One slash made Google flag every website as harmful

transcript

One character put a malware warning on every Google result. Not one dodgy site. Every site.

31 January 2009, early morning. You search on Google. Under the result: this site may harm your computer. Next result? Same warning. And the next. Each and every one.

The warning comes from a list of sites known to install malware. That morning, Google pushed a periodic update to the list. In Google's words: here's the human error. A slash got checked in. A slash starts every web address. So it matched all URLs. Every site on the web was now on the harmful list.

The list rolls out in stages. Warnings appear from 6:27 to 6:40. Google's on-call team finds it fast and reverts the file. Warnings vanish from 7:10 to 7:25. About 40 minutes per user. Same day, Marissa Mayer apologises on the official Google blog.

A data file that touches every request is as risky as code. One entry that matches everything should never pass a check. Roll it out in stages. Keep a fast revert.

Full breakdown in the lecture.