Would love to see the inside.
If they use special dashboards etc.
Maybe someone can give some insight.
Instagram Django site admin
11–20 of 47 posts
Re: Instagram Django site admin
#12How do you mask your admin portal when you are small enough that you dont have an intranet. Someone on hacker news pointed out to me about my admin portal being open but I never understood how to mask it. http://www.truffle.io/admin/ Any suggestions?
Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.
Re: Instagram Django site admin
#13I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.
Re: Instagram Django site admin
#14How do you mask your admin portal when you are small enough that you dont have an intranet. Someone on hacker news pointed out to me about my admin portal being open but I never understood how to mask it. http://www.truffle.io/admin/ Any suggestions?
Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.
Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.
Re: Instagram Django site admin
#15I'm not sure what the point in linking to this is. If you regard it as security hole, alert Instagram. If you just want to let people know that Instagram uses Django... well, that information is already on https://www.djangoproject.com.
Re: Instagram Django site admin
#16Earlier quoted context omitted.
Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.
Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.
That's a normal HTTPS cert, I'm talking about this:
http://www.ibm.com/developerworks/lotus/library/ls-SSL_clien...
Really, though, unless you're extremely security-conscious, a hidden URL over HTTPS with a good password is sufficient for your purposes.
Also, don't serve any pages over plain HTTP, login pages even less so.
Re: Instagram Django site admin
#17Earlier quoted context omitted.
Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.
Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.
Note that StavrosK is probably talking about SSL client authentication, which isn't what most people think about when talking about SSL. Basically, it enables you to allow access only to people with a certain client certificate installed in their browser (i.e., proving the clients' identity to the server, not just the other way around).
Unfortunately I have no idea how this would work on Heroku.
There's a great article about client authentication for HAProxy (might be interesting even if you're not using HAProxy): http://blog.exceliance.fr/2012/10/03/ssl-client-certificate-...
Re: Instagram Django site admin
#18Earlier quoted context omitted.
Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.
Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.
you can also put up a htpasswd if you can on that directory, every bit helps.
Re: Instagram Django site admin
#19BlackJet Django admin: https://www.blackjet.com/admin/
Re: Instagram Django site admin
#20Earlier quoted context omitted.
Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.
That's a normal HTTPS cert, I'm talking about this: http://www.ibm.com/developerworks/lotus/library/ls-SSL_clien... Really, though, unless you're extremely security-conscious, a hidden URL over HTTPS with a good password is sufficient for your purposes. Also, don't serve any pages over plain HTTP, login pages even less so.
Thanks, I guess I ll explore the option that you described above. Also there is one more thing I am curious about, so heroku does gives a free SSL certificate but that only works for their domain meaning something like truffleapp.herokuapp.com, it doesn't work for the custom domain. Do you know any way where I can save money on buying SSL certificate and rather use heroku's certificate. All the certificates put atleast a 1000$ hole in the pocket but eventually in a week or so if I can't figure out how to use heroku SLL, I have to spend that money