Instagram Django site admin • Hacker News Board

Re: Instagram Django site admin

#21

Post by ing33k » Thu, Jun 13, 2013, 2:35 PM UTC

StavrosK wrote: post #12

pacifi30 wrote: post #10

How do you mask your admin portal when you are small enough that you dont have an intranet. Someone on hacker news pointed out to me about my admin portal being open but I never understood how to mask it. http://www.truffle.io/admin/ Any suggestions?

Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.

tbh , was not aware of creating private ssl certificates for this purpose .. Thanks

Re: Instagram Django site admin

#22

Post by tingletech » Thu, Jun 13, 2013, 2:42 PM UTC

pacifi30 wrote: post #20

StavrosK wrote: post #16

Earlier quoted context omitted.

That's a normal HTTPS cert, I'm talking about this: http://www.ibm.com/developerworks/lotus/library/ls-SSL_clien... Really, though, unless you're extremely security-conscious, a hidden URL over HTTPS with a good password is sufficient for your purposes. Also, don't serve any pages over plain HTTP, login pages even less so.

Thanks, I guess I ll explore the option that you described above. Also there is one more thing I am curious about, so heroku does gives a free SSL certificate but that only works for their domain meaning something like truffleapp.herokuapp.com, it doesn't work for the custom domain. Do you know any way where I can save money on buying SSL certificate and rather use heroku's certificate. All the certificates put atlea…

If you are just using ssl on your admin site; you could roll your own.

  openssl req -new -x509 -nodes \
        -out /nuxeo/certs/server.crt \
        -keyout /nuxeo/certs/server.key \
        -batch

you will get a warning about the certificate being suspect; but at least the traffic will be encrypted

Re: Instagram Django site admin

#23

Post by dopamean » Thu, Jun 13, 2013, 2:42 PM UTC

stefs wrote: post #6

dlsym wrote: post #4

admin:admin doesn't work.

file a bug report "login is broken"

This is the best idea in this thread.

Re: Instagram Django site admin

#24

Post by aet » Thu, Jun 13, 2013, 2:45 PM UTC

workhere-io wrote: post #15

I'm not sure what the point in linking to this is. If you regard it as security hole, alert Instagram. If you just want to let people know that Instagram uses Django... well, that information is already on https://www.djangoproject.com .

I guess the point is that maybe you should restrict "people from the internet" from being able to access the login page.

Re: Instagram Django site admin

#25

Post by craigkerstiens » Thu, Jun 13, 2013, 2:46 PM UTC

the_cat_kittles wrote: post #13

I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.

A post or code snippet that does this would be great, seems like a really simple but useful people others may like

Re: Instagram Django site admin

#26

Post by workhere-io » Thu, Jun 13, 2013, 2:47 PM UTC

aet wrote: post #24

workhere-io wrote: post #15

I'm not sure what the point in linking to this is. If you regard it as security hole, alert Instagram. If you just want to let people know that Instagram uses Django... well, that information is already on https://www.djangoproject.com .

I guess the point is that maybe you should restrict "people from the internet" from being able to access the login page.

I understand. My point was that it would be better to alert Instagram rather than direct a lot of HN users to a page that offers no value.

Re: Instagram Django site admin

#27

Post by wrboyce » Thu, Jun 13, 2013, 2:53 PM UTC

It seems to have (just) changed to a non-standard (different to the rest of Instagram's) 404 page.

Re: Instagram Django site admin

#28

Post by rajbala » Thu, Jun 13, 2013, 2:54 PM UTC

They removed the link to the admin page.

Re: Instagram Django site admin

#29

Post by sevenproxies » Thu, Jun 13, 2013, 2:57 PM UTC

craigkerstiens wrote: post #25

the_cat_kittles wrote: post #13

I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.

A post or code snippet that does this would be great, seems like a really simple but useful people others may like

Simple browser-side CSS does the trick. I use Stylish[1] for Chromium. I believe there is also a Firefox version.

[1] - https://chrome.google.com/webstore/detail/stylish/fjnbnpbmke...

Re: Instagram Django site admin

#30

Post by mikeyk » Thu, Jun 13, 2013, 2:58 PM UTC

Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected).

We're also part of Facebook's bug bounty whitehat program (https://www.facebook.com/whitehat/bounty/), if anyone comes across something in the future, we welcome responsible disclosure and pay out bounties through the program as well.