Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram Django site admin

instagram.com

Post reply on HN
Print view View original

41–47 of 47 posts

Re: Instagram Django site admin

#41

Post by cdjk »

pacifi30 wrote: post #10

How do you mask your admin portal when you are small enough that you dont have an intranet. Someone on hacker news pointed out to me about my admin portal being open but I never understood how to mask it. http://www.truffle.io/admin/ Any suggestions?

Limit access in the firewall/load balancer/webserver to whitelisted ip addresses. If you don't have static ips at your office or a vpn, include the ip of a VPS or dev server, and use ssh forwarding (-D for a socks proxy) to access the admin site. And if you're running everything from one server, you can even limit connections to localhost and tunnel connections through there.

Re: Instagram Django site admin

#42

Post by cwh »

tomp wrote: post #40
donbronson wrote: post #7

Pinterest and Instagram are both using Django. Then again, when you are scale like these sites, you start to build new architecture around existing stuff. Reference: http://highscalability.com/blog/2013/4/15/scaling-pinterest-...

Makes me wonder why there aren't more jobs for Django; Ruby on Rails still seems to be far more popular for new startups!

i believe it's because Rails is as easy as grabbing a shovel to dig a hole for yourself.

Re: Instagram Django site admin

#43

Post by tjohns »

pacifi30 wrote: post #20
StavrosK wrote: post #16

Earlier quoted context omitted.

That's a normal HTTPS cert, I'm talking about this: http://www.ibm.com/developerworks/lotus/library/ls-SSL_clien... Really, though, unless you're extremely security-conscious, a hidden URL over HTTPS with a good password is sufficient for your purposes. Also, don't serve any pages over plain HTTP, login pages even less so.

Thanks, I guess I ll explore the option that you described above. Also there is one more thing I am curious about, so heroku does gives a free SSL certificate but that only works for their domain meaning something like truffleapp.herokuapp.com, it doesn't work for the custom domain. Do you know any way where I can save money on buying SSL certificate and rather use heroku's certificate. All the certificates put atlea…

StartCom offers free SSL certificates that are recognized by most browsers: http://cert.startcom.org/

Heroku will still probably charge you a basic fee for enabling SSL, since each certificate requires a dedicated (non-shared) IP address... at least until SNI support becomes more commonplace.

Edit: Just to reiterate what others have said, this is a server-side certificate, which is primarily used for encryption. You'll also want to generate a client-side certificate for authentication purposes. That's something you'd do entirely on your own, no need to go through a third-party CA for that.

Re: Instagram Django site admin

#44

Post by tptacek »

davis_m wrote: post #38
MattBearman wrote: post #37

Earlier quoted context omitted.

Out of interest, would something as easy to find as this qualify for the bug bounty?

I would hope so. It shouldn't matter how "easy" something is to find. If the bug was really that easy, the team should have never let it out onto production.

Off the top of my head I can't speak to Facebook's program, but Google's terms include "substantially affects the confidentiality or integrity of user data". A login page that shouldn't be exposed is a marginal finding and might not qualify.

Also: obviously I don't speak for either Facebook or Google, but I strongly recommend against brute-forcing login prompts to try to prove the point that an exposed console is a real finding.

Re: Instagram Django site admin

#45

Post by dylangs1030 »

tptacek wrote: post #44
davis_m wrote: post #38

Earlier quoted context omitted.

I would hope so. It shouldn't matter how "easy" something is to find. If the bug was really that easy, the team should have never let it out onto production.

Off the top of my head I can't speak to Facebook's program, but Google's terms include "substantially affects the confidentiality or integrity of user data". A login page that shouldn't be exposed is a marginal finding and might not qualify. Also: obviously I don't speak for either Facebook or Google, but I strongly recommend against brute-forcing login prompts to try to prove the point that an exposed console is a r…

"Report a bug that could compromise the integrity of Facebook user data, circumvent the privacy protections of Facebook user data, or enable access to a system within the Facebook infrastructure"

^That's Facebook's. Theoretically, an exposed login page "could...enable access to a system within the Facebook infrastructure", but to be fair, I doubt they had that in mind.

Re: Instagram Django site admin

#46

Post by the_cat_kittles »

craigkerstiens wrote: post #25
the_cat_kittles wrote: post #13

I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.

A post or code snippet that does this would be great, seems like a really simple but useful people others may like

I changed django admin's base.css:

    #header {
       ... css ...
       background: ;
       ... more css ...
    }

Re: Instagram Django site admin

#47

Post by DirtyMonkey »

johndavidback wrote: post #34
spdy wrote: post #11

Would love to see the inside. If they use special dashboards etc. Maybe someone can give some insight.

It would actually be quite interesting to see how large enterprise clients modify/utilize the Django admin... if at all. Other than Grappelli, I've historically used the admin pretty much as-is. Creating admin functions is one thing, but lots of custom screens is quite another. I also think that's one thing really lacking from the Django documentation, really great customization of the Admin.

Most of the Django projects I've worked on, people tended to make their own admin panels with things like Bootstrap and Foundation. Django's core team have made their goals clear for the next admin, extensibility and adaptability. https://github.com/twoscoops/django-admin2
Post reply on HN