), and are extremely explicit about what's for sale (compared to eBay).

    For simple things like MISB retail sets, eBay is fine. But for used sets, individual parts, and other oddities, eBay just won't cut it. There aren't enough buyers looking for "1x4 lattice fences" or "used-but-complete Walking Astro Grapplers" on eBay. God forbid there were, because it'd be impossible to find what you were looking for.

    Also, the pace of eBay is faster than BrickLink. If you put something up on eBay, it's only there for a limited time, and the seller is paying money to get it listed. It's not laid back like the BrickLink model, where you can list whatever you want for free, for as long as you want, and let your inventory sit there until a buyer comes along. Very beneficial when pairing up a buyer and seller can take a long time!

    As for being a small family-owned business that can't afford professional development-- that's probably not *quite* true. They probably have enough to *have* professional developers come in and re-write the site (that's how Eric's doing that, it seems), but I wouldn't expect they have enough to maintain more than a handful of full-time staff. IE, if they have enough to pay (say) 3-10 people, they'd have to make sure that one of them was a full-time developer. Not impossible to do by any means-- but tricky to find a person that's a good fit.

    DaveE
  • LegoFanTexasLegoFanTexas TexasMember Posts: 8,409
    When i sell a figure on ebay i usually fetch a higher price than the one i would get at BL! As soon as i add the higher fees to the price of my inventory i guess i wouldn't sell anything no more because i couldn't compete with bigger stores!
    You get a higher price on eBay because the seller fees are higher... Yes, there is a larger audience for sets, but the price is really set by the market, if the price on eBay is way higher than Bricklink, inventory moves to balance that out.

    That is the free market at work. :)

    If the fees go from 3% to 5% on Bricklink, all sellers would have to raise their prices. Also, it is worth considering that if you can't make money at 5% fees, you aren't making money at 3% either.

    2% is a gross margin that only companies like Walmart can deal with.
  • littletokilittletoki Member Posts: 519
    Bricklink is a lot easier to use when you make your husband do all the ordering.
  • sidersddsidersdd USAMember Posts: 2,432
    Seems Bricklink was hacked again today, including borrowing the Admin user id and merging people's accounts.
    http://www.bricklink.com/message.asp?ID=642624
  • lulwutlulwut Member Posts: 417
    Wanted list is still broken just as I needed to buy parts for the chibi AT-AT build. :(
  • Si_UKNZSi_UKNZ NZMember Posts: 4,179
    Anyone know if it's possible to back up your inventory and/or wanted list?

    The only download I know of is this one, but doesnt seem to be any use
    http://www.bricklink.com/catalogDownload.asp

  • OrangechefOrangechef Member Posts: 7
    Honestly a modernized site can't come soon enough for me. It seemed dated when I first started buying on BL, and that was several years ago.
  • emilewskiemilewski CT, USAMember Posts: 476
    To backup your inventory, go to the Sell, Download
    http://www.bricklink.com//invExcel.asp

    (You can then import into Brickstore if desired for offline management)
  • dougtsdougts Oregon, USAMember Posts: 4,129
    Honestly a modernized site can't come soon enough for me. It seemed dated when I first started buying on BL, and that was several years ago.
    A few months back I was toying with the idea of developing a modernized competitor site to sell LEGO. I shelved it since I thought it would be difficult to get enough critical mass of sellers to get the thing off the ground with any kind of traction. the hurdles of moving people off an entrenched monopoly are not to be taken lightly.

    If a competitor had something ready to launch, the time would be now. HUGE opportunity to create that critical mass from day 1 - assuming you were ready for it of course.

  • bluemodernbluemodern USAMember Posts: 11
    Honestly a modernized site can't come soon enough for me. It seemed dated when I first started buying on BL, and that was several years ago.
    A few months back I was toying with the idea of developing a modernized competitor site to sell LEGO. I shelved it since I thought it would be difficult to get enough critical mass of sellers to get the thing off the ground with any kind of traction. the hurdles of moving people off an entrenched monopoly are not to be taken lightly.

    If a competitor had something ready to launch, the time would be now. HUGE opportunity to create that critical mass from day 1 - assuming you were ready for it of course.

    I have been wondering if a competitor will launch very shortly. I have been thinking about what whoever doing this has to gain by hacking Bricklink, and it occurred to me that it could be a competitor. Bricklink does not keep any bank account/money information (you always pay through other sources) so that does not seem to be a reason. We will see what happens.
  • nkx1nkx1 Member Posts: 719
    edited June 2012
    A few months back I was toying with the idea of developing a modernized competitor site to sell LEGO...
    If fees were lower and the interface more intuitive (ie simpler and easier/faster to use), I think you would have a legitimate shot at it. I like selling on ebay. It's easy and fast. While I appreciate the additional outlet to buy/sell Lego, BL is clunky and time consuming. I can't be the only one who has this opinion.

    It might be slow-going at first, but if you have a better product, people would undoubtedly migrate. An obvious caveat is BL could improve it's interface before enough people migrated...
  • brickmaticbrickmatic Member Posts: 1,071
    Yeah, Bricklink looks like it's stuck in the 90s. It's really time to upgrade.

    Speaking of critical mass, I can imagine one scenario in which it would be easy to get critical mass for a competing site: if Brickset launched it's own version of a LEGO product marketplace.
  • hleonffuhleonffu USAMember Posts: 244
    I agree that an alternative to BrickLink that would bring buyer and seller could be successful, but the BrickLink catalog is very hard to replace. This is specially true when you think about individual parts vs whole sets.

    As someone stated before, eBay and other sites do not work well for parts the way BrickLink does.
  • effalconeffalcon Member Posts: 71
    whilst the interface is old, theres a LOT of functionality in it.
    possibly some of which that lead to the security breach.

    we really don't know the extent of the security that WAS in place either.
  • brickmaticbrickmatic Member Posts: 1,071
    ^^True, the catalog is the site's greatest asset. That would be a lot of work to reproduce.

    It might be possible for a competitor to get a good start on recreating their own version by reverse engineering the one on Bricklink. You wouldn't get pictures and you might have to renumber all the parts, but you could get all the relationships of parts to sets. You might be able to use the names too.

    However, it would be much better for everyone involved if Bricklink just got its act together and modernized their site.

    ^Lots of functionality is only great when it makes what you want to do easier. Without a good interface, a lot of it goes to waste. Command line interfaces have a lot of functionality (and can be very useful tools) but most people still use graphical interfaces on a day to day basis because of the ease of use.
  • effalconeffalcon Member Posts: 71
    I must be one of the only people who doesn't find the interface that bad?
    sure... it looks old.
    and there are improvements to be made, but it does work with relative little work.

    i'm not a seller, so i can't comment on that side, but as a frequent buyer, i don't have many complaints.

    making it *look* newer would probably solve most peoples qualms with it.
  • CCCCCC UKMember Posts: 20,309
    One of the problems I have with bricklink is if I want to buy, for example, a light flesh head - any head, as I will clean the print off - how do I find the cheapest? I have to look at every single one individually. What if I want to buy any minifigure with a flesh head. Again it is not possible to do a quick search. You have to look at every minifigure, then click the ones with the right coloured head, then check the prices for each one at a time.

    I would love a search by ... contains a generic piece (use asterisk in the description) in certain colour. I know that is unlikely.

    What it could really do with is the cheapest for multiple parts search that is on here.

    As for why it has been hacked - the competitor idea is probably a bit far fetched. I reckon it was hacked because it could be hacked. I'm fairly disappointed that the site has managed to get so big and generate fairly serious revenue without them considering, well maybe they have considered it, but implementing proper security.
  • Si_UKNZSi_UKNZ NZMember Posts: 4,179
    Looking at the level (lack) of professionalism in the UI, it's hardly surprising that the back end is in a similar state. Says a lot about their priorities/ abilities. They've done a great job to get it as far as it has, but they seriously need help.
  • Brick_WallBrick_Wall Member Posts: 7
    One of the problems I have with bricklink is if I want to buy, for example, a light flesh head - any head, as I will clean the print off - how do I find the cheapest? I have to look at every single one individually.
    I think if you put it in your wanted list, or any wanted list you make you can see a comparative list of stores and prices (through the list screen)
  • CCCCCC UKMember Posts: 20,309
    ^ But I cannot add "any head that is flesh in colour" to a wants list.
  • Si_UKNZSi_UKNZ NZMember Posts: 4,179
    ^ I would definitely say that's a niche requirement!
    It's focusing on that kind of thing, rather than getting the basics really sorted, that's got them to where they are today.
  • CCCCCC UKMember Posts: 20,309
    ^ In the example I give, it is of course niche. What if you wanted to search for the cheapest torso in black though? I often find I want a piece of a certain colour but don't care too much what detail is printed on it - not just for minifigs, sometimes for bricks / slopes too. The database has the colours, and even has them in the titles of the items but you cannot search for them and the piece number at the same time.

    Eg. If I want the cheapest torso I can search for 973*. The title will have things like "Black Torso Police Leather Jacket" but if I search for 973* and a colour name, it fails. Why can you not search for item number and part of the title at the same time (or indeed any attribute associated with the item)? It seems stupid you can do one but not multiple. Most decent databases allow you to search over the entire record, rather than just one field. There are ways around it. In this case "torso hand* black" will help strip out the bionicle torsos and other junk since they do not have hands and give me most of the correct colour although will pick up ones with black details, black arms, etc, but this will give me torso assemblies only, and not torsos.
Sign In or Register to comment.

Shopping at LEGO.com or Amazon?

Please use our links: LEGO.com Amazon

Recent discussions Categories Privacy Policy Brickset.com

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Brickset.com is a participant in the Amazon Services LLC Associates Program, the Amazon.com.ca, Inc. Associates Program and the Amazon EU Associates Programme, which are affiliate advertising programs designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.

As an Amazon Associate we earn from qualifying purchases.