Global trade search tool needs YOUR help

cyx54tc · April 2016

Tamriel Trade Centre is aiming to provide a powerful search engine for everyone to search the market more easily.

In order for this to work, we need to gather store listing data across Tamriel and this is where YOU can help.

FAQ could be found Here

By running our addon and client (download from our site or Minion/ESOUI). Your guild listings as well as any item you seen by using guild store search function will be automatically upload to the site for other people to search and browse. The collected data will also be used to generate price info for everyone~

If you want to contribute more to the community or if you wish to help boosting up your guild's sale by uploading an entire guild's listings, you are more than welcome to do so!

Here are some screen shots of the site, addon and client

Search Page

Listings collected during search will show up as Community

Client

wayfarerx · April 2016

This is a cool idea and something I've thought of working on myself, however there is a serious problem with how you currently have this set up: you are asking people to run an unsigned executable downloaded over an unencrypted HTTP connection. This is a big no-no.

Even without malice on the part of the original developers, the process for installing and running the native executable is rife for being exploited by nefarious individuals. They could circumvent the above process and, once they gain access to your machine, steal everything from your ESO account information to credit card numbers to credentials for completely unrelated accounts. I suggest everyone use extreme caution when running the supplied executable.

Some things that could be done to make the situation better:

Get a HTTPS certificate for tamrieltradecentre.com. You can get these for free nowadays from Let's Encypt, a widely-trusted certificate authority.
Sign your executable so that users know it has not been tampered with. This process can be somewhat complex and/or expensive, but offers a significant amount of assurance to the user that the executable is safe to run.
Make the source code to your software available under whatever license you like as long as it allows the user to download, inspect and compile the application themselves. A modification-friendly license might even convince people to contribute back to the project.

Personally, I would not run this without access to the source code, but at a bare minimum you should be distributing the executable file over HTTPS.

cyx54tc · April 2016

wayfarerx wrote: »

This is a cool idea and something I've thought of working on myself, however there is a serious problem with how you currently have this set up: you are asking people to run an unsigned executable downloaded over an unencrypted HTTP connection. This is a big no-no.

Even without malice on the part of the original developers, the process for installing and running the native executable is rife for being exploited by nefarious individuals. They could circumvent the above process and, once they gain access to your machine, steal everything from your ESO account information to credit card numbers to credentials for completely unrelated accounts. I suggest everyone use extreme caution when running the supplied executable.

Some things that could be done to make the situation better:
Get a HTTPS certificate for tamrieltradecentre.com. You can get these for free nowadays from Let's Encypt, a widely-trusted certificate authority.

Sign your executable so that users know it has not been tampered with. This process can be somewhat complex and/or expensive, but offers a significant amount of assurance to the user that the executable is safe to run.

Make the source code to your software available under whatever license you like as long as it allows the user to download, inspect and compile the application themselves. A modification-friendly license might even convince people to contribute back to the project.

Personally, I would not run this without access to the source code, but at a bare minimum you should be distributing the executable file over HTTPS.

Thanks for pointing this out. I have went ahead and added SSL support and its expected to be up tomorrow.

But I would say code sign would not be necessary. I do understand that code sign will help user to verify that the executable is distributed by "me" not the modified version from a malicious user thus it increases security. As long as the user is not downloading it from an arbitrary site this shouldn't be an issue.

I will think about #3 but I have no plan of doing so right now.

If you are really concerned about security issue, you can always run it under a Virtual machine. Just create a folder structure like this

Live
AddOns
SavedVariables

then copy the addon/saved variable file into the corresponding folder and run it. It will have the same result.

Sausage · April 2016

Cant they just add Global Search as Outlaw Den service, you give them gold, they search for you and send you the coords of the trader.