<a id="ch-19"></a>

## Chapter 19 — Thirty days is not ninety

<!-- open-cyber-academy:lesson-figures:start ch-19 -->
### Lesson map

Lesson 19. Map, example, EX065.

```mermaid
flowchart TD
  E["Email sign-in logs: 30 days"] --> N["A note, not a lab column"]
  D["Donation logins: 90 days"] --> N
  G["A service with no useful log"] --> S["Record the gap"]
  S --> Q{"Does silence mean safe?"}
  Q -->|No| K["A gap is not a clearance"]
```

The retention figures are prose. Neither script prints them.

### Logical drawing

```text
prose
  email sign-ins, 30 days
  donation logins, 90 days
labs print
  neither integer
gap
  no useful log means write the gap
  do not read silence as safety
```
<!-- open-cyber-academy:lesson-figures:end ch-19 -->

### Learning outcomes

After this chapter, you should be able to:

1. Pair each retention figure with its log.
2. Keep both figures out of the lab prints.
3. Refuse silence as a proof that nothing happened.

### 19.1 The consoles keep different windows. A missing window is written down.

Email sign-in logs at EFBN last 30 days. Donation-platform login logs last 90 days. Those integers come from Sam's check of the provider consoles. `lab_sources.py` prints dependency names and one independent list. `lab_rapid.py` prints an invalid value, a length, two hits, and a community list. Neither output contains 30 or 90. A note that writes `valid: 30` has pasted a retention figure onto the wrong page.

When a service offers no useful log, Sam records the gap. The absence of rows is not a successful review. Stuffing-alert follow-up, in the earlier chapter, did show failed attempts and no successful login. That is an observation from a log that existed. It is not the same sentence as "this other service has no log, therefore nothing failed." The gap stays a gap. No vendor product name is printed for these consoles, so the note does not add one.

Two-step login and the backup settings were chosen because of intelligence about stolen passwords and ransomware. They are settings. They are not rows in either lab, and they do not change 30 into 90.

| Fact | Page |
|---|---|
| 30 days | Email sign-in note |
| 90 days | Donation login note |
| `valid: 3` | The indicator lab, not a retention |
| A missing log | A gap, not a clearance |

### 19.2 Worked example

| Offered line | Page it belongs on | Decision |
|---|---|---|
| "Email 30, donation 90." | The console note | Keep |
| "No useful log is written as a gap." | The limit | Keep |
| "valid: 3 means the logs last three days." | Wrong page | Refuse |
| "The quiet free tier proves no failed logins." | Silence is not that proof | Refuse |

> **Synthetic case.** The windows are EFBN's notes about its providers.

### Errors and limits

Do not launder a missing log into a clean bill of health.

### Apply

- **EX065 — Two windows.** How long do the email and donation logs last, and does either lab print those integers? *Rubric:* 3 = email sign-ins 30 days and donation logins 90 days; neither lab prints 30 or 90; a missing log is a gap, not proof of safety;; 2 = the two windows stay prose and silence is not a clearance;; 1 = one number;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-19 -->
### Continue studying — lesson 19 (chapter 19 of 20)

[← Chapter 18](#ch-18) · [Course chapter index](../SUBJECTS.md) · [Chapter 20 →](#ch-20)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex065"></a>
**EX065.** Email sign-ins last 30 days and donation logins last 90 days. Neither lab prints those integers. A missing log is a gap, not proof of safety.
