We did experiment enough to verify that he couldn't actually use my account to post or vote, but it's still a little disturbing that he could see, for example, my personal messages.

One point I will note is that he's not clicking the "Remember me" checkbox when he logs in (he prefers to log in each day). This could be relevant. It also means that theoretically any Anonymous Monk in my company could be viewing my account on a daily basis!

I assume that our company's proxy server is caching things over-aggresively. Isn't there some way to circumvent this?

Update: I should be more explicit about something that drinkd alluded to. We work at a large corporation with a corporate IT group that is never ever going to bother reconfiguring the gateway solely for our PerlMonks viewing pleasure. This leads us to hope that the answer lies elsewhere. What we're wondering is: Should PerlMonks be using something like an Expires: header? Is it already doing this?

buckaduck

I run the squid proxy server at home and it has a configuration option to specify, based upon a url regexp, what things to cache or not to cache. I would suspect that most decent proxy programs have a way to do this. I'd suggest having your sysadmin look into this, because odds are, PM isn't the only site that your proxy will over aggressively cache.

/\/\averick
perl -l -e "eval pack('h*','072796e6470272f2c5f2c5166756279636b672');"

Perl Monks isn't the only site that doesn't deal with Web caches properly, but that's no reason for it to violate HTTP standards.

If an HTTP response makes no statement as to what a cache should do with it (no Last-Modified, Expires or Cache-Control), the document is considered cacheable.

I disagree that cache administrators should be held responsible for creating workarounds for non-compliant sites. Web site/application developers should be responsible for ensuring their code works properly.

A silly client side hack would be to access perlmonks through some of its lesser known aliases: http://yoda.blockstackers.com comes to mind....

Or, you could muck with your own DNS, (with /etc/hosts, its Windows equivalent, or a local DNS caching server) to point some other odd domain (ThisReallyIsForWorkIPromise.com perhaps??) at perlmonks IP.

If your cache is based on domain names (which I imagine it would be) this would prevent the casual anonymonk from tripping over your private messages.

-Blake

The problem is that this means the users will be putting a serious smack-down on the servers, even harder than they already down. The cache helps (usually...) on both ends, and, as already mentioned, this would not be the only site that would have this problem. So, all in all, I can't recommend a short cache-time for PerlMonks, which is already, one guesses, hard-up for bandwidth and processor time.

For you guys, I would recommed going to your company, because issues like this are security-related, and will affect more than one user. Or...in Mozilla, Go Edit/Preferences/Advanced/Cache, and change it to "Every Time I view the Page", and see if that doesn't help the problem.

----Asim, known to some as Woodrow.

We have already played with Mozilla's cache, to no avail. (Update: Although I should point out that Mozilla 0.9.5 does seem to overaggressively cache many things, regardless of the settings.) And we have also seen this happen with other browsers, such as IE.

Regarding the toll that this would take on PerlMonks: Maybe an expiration after 3 minutes would be extreme. But it currently isn't even expiring after 12 hours. That's a pretty long time. Even the front page changes more frequently than that...

buckaduck