Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram Django site admin

instagram.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: Instagram Django site admin

#31

Post by dalore »

pfg wrote: post #17
pacifi30 wrote: post #14

Earlier quoted context omitted.

Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.

Note that StavrosK is probably talking about SSL client authentication, which isn't what most people think about when talking about SSL. Basically, it enables you to allow access only to people with a certain client certificate installed in their browser (i.e., proving the clients' identity to the server, not just the other way around). Unfortunately I have no idea how this would work on Heroku. There's a great artic…

There is a module for django to do client ssl cert authentication. I haven't used it though but it seems maintained.

https://github.com/kimvais/django-ssl-client-auth

Re: Instagram Django site admin

#32

Post by aet »

workhere-io wrote: post #26
aet wrote: post #24

Earlier quoted context omitted.

I guess the point is that maybe you should restrict "people from the internet" from being able to access the login page.

I understand. My point was that it would be better to alert Instagram rather than direct a lot of HN users to a page that offers no value.

I agree. (Already fixed?)

Re: Instagram Django site admin

#34

Post by johndavidback »

spdy wrote: post #11

Would love to see the inside. If they use special dashboards etc. Maybe someone can give some insight.

It would actually be quite interesting to see how large enterprise clients modify/utilize the Django admin... if at all.

Other than Grappelli, I've historically used the admin pretty much as-is. Creating admin functions is one thing, but lots of custom screens is quite another.

I also think that's one thing really lacking from the Django documentation, really great customization of the Admin.

Re: Instagram Django site admin

#37

Post by MattBearman »

mikeyk wrote: post #30

Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected). We're also part of Facebook's bug bounty whitehat program ( https://www.facebook.com/whitehat/bounty/ ), if anyone comes across something in the future, we welcome responsible disclosure and pay out bounties through the program as well.

Out of interest, would something as easy to find as this qualify for the bug bounty?

Re: Instagram Django site admin

#38

Post by davis_m »

MattBearman wrote: post #37
mikeyk wrote: post #30

Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected). We're also part of Facebook's bug bounty whitehat program ( https://www.facebook.com/whitehat/bounty/ ), if anyone comes across something in the future, we welcome responsible disclosure and pay out bounties through the program as well.

Out of interest, would something as easy to find as this qualify for the bug bounty?

I would hope so. It shouldn't matter how "easy" something is to find. If the bug was really that easy, the team should have never let it out onto production.

Re: Instagram Django site admin

#40

Post by tomp »

donbronson wrote: post #7

Pinterest and Instagram are both using Django. Then again, when you are scale like these sites, you start to build new architecture around existing stuff. Reference: http://highscalability.com/blog/2013/4/15/scaling-pinterest-...

Makes me wonder why there aren't more jobs for Django; Ruby on Rails still seems to be far more popular for new startups!
Post reply on HN