Quantcast StorefrontBacktalk » Blog Archive » July Reminders: Crashes You’re Blamed For That Aren’t Your Fault
advertisement
advertisement

July Reminders: Crashes You’re Blamed For That Aren’t Your Fault

Written by Evan Schuman
July 8th, 2009
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

With just four short months remaining before the holiday shopping season starts, it’s not like E-Commerce directors need reminding that Web sites have minds of their own and they’ll crash no matter what they do. Those directors also do not need reminding that they work for CFOs and CEOs who often seem to have no minds of their own and will blame them for anything that goes wrong with the site, despite facts and laws of nature.

But July has chosen to remind us of these sad realities anyway. The malicious Denial of Service attacks are still out there—as the U.S. and South Korean governments learned this week–and the most meticulous plans of backup procedures can still knock out a site (or a payment processor) for six hours, as Authorize.net discovered on July 2 when it was done in by a fire.

But the most frightening reminder happened at the very end of June, when singer Michael Jackson died, causing a flood of traffic of people looking for confirmation and details. The traffic spikes were so sudden and extreme that Google literally thought it was being hit by a DOS attack and shut down servers, before figuring out what had happened.

The parallel with E-Commerce is traffic preparedness. Major news Web sites certainly have a reasonable expectation that major world events will happen and that viewers will quickly try and turn to them for news. And in late November, the largest retailers need to be prepared for a tidal wave of traffic.

As retailers discovered during last year’s Black Friday, even if consumers plan on spending less online, they’ll still visit to try and find bargains. That means that lower revenues may just be married to higher traffic (just the kind of weddding your CFO would truly cry at).

When Keynote Systems started trying to analyze the Michael Jackson traffic and its impact on major news sites, it found the expected steep slowdown. But it also found an unexpected culprit: third-party content. That’s the same kind of content that retailers are relying on much more, as they try and cut costs while adding features for the holidays. Uh-oh.

Keynote’s Shawn White said the “main culprit of these performance and availability issues was third party content and providers’ ability to handle the flash crowd. This is an important distinction because, in some cases, depending upon how a site is constructed or how the Web browser is used, a page may display perfectly fine with a blank area where a third party image should have been shown. In other cases, the entire Web page will wait until that last image is downloaded from the third party advertisement service, frustrating the reader.”

Added White: “Our measurement data shows that for sites reported as having performance slowdowns yesterday, internal content delivered quite fast, however content that came from other sources contributed most to the site slowdowns.”

This is about when most E-Commerce directors are starting to make final calls to site partners, reminding them that they need to be able to handle the traffic. Michael Jackson has just given them one more reason to take those calls seriously.


advertisement

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...