Quantcast StorefrontBacktalk » Blog Archive » Dark For 36 Hours: Burlington’s Web Gambit
advertisement
advertisement

Dark For 36 Hours: Burlington’s Web Gambit

Written by Evan Schuman and Fred J. Aun
November 18th, 2009
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

Leaving online shoppers out in the cold with no warnings or explanations (or coats, if that’s what they wanted to buy), Burlington Coat Factory took its Web site offline all day Wednesday (Nov. 18)—plus about 12 hours split between Tuesday and Thursday—for a planned outage as the $3.5 billion clothing retailer performed an extensive hardware and database upgrade.

In what a senior company official conceded was an oversight, the 430-store, New Jersey-based chain failed to publish any ahead-of-time advisories before yanking its E-Commerce site’s plug in the wee hours. Nor did it post much in the way of an explanatory statement during the long downtime period that followed.

“The Burlington Coat Factory site is temporarily unavailable. Please check back later” was the extent of the message presented to visitors while the site was AWOL. Burlington Coat Factory Supervisor of Web Development Jack Follansbee acknowledged the blunder and said that the retailer should have told visitors when its site was expected to return.

“The messaging on the site could clearly have been better,” Follansbee said. “It was an omission. We should have done something (a status page) a little more customized.”

The outage had long been planned to start Tuesday night and last all day Wednesday and into the early morning hours of Thursday, Follansbee said. “Wednesday is actually the lowest revenue day for our Web site,” he said.

The need for the upgrade seems to have been demonstrated earlier in the week, something visitors to www.coat.com might have learned the hard way, as the site began experiencing sporadic, short-lived outages as early as Monday, according to site monitoring companies Dotcom-Monitor and Alert-Bot. “On Monday, it went down for five minutes with an HTTP 503 server-too-busy outage,” said AlertBot Sales and Marketing Manager Justin Noll, adding that the site was offline for brief periods up until shortly after 2:00 A.M. (New York time) Wednesday. At that point, the lights went out completely.

Follansbee said the site was actually taken down at 10:00 P.M. (New York time) Tuesday and was targeted to be back up at 2:00 A.M. (New York time) Thursday. (Editor’s Note: It seems as though Burlington Coat missed its target to be back up by 2 AM. According to site monitor services, Coat.com returned to the living at about 9:50 AM Thursday.)

Follansbee said he was not surprised the site was sputtering before the patient was euthanized. “We’ve been trying to migrate off obsolete hardware,” he said. Any intermittent outages were “related to getting off the infrastructure we are replacing. The deteriorating performance of the old hardware was one of the reasons for the upgrade.”

The effort was to perform a major upgrade to the chain’s Oracle Application Server in addition to “a complete hardware and software refresh of our E-Commerce platform,” including an operating system upgrade and “getting off some old disk arrays that we’ve been trying to retire,” Follansbee said. “Everything is being refreshed.”

Internal projections had the database upgrade alone taking 19 hours. “We needed a full 24-hour outage to do the upgrade, to do the tidying up,” he said, adding that some of these upgrades were attempted last year—under a different executive’s jurisdiction—and had “failed.” Why had it failed. “Nobody seems to remember,” Follansbee said.

The changes will not deliver any immediate functionality improvements but will enable such improvements shortly, including an improved capability to handle the accounting backend operations needed for selling stored-value cards online.

Although Burlington Coat Factory’s situation clearly doesn’t qualify as mere site maintenance, one of Alert-Bot’s Noll’s pet peeves is the way some major retailers regularly take their E-Commerce sites offline for nightly tweaking.

“These major brands should not have scheduled maintenance,” he said, noting there is technology available that allows companies to update sites without incurring extensive downtime. “You don’t need to take down your Web site to do updates, but you see these huge, Fortune 500 companies doing it. I don’t know if they’re skimping on IT spending, but I can’t see why they are updating every night for two or three hours. When we do consulting, we tell them the most amount of downtime we consider acceptable is 20 minutes per month for scheduled maintenance.”

That said, the Burlington changes included extensive upgrades to key hardware plus multiple pieces of strategic software. By completely taking down the site, the E-Commerce group was theoretically able to complete all of its major changes in barely more than one day. (We stress: “In theory.”) An attempt to perform these changes while maintaining site functionality would have almost certainly caused the upgrades to take far longer, an undesirable luxury right before the crucial holiday shopping season. Noll’s point has merit in general, but Burlington’s effort seems like a valid exception.


advertisement

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...