Latest news from the Grand Exchange Central

I am back from a week long vacation (was exploring Kentucky - loved it) and I do plan to resume more or less regular postings.

Meanwhile, here is the latest update from Absenm about the Grand Exchange Central reopening. Almost there!

Well, The Grand Exchange Central is about 80% up and running. Just cleaning up a few issues. It may seem that two months was an awful long time to fix our security issues. But we needed to use what little time we had to make sure we didn't face these issues again.

First of all, you will see that the site looks pretty much the same. That is because we focused on stuff in the background. Redundant security and visitor protection was paramount. But we also managed to make most pages load up to 4x faster. We also tweaked certain formulas, to make our lists more reasonable in what they display.

The Mock Grand Exchange portion of the site will still be down till summer. The MGE had major issues, and it seemed it was better to simply start fresh with it; building on a foundation focused on security first, and learning from our technical challenges of the past to make an overall better mock exchange.

We are in talks with other fan sites about hosting our forums. Forums are a terrible security risk for a site, and having an outside forums host will protect the main site from attack. In the end, the GEC was never about the forums, so having a trusted fansite take that responsibility just makes a lot of security sense.

Obviously, you'll see nothing new on our site from a visitor stand point. All these months of work went into a foundation based on security. But we did implement some tweaks that will also help us expand in the future.

I'd like to thank everyone who was concerned with our issues, and sent me and the GEC their best wishes for our return. We are almost there, and I hope our former visitors will check us out again and be reminded of why they liked us so much.

Thank you again, Absenm

Grand Exchange Central Re-opening

Below is an announcement from Absenm about the Grand Exchange Central re-opening. Yes, it's up and running again, yay!

Set your calendars friends. April 15 is the official re-opening of The Grand Exchange Central. Before then we will be bits and pieces. But portions of the site will be up. Even today.

We have spent a month finding everything we could to secure our site. Our security is not just watching our users back. We have taken the offensive. Fool me once shame on me. Fool me twice shame on you.

No. Sadly, you will not see anything new. Not yet. Six weeks of work went into security. But at the same time, while rewriting everything, we put in to place some very powerful plug in routines. Once we know you visitors are safe, we can start adding things at a startling pace.
Our little baby hacker has awoken a sleeping giant. We at the GEC will be bigger, stronger, and way more cool than even we had dreamed.

I personally, Absenm, apologize for taking so long. It was required to protect our visitors. We will never again allow hackers to take us down again. I am not issuing a challenge. I am making a statement of fact.

We are going to be smart. Just adding pages slowly. There will be broken links. But in a month you will hardly notice we had been gone. By April 15 it will be business as usual. It is time for resurrection. And the GEC will be there when the dust settles.

So please, RuneScape friends, check on us. You will be glad you did. And on April 15 you will have your GEC finally back. Until then, please watch our progress. We will be a little messy, but we are back, and constructing the site you always wanted us to be.

Message from Absenm about the Grand Exchange Central situation

Below is an official announcement from Absenm about the latest news from the Grand Exchange Central and the status of the site recovery. As you are aware, the GEC is being completely reworked at the moment, including the forum, which makes it hard for Absenm to keep in touch with the GEC users. I am happy to use Runewise and Runescape Reader's Digest to get the message out and I would encourage you to help too. If you know someone who used to use GEC and wonders what happened to it, point them here or reprint/link this post. Thank you!

Greetings Runewise Friends. My name is Absenm, and I am the webmaster of a site known as The Grand Exchange Central.

Over the past couple of weeks the Grand Exchange Central (GEC) has been the victim of a targeted hacking attack. At first it started out small, and I worked diligently to head it off as quickly as possible. Usually I was able to get in and restore things within hours if not minutes of each attack. I spent a lot of time trying to secure things. But the attacks kept coming, stronger and nastier. I eventually needed to temporarily close down to confront the issue head on and prevent GEC visitors from becoming victims.

Sadly, some people did manage to get infected by rouge javascript that was injected to my site. To those people I formally apologize. I know this must be frustrating to you. There is nothing we can do to change what has happened. But know that the GEC takes your security seriously, and our current efforts to protect you and all our visitors in the future are extensive, massive, and severe. I take this attack on the GEC personally, and rest assured I have been spending every waking minute confronting this issue. I do urge anyone who visited the GEC in February to make sure you perform solid virus scans on your computers, just to play it safe.

I admit, I probably should have taken greater efforts to alert our visitors to the situation. I did mention the hacking attempts in our forums several times. But it would have been more responsible for me to post a warning outright on our main page too. There are a couple of reasons for not taking that step. First, I thought I had it handled and that it was just an isolated script kiddie. Second, I really didn't want to give the hackers the satisfaction. Third, I didn't want to publicize the issue to prevent others from trying to take advantage of the situation. So I just notified visitors through the forums. In the future, potential security threats will be posted on our main pages immediately. In fact, if the GEC detects its under attack, it will automatically post a warning. This warning won't mean we have been hacked, simply that an attempt is being made and visitors should be cautious. (This is a new security feature we have added). I toyed with the idea of having the site automatically shut down, but then decided against it. Anyone who wanted to shutdown our site would simply just need to start trying. That isn't a solution. Plus, every large site is attacked multiple times every day.

Before I go further, some of you have noticed that the domain grandexchangecentral.com has expired. Please don't let this scare you. As it turns out, the domain name was set to expire already. After talking to my hosting provider to make sure I had leeway in renewal, I decided for security reasons to allow it to expire. The GEC was already down for our security overhaul, and we already had plans to go to a VPS, so safely expiring the domain was not an issue for me. Frankly, it is just less of a distraction for me right now. I have all my attention on overhauling the GEC, and I don't want to keep tabs on an open domain just in case someone managed to start posting code there. This is overkill. But I really want to protect my visitors, even if it kills the GEC search rankings.

So, what happened? Everything concerning the GEC has been destroyed in a manner of fashion. By my own hand no less. I suspect the problem arose from a rootkit being hidden on my site, injected through a malformed URL. The GEC is terribly complex, and I couldn't find the access point or rootkit. And even if I did find a rootkit, I could not be certain it was the only one. Thus, post attack security simply wouldn't cut it. I'd secure all directories. I'd sanitized my variables. But it was already too late. The safety of our visitors and future of the GEC depended on drastic actions. So I killed everything (kind of). I'm working with backups from last year right now.

So what is happening now? Well, just because I'm working from backups from last year doesn't mean much of any of those backups will ever see the light of day again in their original form. I am going page by page, line by line, rewriting everything using all the security precautions recommended from various security professionals. When GEC2.0 returns in the beginning of March, there will be several layers of security and monitoring. We are being both defensive in our measures, and proactive. No site is hack proof. But you can know, that if we ever do get hacked again, we did everything we could.

I'm not going to go into exactly all the security we have implemented. I'm not going to give hackers a blue print. But I will let you know that the entire site will be starting out clean. If a file is on our site, it will have been scrutinized for every possible weakness. Again, nothing that was there in the past will be there in the future without some form of security modification. Also, we are off loading our forums to a remote forums host. That means an attack on the forums (which is where I think this started), can not bleed onto the rest of the site. Also, a hosted forum has the benefit of always being updated to the latest security patches. For a few more weeks, the MGE portion of the site will also be down. That is a weak point that will take longer to protect. But the GEC itself, with its graphs and lists and Runedexs will be available.

Our goal is to be back up on March 3rd. That's the goal. And we think we will make it. The only reason I can see that will cause us to not meet that deadline is if my hosting provider takes longer to drop us onto a VPS. That is scheduling that is kind of out of my hands right now.

Also, be aware, we are still collecting price data. So even though we have been down now almost a week, GE pricing data has still been collected and will be available as soon as we are back up.

Once again, I apologize to anyone effected by this. Trust me. I have been deeply effected by this myself. And I feel your pain. I am terribly embarrassed and hurt and frustrated and mad. We were just hitting our stride, and this happens. I hope that the RS community will quickly come to trust our site again. I think the measures we have taken will make all our visitors feel safe and secure.

I'd also like to thank Vaskor for allowing us to reach the RS community through the Runewise site while the GEC is down. Runewise will always have a friend and partner with the GEC.

Grand Exchange Central is under attack

This is a message for those of you who uses Grand Exchange Central fan site and wonders what happened to it. The site is down at the moment, because of a series of hacking attacks on the site. The attacks started a few weeks ago and recently intensified to the point that Absenm decided to shut down the site until the issue is somehow resolved.

So the good news is that the Grand Exchange Central will be back eventually (so keep checking it from time to time). The bad news, of course, is that there is somebody out there who decided to deliberately break the site. I am sure Absenm will sort it out one way or the other, but, oh boy, I wish the hackers would go to jail for their crimes. I really do...

Some people think that hacking is cool and that there are noble hackers, or hackers who work for good governments or whatever. There is NOTHING noble about hacking web sites, regardless of what a web site is about or who owns it. It is a crime and a bad one too. Somewhere in a range between burglary and rape...

Interviews with Runescape Fan Sites: Grand Exchange Central

Today's interview is with Absenm, founder, owner and developer of Grand Exchange Central. The site is a very unusual and very focused (in a good way). And when I think of innovation done by Runescape fan sites, Grand Exchange Central with it's Mock Grand Exchange feature is probably the first site that comes to my mind. Enjoy the interview!

Q: How would you describe your site in a few words?
A: The Grand Exchange Central is a safe place for RuneScape players who enjoy the economic side of RuneScape. Merchanting in RuneScape has negative tones, and the goal of the GEC is to be a safe information and training tool that is focused on changing merchanting from a negative to a positive.

Q: Can you tell us about major milestones of your site? A little bit of a history?
A: The GEC started out as a simple script I could personally use for my blog. When I wrote in my blog about items I thought were good investments, I wanted to have realtime data displayed in my blog. In concept this was a cool idea. But in practice I soon discovered that posting realtime data in a blog actually was a bad idea. When I'd write an article about good items, everything was fine. But over time those items may become bad investments, and thus the realtime data removed all sense from the blog post.
But the fact that I had the scripts to do the calculations and store the data still seemed to me to be a powerful tool. So I took my focus away from simple realtime data for a blog, and focused instead on making a site that improved upon the official RuneScape Grand Exchange Beta website.
The official GE website was an okay tool for RuneScape investors. But it lacked a lot of resources that merchants could use to make better investments. I started out the GEC slowly. First just giving realtime data on tradeable items. But once I had that data easily accessible I started making tools to use that data. I liked the idea of "indices" that could show how categories of items where performing over time. I called these Runedexes. This was not an origional idea to me. I first fell in love with the concept from the Grand Exchange Market Watch. Then I started making specific lists of items. First there were the normal lists, like most valuable items, and items that had the greatest price drops/falls. Then I started getting the GEC a little more advanced. We got lists of items that were bottoming out (near their historic low) or peaking (near their historic high). Then we developed a detection formula that could potentially spot items that were suffering from clan manipulations. Other lists followed.
While we were doing all this, I had this wonderful idea of creating a GE market simulator. We call it the Mock Grand Exchange. Visitors could make mock accounts on the GEC website, be giving a certain amount of mock GP, and trying out investment ideas without the risk of losing real RuneScape GP. This added a fun aspect to the otherwise static and intimidating process of researching RuneScape investments.

Q: What inspired you to start a Runescape fan site?
A: I already explained how the GEC started, so I'll focus on how the original blog started. While playing RuneScape, week after week I would see all the changes going on. It was an exciting time in the world of RuneScape. I wanted to talk about these things, but none of my real life friends played the game. So I decided to express my views publicly in a blog where other RuneScape fans could read and comment on my ideas.

Q: What were your original goals for the site?
A: Originally, I just wanted a place to quickly find historical information about tradeable items in RuneScape. I kind of wanted the GEC to become the Wall Street Journal of RuneScape.

Q: Had your goals changed over time? If yes, how and why?
A: My goals for the Grand Exchange Central are basically the same as when I started. I still want a safe site for everyone. I still want it to have the best investment tools available on the internet. I still want to remove the bad stigma that is sometimes associated with the word Merchanting.

Q: Was it the first web site you ever created?
A: No. For a brief time about a decade ago I had an antivirus help website. But it was straight HTML code, and mainly only provided links to antivirus resources. Back then blogging wasn't as popular as it is now. That first website of mine could have easily been a WordPress blog in today's world.

Q: What technologies were used to create the site? Did you add new technologies into the mix after you created the original version?
A: My coding background is very limited. I wrote my first program in BASIC almost thirty years ago when I was eight years old on a RadioShack Color Computer 2. But I never really got into programming. It was only ten years ago I tried my hand at limited HTML coding. It was only a couple of years ago, when I first wanted a more dynamic aspect for my RuneScape blog which meant I needed to teach myself PHP and mySQL. I had, and still have, no formal programming education. It's all been trial and error as I learn and improve the GEC.
The GEC itself is extremely heavily dependent on PHP and mySQL. With the exception of the forums, the entire site is custom made. This has been a blessing and a curse. Even though there are several thousand pages accessible on the GEC, only a few pages need to be coded to build all the pages visitors see. Yet that also means that even the simplest changes require making sitewide changes to some very important scripts. One mistake can take down thousands of pages, and even take down the entire site.
Currently the only new technologies I'm looking into are integrating with Facebook Connect and developing HTML5 graphing. Visitors can share various things already from the GEC to Facebook. But I'd eventually like to add the ability to logon to the GEC using Facebook. But I'm talking technologies here. We have ton of new features we are adding that use our current technologies. PHP and mySQL are still very powerful tools.

Q: Is there a unique feature/service your site provides to Runescape players?
A: That would be the Mock Grand Exchange. As I mentioned before, this is a virtual Grand Exchange that allows visitors to try out investment strategies without risk.

Q: Which feature/service took the most time and effort to create?
A: The Mock Grand Exchange. This changed the entire direction of the Grand Exchange Central. Before the MockGE, anyone could use all the features. But the MockGE required user accounts (which is why I added the forums... so I could use the forums user accounts for the MockGE). It require required fairly complex coding to mimic the real GE. It required detection of Official GE price updates almost immediately. Plus it required a fair bit of politics. How to mimic the GE without stepping on Jagex toes? It had to be an effective tool without duplicating the real thing. Also, since members can compare their performance to other members, I had to find a way that new members could still "compete" with older members who might have more mockGP.

Q: Which feature/service was the most complex from the programming stand point?
A: The whole site. LOL. The truth is, not being a programmer, almost everything has been a challenge. But if I had to pick one thing, it is getting the graphs right. Since the start I have used a nice FLASH app to create the GEC graphs. But I was never particularly happy with it. And once I got my iPhone, it became more important to me to look into graphing in HTML5. That is something I have been looking into for almost a year now, and have yet to implement. Only on the GEC mobile pages do I touch HTML5 graphs. But our mobile site is very limited, and the graphs are not particularly interesting. Yet.

Q: Is there a feature/service of the site you are most proud of?
A: Most members would probably think this is a minor feature, but I still smile when I think about it. The Clan Manipulation detection formula. Our Clan Manipulation detection mathematics are not perfect, but they do provide a nice level of logic and reasonable accuracy. The GEC uses what we call the 4x4 Rule. Any items that have increased and/or decreased in overall value by more than 4% for four days out of the last five days are flagged as potentially being manipulated. It seems to be fairly on the spot, and I'm a little smug about that.

Q: Did you start the site alone or with friends?
A: I started the site by myself.

Q: Are you the only developer of the site's code?
A: Yes, I'm the only developer. Again, I have no formal training in coding and I'm pretty much the only person that could understand my admittedly poor coding design. Though over the past year I have been updating portions of the site to be a little more clean.

Q: How much time do you normally spend supporting the site? A few hours a day? A few hours a month?
A: That really depends. There are times where I can easily put in 20 or 30 hours in a week on the site. But then there are times (like recently) when an unholy convergence of personal conflicts happen an I have almost no time at all to work on the site. Sadly, with me, it is an all or nothing type of situation. When I'm working on the site (about 40 weeks a year) I'm putting in at least 20hrs a week. The remaining 12 weeks I'm doing almost nothing but putting out any small fires (maybe a few minutes a week).

Q: What is the most difficult/challenging task you have to do to maintain the site?
A: Finding the free time to write (or rewrite) quality features. I have a backlog of features/fixes 13 pages long I want to implement. Coming back from those before mentioned unholy convergences is always hard. What to do first? What amazing features can I add that will make up for my time away?
I am thankful that I am a very anal person, and therefore I wrote the site with backup contingencies that allows the GEC to run itself in most situations. Every once in a while something horrible will happen that seems like it will require my immediate attention. But then I'll discover that the GEC somehow self corrected and is functioning properly. At those time I sit back and say out loud "Wow. I didn't know it could do that."

Q: How many staff members do you have? How did you find/chose them?
A: I have two staff members. Unfortunately one of them has disappeared over the past six months (that happens to everyone from time to time). But my other staff member Stramel has been an incredible addition to the site. He keeps an eye out on our forums, keeping them safe for our members, and tries to answer questions as best he can. I choose him and my other staff member based on their involvement in the forums and maturity level. Pretty much if someone is being helpful in the forums, and PMing me with questions and suggestions, and they do not present a negative attitude, I'll eventually ask them to become a mod. Over time, I hope to have more things for mods to do. But right now their job is focused on the forums. Though Stramel does have some limited ability to make minor changes to item detail information.

Q: Are there aspects of web site management you were able to completely delegate to others?
A: I wouldn't call it completely, but I have pretty much handed almost all control of the GEC forums to Stramel.

Q: Did you ever have to deal with hostility and/or attacks from other fan sites?
A: Not specifically from other fan sites. I usually am approached from other sites to merge or work with them as partners. I'm looking into a separated partnership with one such site right now, though I haven't had much time to follow up on it. However, every once in a while I do have to deal with attacks on the site as a whole from persons unknown. This happens to any sizable site, and is standard business. But as a community, I have heard very few negative comments about the GEC. Usually the only negative comments I see are about site design. And usually I agree.

Q: Did you ever consider making money with the site or is it just a hobby?
A: It is a hobby, though I do have some Google ads that go toward paying my web hosting costs. I wouldn't say I make any profit off the site. When all is said and done, I probably make about $0.17 an hour for my time.

Q: Do you still play Runescape? If yes, how often?
A: Sadly, I play almost never now. What little free time I have to play RuneScape, I need to spend working on my site. Thankfully, the nature of my site doesn't require me to be an active RuneScape player. It does preclude me from giving much investment advice these days. But my members can take care of the advice part. I focus my attention on the mathematics, which doesn't require my involvement in game. That said, I do miss playing.

Q: What kind of Runescape player are you? Which Runescape aspect is most appealing to you: quests, role-playing, skilling, pking, minigames etc.?
A: When I was playing actively I stuck to trying to making money through combat. And the quests were pretty fun. Ironically, I didn't use to GE much to make money. Though I did fully adore merchanting when I made a small fortune off Strange Fruit a couple of years ago when the Random Events update occurred. Everyone knew about the update for a few weeks before, and I just knew those fruit were going to skyrocket. That was a ton of fun.

Q: Are there other Runescape fan sites you personally use as a Runescape player?
A: Whenever I need advice or quest help I use Tip.it. There are a lot of quality sites out there, but Tip.it was the site I used when I first started playing, and therefore they are the first (and usually the only) place I need to go.

Q: Is there something you don't mind revealing about your RL (age, country, hobbies etc.)?
A: I live in the midwest USA. I play darts and do computer consulting. Love the Green Bay Packers.


Thank you very much, Absenm!