I was initially thinking that it would make sense to always ask yourself "how long should this take" and tune appropriately, but for the vast majority

I was initially thinking that it would make sense to always ask yourself "how long should this take" and tune appropriately, but for the vast majority of regexes that's overkill More than being overkill, it's actually impossible right? The execution time will also vary greatly based on base CPU performance, and current server load. A regexp that takes 10ms to process right now might take 500ms tomorrow when your server is under heavy load. So we can't predict how much time each regexp "needs." But, like you said, we can set a somewhat ridiculously high limit to help prevent regex-based oopsies or re-based DoS attacks from dragging us down =)