Home

Web dev took down major online bookstore by buying too many books

Who, Me? Thank you, dear reader, for tearing yourself away from Black Friday and Cyber Monday sales long enough to visit The Register, just in time for this fresh installment of Who, Me? It's the reader-contributed column in which we share your stories of unforced errors, and how you bounced back afterwards.

This week, meet a reader we'll Regomize as "Jim" who in the early 1990s worked for an online bookstore.*

"It was a startup when I worked there," Jim wrote, explaining that he helped to design and build the bookstore on Windows NT 4, Windows 2000 Server, Internet Information Server, and SQL Server. Those products supported a site structure that used subdomains for different types of products. Users could therefore visit books.bookstore.com to buy books, or video.bookstore.com to buy DVDs, and so on.

To keep the site humming, Jim would run a site crawler to find broken links, bad images, and even spelling errors.

His weapon of choice, Microsoft Site Server, needed careful handling.

"I had to make sure that it did not click links that would add things to a shopping cart, as this would go into the 'shop' database with a cookie link to the 'user' and could cause problems, as the cart server would hold contents of the cart for 24 hours," Jim explained.

Jim made it work and thought little of it.

Then the company decided it had outgrown SQL Server and migrated to a new platform that would allow it to do accurate just-in-time inventory reporting. "It meant we could show the number of items in stock and how quickly we could deliver," Jim explained. "It was a very big deal at the company, because it put us ahead of our competitors."

To make this new platform work, the bookstore needed to change subdomains. So out went the old shop.bookstore.com and in came shoppingcart.bookstore.com.

Naturally, Jim added the new subdomain to the list of sites his crawler considered.

But he forgot to stop it clicking "add to cart" links.

The consequences of that omission became apparent when Jim's two-way pager interrupted his lunch.

The bookstore's VP of engineering asked Jim if he was scanning the site and, if so, could he stop it ASAP?

"I raced back to my desk and stopped the crawler," Jim told Who, Me? He soon saw that the phantom account the crawler used had thousands of books in its shopping cart.

Then the VP of engineering pointed out that Jim's colossal cart – which contained merchandise valued at more than $50,000 – somehow meant actual customers could not add items to their own carts, or check out and pay for products.

Jim raced to fix the problem, but it took 45 minutes before the site resumed normal operations.

This story has a happy ending as post-incident analysis showed two things.

One was that anybody who crawled shop.bookstore.com could create the same problem. So Jim had found a flaw worth fixing. The other was that most customers returned to complete their purchases once he fixed the problem. So Jim kept his job, and the bookstore operates to this day!

Have you made a mistake that halted the march of e-commerce or took down a website? If so, click here to send an email to Who, Me? We consider every story that comes our way and handle them all with care, as we hope this week's installment demonstrates. ®

*It's the one that grew out of a bricks-and-mortar bookstore chain and has a name that sounds like a law firm, not the one named after a river.

Source: The register

Previous

Next