Re: Adding a Remember Me on this very site
- 10/12/2007 20:07:29
- JMorris
Sounds like a reasonable compromise.
ImpressCMS Professional Services: INBOX International inc.
James Morris Online | Frolicking on the playground that is the Internet...
Re: Ohloh: the open source network
- 10/12/2007 19:41:09
- marcan
Steve, login to your Ohloh account and then go here :http://www.ohloh.net/projects/10042/contributors/50460
Click on the "I am this person" link on the oper right.
And everyone else, please do the same 
Let me know if you have any issue !
Re: Ohloh: the open source network
- 10/12/2007 19:29:26
- Dave_L
I see that Ohloh is headquartered in Bellevue, WA. There's not some sinister connection with Microsoft, is there? (Microsoft is about five miles from Bellevue.)
Re: Ohloh: the open source network
- 10/12/2007 19:22:42
- skenow
I am this person - http://www.ohloh.net/accounts/12188
Re: Adding a Remember Me on this very site
- 10/12/2007 18:33:01
- marcan
So can we agree on this: put Gijoe's remember me feature in the core, controlled by a preference, turned Off by default.
Re: Ohloh: the open source network
- 10/12/2007 18:08:59
- marcan
Ok Ohloh have updated our project (they update projects about once a week), so now, I am not the only developer, yé !!!
http://www.ohloh.net/projects/10042/analyses/latest/contributors
Can I ask the people who have committed in our SVN to go on the previous link, click on your name and then on "I am this person" link on the upper right so Ohloh can associate your SF username with your Ohloh account (of course, if you don't yet have an Ohloh account, please creat one first).
Also, in your profile, please edit your physical location so the map can show the physical location of all ImpressCMS developer.
I know all this may sound not usefull, but I believe this is important from a marketing's perspective. It is important to show the project does not rely on only 1 developer, and that contributors are spread all around the world.
Thanks for your collaboartion on that matter !
Re: Adding a Remember Me on this very site
- 10/12/2007 16:32:53
- Vaughan
agreed with james & dave's points.
we just need to weigh up the convenience vs potential risks involved and agree to them either way.
which brings me to another feature request i think would be useful.
in admin we could do with a function that will instantly flush the session table and basicly destroy all current valid sessions without the need for going into the db manually, or changing the session name.
The beauty of a living thing is not the atoms that go into it, but the way those atoms are put together!
Re: Adding a Remember Me on this very site
- 10/12/2007 16:25:48
- Dave_L
It is a potential security risk. One reason is using the feature on a shared computer, and neglecting to log out. Another reason is that it makes it easier for an attacker to gain access by hijacking an existing active session.
For these reasons, it should be disabled by default, and the setting in the admin page should have a note explaining the risk.
But it's also a very convenient feature. I think that the individual webmaster should have the choice of whether to use the feature for his site.
Re: ImpressCMS Theme
- 10/12/2007 16:13:42
- JMorris
Yeah, it's still rough. My brain is mush right now. I'll have to take a look at it tomorrow. Thanks!
ImpressCMS Professional Services: INBOX International inc.
James Morris Online | Frolicking on the playground that is the Internet...
Re: Modules
- 10/12/2007 16:10:55
- JMorris
I agree and disagree on this one.
I think there should be some form of content management that is native to the core. Perhaps a "page" functionality with native WYSIWYG. Also a set of classes that enable you to output a ordered listed of recent pages in either templates or blocks.
If we are going more in the direction of Community Management Software, then I don't think modules should be bundled with the core. Core devs could still work on Mod dev teams, take Marcan for instance, but I don't think modules should be packaged with the core.
Now, if it is decided we move more towards true Content Management, then I would retract the above statement about bundling modules. Provided the modules bundled pertained to content management. (news, document management, blog, etc).
ImpressCMS Professional Services: INBOX International inc.
James Morris Online | Frolicking on the playground that is the Internet...
Re: Adding a Remember Me on this very site
- 10/12/2007 16:02:33
- JMorris
Any "feature" that introduces a potential security risk that only provides functionality that can easily be replicated with one mouse click in a browser is a "feature" that has too high of a risk to justify its usefulness IMHO. But then again, I am p@r@n0!d. 
ImpressCMS Professional Services: INBOX International inc.
James Morris Online | Frolicking on the playground that is the Internet...
Re: Adding a Remember Me on this very site
- 10/12/2007 15:55:48
- Vaughan
james, i understand some of the security ramifications of 'remember me', but i honestly don't think it's as big an issue as all the other exploits and vulnerabilities that crackers/hackers & script kiddies use to gain access.
I haven't seen or heard of any sites being hacked where the entry point was via the remember me hack.. most of what i have come across have been some kind of SQLi or input validation methods, or files placed on the server through various methods.
but of course it's open to discussion :)
The beauty of a living thing is not the atoms that go into it, but the way those atoms are put together!
Re: usage of rel="external nofollow"
- 10/12/2007 15:51:51
- JMorris
rel="nofollow" will be interpreted by Google as a paid link. Also, rel=nofollow does not pass PR.
See: Use rel=nofollow Only When Needed for my views on rel=nofollow
rel=external is a different story. I know there is the relationship defined by the XFN and microformats, but we need to also look at the SEO implications.
ImpressCMS Professional Services: INBOX International inc.
James Morris Online | Frolicking on the playground that is the Internet...
Re: Adding a Remember Me on this very site
- 10/12/2007 15:43:01
- JMorris
-1 For security reasons.
ImpressCMS Professional Services: INBOX International inc.
James Morris Online | Frolicking on the playground that is the Internet...
Re: Remember me
- 10/12/2007 14:51:31
- Dave_L
Since it's a potential security risk, I think it should be "off" by default.
Re: Remember me
- 10/12/2007 14:41:30
- sudhaker
Yeah, webmaster should be able to turn it on-off using some config parameter. Let me evaluate the implementation part. I've a feeling that it may become a big change running across core and modules.
Thanks,
Re: Adding a Remember Me on this very site
- 10/12/2007 14:34:14
- Vaughan
yes i think it maybe a good idea. it has my vote.
i think once we become community.impresscms.org tho, we should be using impresscms core imo. think gijoe hack should be included in impresscms core as default (but with an option in admin to disable it on a group basis)
for now i've set the session time here to 24hrs.
The beauty of a living thing is not the atoms that go into it, but the way those atoms are put together!
Re: Welcome Sudhaker !
- 10/12/2007 14:24:54
- sudhaker
Thanks everyone for this warm welcome! It is really my honor to become part of this great team
ImpressCMS is a multi-language content management system for the web. It is community-built, an open source project and based on the common web technologies of PHP and MySQL.
Meer Info
