MIME-Version: 1.0
In-Reply-To: <20130427140914.GA20361@momjian.us>
References: <5179CD76.6030908@agliodbs.com>
	<CABUevEymuYyyof68ASuDt9GBpFOvF2r0WNyk8JxK1nbGG70Rpw@mail.gmail.com>
	<517A6C78.7000101@xk7.net>
	<CABUevEw0asBAR6jS=aqKBG1OAJmTsMP1FiocCm-cLJfqGEAm_w@mail.gmail.com>
	<517A7144.4070204@xk7.net> <517B729C.4060906@kaltenbrunner.cc>
	<517B7658.9070209@commandprompt.com>
	<517B9613.4090201@kaltenbrunner.cc>
	<20130427140914.GA20361@momjian.us>
Date: Sat, 27 Apr 2013 17:24:51 +0200
Message-ID: 
 <CABUevEwn9jDpaVSHb9c74WR0tOjjZYPgk4VgpB97V9+Go4dtYQ@mail.gmail.com>
Subject: Re: Can we change auto-logout timing on wiki.postgresql.org?
From: Magnus Hagander <magnus@hagander.net>
To: Bruce Momjian <bruce@momjian.us>
Cc: Stefan Kaltenbrunner <stefan@kaltenbrunner.cc>,
	"Joshua D. Drake" <jd@commandprompt.com>,
	Paul Waring <paul@xk7.net>, PostgreSQL WWW <pgsql-www@postgresql.org>
Content-Type: text/plain; charset=ISO-8859-1
Precedence: bulk
Sender: pgsql-www-owner@postgresql.org

On Sat, Apr 27, 2013 at 4:09 PM, Bruce Momjian <bruce@momjian.us> wrote:
> On Sat, Apr 27, 2013 at 11:10:43AM +0200, Stefan Kaltenbrunner wrote:
>> On 04/27/2013 08:55 AM, Joshua D. Drake wrote:
>> >
>> > On 04/26/2013 11:39 PM, Stefan Kaltenbrunner wrote:
>> >
>> >> interesting hint - thanks.
>> >>
>> >> I have now increased the relevant timeouts to 6h - lets see how that
>> >> goes..
>> >
>> > FTR, I don't think we should autologout people or at least it should be
>> > set to something like 7D.
>>
>> well from a security perspective it is usually advisable to keep session
>> lifetimes as short as possible, I agree that the current setup was way
>> to aggressive, but 6h already results in a 6-15x increase of what we had
>> before. We can always adjust upwards if we people are really working 6h+
>> on an article but lets see first if this change really fixes the issue
>> berkus complained about.
>
> This is a wiki, not a banking website.  We need to use security that is
> appropriate for what we are guarding.  We could just prevent edits and
> it would be even more secure.  ;-)
>
> I would like 7 days, myself.

Note that this is not 7 days since you logged in. It's 7 days since
you last did something. And as long as you don't stop working, you
never get logged out ;)


--
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/


-- 
Sent via pgsql-www mailing list (pgsql-www@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-www