The client and the context
OFCE is the Observatoire français des conjonctures économiques, the French Economic Observatory and the economics research center of Sciences Po. It publishes forecasts, working papers, policy briefs, a journal and a blog.
Since 2021, its teams have produced a growing share of this content with R, Quarto and GitHub. The blog and the forecasts already came out of this pipeline. The rest of the site, meaning the home page, the institutional pages and the publication lists, relied on an old PHP system and its database. OFCE planned to overhaul it, and we had audited its publishing pipeline and its websites a year earlier.
Our contact was Xavier Timbeau, Principal Director of OFCE.
The problem
In late January, the Sciences Po IT department took the site offline after a security flaw was discovered in the old site. The blog and the forecasts, hosted in the same place, disappeared with the rest.
OFCE needed to get back online as fast as possible, even in a reduced form, then to restore its publications. The reopened site also had to be accepted by the Sciences Po IT department.
What we did
Xavier Timbeau wrote to us on the day of the shutdown. Two hours later, we sent a proposal in two phases, an emergency return online then a gradual restoration.
Start with what already existed. The blog and the latest forecast were Quarto projects, stored in GitHub repositories. They could therefore come back online without waiting for the rest to be migrated, and we published them behind a new home page, also written in Quarto. OFCE got back first the content it considered a priority. The old site remained available internally, behind restricted access, while its content was being migrated.
Remove PHP and the database. For the restoration, we rebuilt everything as a static site, meaning HTML pages produced in advance and placed as is on the hosting. No program runs on the server and no database is queried, which removes the components through which a site of this kind gets attacked. OFCE already produced its blog and its forecasts this way, and we extended that choice to the whole site. It is published through the process the team used for the blog, with files tracked on GitHub and a GitHub Action that sends them to the hosting.
Leave the team in control. OFCE had to be able to keep its site up to date without going through us. The content of each block on the home page is therefore edited in a text file, and the blog block fills itself from the latest published posts. The lists of policy briefs, working papers and reports are generated from data files.
The challenge: the Revue de l’OFCE
The Revue de l’OFCE, a peer-reviewed journal, did not fit the lists we used for the other publications. On the site, each issue must have its own page, with the full PDF, the link to buy it and the PDF of each article. We had to handle two levels, the issue and its articles, where the other publications have only one.
The list of issues and articles was in the old site’s database. We exported it once to a single text file, which describes 82 issues and their 982 articles. A program runs before each build of the site and creates the page of each issue from this file, so publishing a new issue comes down to adding an entry at the top of the file.
That left 2,159 PDFs of the Revue published before 2012, all of which OFCE wanted to keep. That was too much for the repository that holds the site’s code. We placed them directly on the hosting, after checking that the automated publication only deletes the files it has placed there itself.
The results
Three days after the shutdown, OFCE had its home page, its blog and its latest forecast back. The same day, the security meeting with the Sciences Po IT department approved the new setup, and its vulnerability scan, run on 458 pages, found no critical vulnerability.
The restoration was delivered fifteen days after the shutdown. OFCE got back its policy briefs, its reports, its past forecasts and 766 working papers published since 1982. The researchers’ pages and the English version, left out of scope from the quote stage, were deferred to a later phase.
Since then, OFCE has updated the site itself. In the four months following delivery, it recorded more than 110 changes without any intervention from us, most of them made by its Principal Director. It then asked us to support the further development of the site.
Does your website need to be brought back into service quickly, or rebuilt on a foundation that is simpler to secure? Get in touch.