BrickLink Hacked!

DadsAFOL

Noooo!
https://twitter.com/#!/BricklinkAdm

111ins

now what am I going to do tonight??

kor

I guess I'll make it through one night without spending money....

ACWWGal2011

now what am I going to do tonight??

http://www.chatzy.com/BLCHAT Here's the temp chat. How in the world can someone just hack the site like that U_U

AFFOL_Shellz_Bellz

hackers are such creeps!

mrseatle

I really wish i could reach through the screen and strangle them sometimes... It's so easy to destroy, but takes a lot more to create.

Supersympa

^exact!

such a bunch of a## holes those hackers...

Si_UKNZ

Bricklink seems to be broken when trying to add sets to inventory - for me anyway. Anyone else have this problem?

Huw

It was hacked on Friday and Eric is still clearing up the mess, so a lot isn't working at the moment.

Si_UKNZ

Wow, didn't realise it'd been hacked, thanks Huw.
What a nightmare for Eric.

LegoFanTexas

Removing items from existing orders isn't working either...

I've just contacted my current deals on Bricklink and said, "why don't we just give them a few days to sort it out.". It isn't a big operation, they may need time to just get it sorted...

It is Lego, we can all wait a few days. ;)

Si_UKNZ

I found it - that site's screwed! He has so much to fix.
http://www.bricklink.com/message.asp?ID=641027
Its the 'inventory_verify.asp 1102' error.

Shame, as I can't really wait a few days - I'd put today aside to list a large amount of inventory on Bricklink, so I'm stuck with putting it onto fleabay and scamazon instead.

Enbric

I'm having trouble deleting wanted lists, there's still a lot of kinks to work out. I believe he's also working on the back-end to bulk up the security to prevent the SQL injections and attacks that started this mess.

He's been updating on his progress on the new Twitter account if you want to see how it's progressing.

LegoFanTexas

He has posted that there are 400 pages to manually check the security on, that they are using a security firm to help, that is going to take time.

They have run unsecured for a very long time and have gotten away with it. I completely get the issues involved, they are a small family business that doesn't have the resources or budget to pay for real site development.

Sad to say, but a lot could be accomplished by raising the commission to 5% and paying for real site development. No one wants to hear that of course, but it would solve the problem at hand.

Just my opinion...

Si_UKNZ

I agree, it's about time it they treated it more seriously and put some investment into it rather than treating it as a cash cow. The whole site is outdated and clunky.

LegoFanTexas

One lesson that I've learned from business over the years, all businesses require reinvesment of capital to improve and change with the times, or you will become out of date and passed by.

A simple example is the auto industry, the cost to redesign a car and retool a factory is very expensive, hundred of millions of dollars, sometimes billions of dollars.

So trying to keep an existing model on the road makes a lot of sense, they can profit off a car design for longer, making money without spending money, but sooner or later that backfires as the car is out of date and sales slow down and require ever larger price discounts to move vehicles.

At some point, you aren't making money on your existing cars because of the discount, and without those profits you don't have the money to redesign.

FollowsClosely

I have been tempted often to launch a competitor to bl...

emilewski

^ Go for it.

Note that it seems that the Bricklink people were/are planning on a relaunch of their site with current web technology. This was posted by Eric Smith after the hacking event:

"We are working with a third-party security firm to help identify as many security holes as possible, covering SQL injection, cross-site scripting, etc. These patches are being done regardless of the fact that we are already making plans for a new ASP.NET based site with security baked in from the beginning. We simply can’t wait."

LegoFanTexas

I'm quite sure Eric is doing the best he can, I am grateful that Bricklink exists at all, it is nice to have a place like it, separate from eBay.

It does need to be updated, and you're right, it sounds like that has been a work in progress...

It always seems so easy to do it, but having run more than one business myself, it is always harder in the trenches than it is on the 50 yard line yelling at the coach on what to do. :)

legomatt

I've never used bricklink myself so not totally up on the costs, but even if they only take a few % of fees, it must surely add up (given that there's people making a living as bricklink sellers), to enough money to afford some security, right? If only from a self-motivated sense to protect their income and not open the door to competition... which this may just invite.

But i don't know. It's not my field. Plus i suppose if someone is determined enough, they'll break anything eventually... though it'll smell a bit fishy if a competing legosite springs up in the next week or two! I certainly wouldn't trust it.... :os

AFFOL_Shellz_Bellz

I am grateful that Bricklink exists at all, it is nice to have a place like it, separate from eBay. :)

I have learned a tremendous amount about Lego elements on bricklink, and am very appreciative that it is available.

jadedanc

I would definitely agree to either a % from sellers or even a "subscription" fee. As much hard work as the admins do, plus everything I have bought and learned over there, in my opinion, would be worth it

Diggydoes

^sellers already pay 3%of any sold item!
I think it's a pretty fair amount for both sellers/site owners/admins!
Like @legomatt stated above,this percentage that's already given shall be enough to keep the site secured!
If the sellers-fee will be raised i'm pretty sure a lot of sellers would jump off the BL-train (so would i do!)! I know ebay fees are higher but ebay is way way much better known than BL,so usually you'll fetch higher prices when selling stuff on ebay!

Enbric

I know ebay fees are higher but ebay is way way much better known than BL,so usually you'll fetch higher prices when selling stuff on ebay!

I doubt it. There's no other site that has such a large database of pieces or sets that makes it so easy to sell in such large quantities. Ebay just doesn't work well for pieces. Plus, many of the established sellers value their feedback records too much to just walk away and try somewhere else.

We don't know what BrickLink's finances look like, but I'm sure if they were strapped for cash increasing the fee from 3% to 5% or even more would alienate only a very small portion of sellers.

LegoFanTexas

^ And keep in mind that sellers don't pay the fee anyway... buyers pay the fee...

If Bricklink fees went up 2%, the prices would follow... but if it meant a better designed web site that was secure and easier to use, that would more than make up for it.

caperberry

I love BL too and the lovely sellers on it. I am glad to hear of the changes coming; much as I like spending time on it, I have to spend far too MUCH time on it because it's a bit clunky and most importantly, doesn't do exactly what I need it to. Which is to tell me the cheapest way of getting a Wanted List; something which @atxdad has been writing a separate program for.

If someone opened a competitor site that had that functionality baked in, I think BL would have quite a challenge on their hands... so long as sellers also see benefits in joining.

Diggydoes

I'm aware that BL's database and inventory is way larger than ebay BUT take for example a Lego buyer like parents or people in general that are not "deep"into Lego(following blogs/pages like brickset etc.),they know ebay but they usually don't know BL,and honestly i think this is the main market for sets and even for Minifigures!
When i sell a figure on ebay i usually fetch a higher price than the one i would get at BL! Of course buying and selling single parts on ebay doesn't really make sense these days but especially sets&figures go very well on ebay!
I have a pretty small BL-shop and it's really a hassle to compete with bigger stores especially internationally(i'm from germany)so if the fees would go up to 5%or even 9%(like ebay) i guess i would close my store. As soon as i add the higher fees to the price of my inventory i guess i wouldn't sell anything no more because i couldn't compete with bigger stores!

Enbric

As soon as i add the higher fees to the price of my inventory i guess i wouldn't sell anything no more because i couldn't compete with bigger stores!

You are an example of the minority I talk about. Smaller stores from countries that are not the UK or the United States. If you don't sell many parts you might even be better off selling on Ebay.

But, for the majority of established sellers, particularly those with a large inventory of parts, Bricklink (right now) is the only option. Right now it would take a very large project to rival BrickLink, and I just don't think anyone wants to take that on at the moment.

dougts

The biggest problem of course would be getting enough critical mass of buyers and sellers to join any newly opened Bricklink competitor. That would not be easy to do at all...

davee123

I'm aware that BL's database and inventory is way larger than ebay BUT take for example a Lego buyer like parents or people in general that are not "deep"into Lego(following blogs/pages like brickset etc.),they know ebay but they usually don't know BL,and honestly i think this is the main market for sets and even for Minifigures!

BrickLink is the specialty market-- Hobbyists that know exactly what they want go to BrickLink because the sellers know what they're doing (generally), and are extremely explicit about what's for sale (compared to eBay).

For simple things like MISB retail sets, eBay is fine. But for used sets, individual parts, and other oddities, eBay just won't cut it. There aren't enough buyers looking for "1x4 lattice fences" or "used-but-complete Walking Astro Grapplers" on eBay. God forbid there were, because it'd be impossible to find what you were looking for.

Also, the pace of eBay is faster than BrickLink. If you put something up on eBay, it's only there for a limited time, and the seller is paying money to get it listed. It's not laid back like the BrickLink model, where you can list whatever you want for free, for as long as you want, and let your inventory sit there until a buyer comes along. Very beneficial when pairing up a buyer and seller can take a long time!

As for being a small family-owned business that can't afford professional development-- that's probably not *quite* true. They probably have enough to *have* professional developers come in and re-write the site (that's how Eric's doing that, it seems), but I wouldn't expect they have enough to maintain more than a handful of full-time staff. IE, if they have enough to pay (say) 3-10 people, they'd have to make sure that one of them was a full-time developer. Not impossible to do by any means-- but tricky to find a person that's a good fit.

DaveE

LegoFanTexas

When i sell a figure on ebay i usually fetch a higher price than the one i would get at BL! As soon as i add the higher fees to the price of my inventory i guess i wouldn't sell anything no more because i couldn't compete with bigger stores!

You get a higher price on eBay because the seller fees are higher... Yes, there is a larger audience for sets, but the price is really set by the market, if the price on eBay is way higher than Bricklink, inventory moves to balance that out.

That is the free market at work. :)

If the fees go from 3% to 5% on Bricklink, all sellers would have to raise their prices. Also, it is worth considering that if you can't make money at 5% fees, you aren't making money at 3% either.

2% is a gross margin that only companies like Walmart can deal with.

littletoki

Bricklink is a lot easier to use when you make your husband do all the ordering.

sidersdd

Seems Bricklink was hacked again today, including borrowing the Admin user id and merging people's accounts.
http://www.bricklink.com/message.asp?ID=642624

lulwut

Wanted list is still broken just as I needed to buy parts for the chibi AT-AT build. :(

Si_UKNZ

Anyone know if it's possible to back up your inventory and/or wanted list?

The only download I know of is this one, but doesnt seem to be any use
http://www.bricklink.com/catalogDownload.asp

Orangechef

Honestly a modernized site can't come soon enough for me. It seemed dated when I first started buying on BL, and that was several years ago.

emilewski

To backup your inventory, go to the Sell, Download
http://www.bricklink.com//invExcel.asp

(You can then import into Brickstore if desired for offline management)

dougts

Honestly a modernized site can't come soon enough for me. It seemed dated when I first started buying on BL, and that was several years ago.

A few months back I was toying with the idea of developing a modernized competitor site to sell LEGO. I shelved it since I thought it would be difficult to get enough critical mass of sellers to get the thing off the ground with any kind of traction. the hurdles of moving people off an entrenched monopoly are not to be taken lightly.

If a competitor had something ready to launch, the time would be now. HUGE opportunity to create that critical mass from day 1 - assuming you were ready for it of course.

bluemodern

Honestly a modernized site can't come soon enough for me. It seemed dated when I first started buying on BL, and that was several years ago.

A few months back I was toying with the idea of developing a modernized competitor site to sell LEGO. I shelved it since I thought it would be difficult to get enough critical mass of sellers to get the thing off the ground with any kind of traction. the hurdles of moving people off an entrenched monopoly are not to be taken lightly.

If a competitor had something ready to launch, the time would be now. HUGE opportunity to create that critical mass from day 1 - assuming you were ready for it of course.

I have been wondering if a competitor will launch very shortly. I have been thinking about what whoever doing this has to gain by hacking Bricklink, and it occurred to me that it could be a competitor. Bricklink does not keep any bank account/money information (you always pay through other sources) so that does not seem to be a reason. We will see what happens.

nkx1

A few months back I was toying with the idea of developing a modernized competitor site to sell LEGO...

If fees were lower and the interface more intuitive (ie simpler and easier/faster to use), I think you would have a legitimate shot at it. I like selling on ebay. It's easy and fast. While I appreciate the additional outlet to buy/sell Lego, BL is clunky and time consuming. I can't be the only one who has this opinion.

It might be slow-going at first, but if you have a better product, people would undoubtedly migrate. An obvious caveat is BL could improve it's interface before enough people migrated...

brickmatic

Yeah, Bricklink looks like it's stuck in the 90s. It's really time to upgrade.

Speaking of critical mass, I can imagine one scenario in which it would be easy to get critical mass for a competing site: if Brickset launched it's own version of a LEGO product marketplace.

hleonffu

I agree that an alternative to BrickLink that would bring buyer and seller could be successful, but the BrickLink catalog is very hard to replace. This is specially true when you think about individual parts vs whole sets.

As someone stated before, eBay and other sites do not work well for parts the way BrickLink does.

effalcon

whilst the interface is old, theres a LOT of functionality in it.
possibly some of which that lead to the security breach.

we really don't know the extent of the security that WAS in place either.

brickmatic

^^True, the catalog is the site's greatest asset. That would be a lot of work to reproduce.

It might be possible for a competitor to get a good start on recreating their own version by reverse engineering the one on Bricklink. You wouldn't get pictures and you might have to renumber all the parts, but you could get all the relationships of parts to sets. You might be able to use the names too.

However, it would be much better for everyone involved if Bricklink just got its act together and modernized their site.

^Lots of functionality is only great when it makes what you want to do easier. Without a good interface, a lot of it goes to waste. Command line interfaces have a lot of functionality (and can be very useful tools) but most people still use graphical interfaces on a day to day basis because of the ease of use.

effalcon

I must be one of the only people who doesn't find the interface that bad?
sure... it looks old.
and there are improvements to be made, but it does work with relative little work.

i'm not a seller, so i can't comment on that side, but as a frequent buyer, i don't have many complaints.

making it *look* newer would probably solve most peoples qualms with it.

CCC

One of the problems I have with bricklink is if I want to buy, for example, a light flesh head - any head, as I will clean the print off - how do I find the cheapest? I have to look at every single one individually. What if I want to buy any minifigure with a flesh head. Again it is not possible to do a quick search. You have to look at every minifigure, then click the ones with the right coloured head, then check the prices for each one at a time.

I would love a search by ... contains a generic piece (use asterisk in the description) in certain colour. I know that is unlikely.

What it could really do with is the cheapest for multiple parts search that is on here.

As for why it has been hacked - the competitor idea is probably a bit far fetched. I reckon it was hacked because it could be hacked. I'm fairly disappointed that the site has managed to get so big and generate fairly serious revenue without them considering, well maybe they have considered it, but implementing proper security.

Si_UKNZ

Looking at the level (lack) of professionalism in the UI, it's hardly surprising that the back end is in a similar state. Says a lot about their priorities/ abilities. They've done a great job to get it as far as it has, but they seriously need help.

Brick_Wall

One of the problems I have with bricklink is if I want to buy, for example, a light flesh head - any head, as I will clean the print off - how do I find the cheapest? I have to look at every single one individually.

I think if you put it in your wanted list, or any wanted list you make you can see a comparative list of stores and prices (through the list screen)

CCC

^ But I cannot add "any head that is flesh in colour" to a wants list.

Si_UKNZ

^ I would definitely say that's a niche requirement!
It's focusing on that kind of thing, rather than getting the basics really sorted, that's got them to where they are today.

CCC

^ In the example I give, it is of course niche. What if you wanted to search for the cheapest torso in black though? I often find I want a piece of a certain colour but don't care too much what detail is printed on it - not just for minifigs, sometimes for bricks / slopes too. The database has the colours, and even has them in the titles of the items but you cannot search for them and the piece number at the same time.

Eg. If I want the cheapest torso I can search for 973*. The title will have things like "Black Torso Police Leather Jacket" but if I search for 973* and a colour name, it fails. Why can you not search for item number and part of the title at the same time (or indeed any attribute associated with the item)? It seems stupid you can do one but not multiple. Most decent databases allow you to search over the entire record, rather than just one field. There are ways around it. In this case "torso hand* black" will help strip out the bionicle torsos and other junk since they do not have hands and give me most of the correct colour although will pick up ones with black details, black arms, etc, but this will give me torso assemblies only, and not torsos.