Instagram Django site admin(instagram.com)

83 pointsby lestvor 13 Jahren46 comments

https://instagram.com/django/

15 comments

spdyvor 13 Jahren

Would love to see the inside. If they use special dashboards etc.

Maybe someone can give some insight.

It would actually be quite interesting to see how large enterprise clients modify/utilize the Django admin... if at all.

Other than Grappelli, I've historically used the admin pretty much as-is. Creating admin functions is one thing, but lots of custom screens is quite another.

I also think that's one thing really lacking from the Django documentation, really great customization of the Admin.

DirtyMonkeyvor 13 Jahren

Most of the Django projects I've worked on, people tended to make their own admin panels with things like Bootstrap and Foundation. Django's core team have made their goals clear for the next admin, extensibility and adaptability. https://github.com/twoscoops/django-admin2

gregorkasvor 13 Jahren

Although it's been a while since I've done anything in Django, seeing this still gives me a warm feeling.

zalewvor 13 Jahren

it may be a honeypot. I sometimes set up a bogus form under /admin/ which logs attempts. adrian holovaty on the other hand, redirects /admin/ to django docs http://www.holovaty.com/writing/admin-easter-egg/

//edit: oh, now I see somebody thought of my idea too https://github.com/dmpayton/django-admin-honeypot

Legogrisvor 13 Jahren

Given that they don't seem to have any automatic tests or similar for their APIs (check out their Google group and you'll see that stuff have been broken for a long time for all users without attention. When stuff has been broken in the past, Instagram people will ask "is this still a problem?", like they have no way of checking their own APIs...), I wouldn't expect them to be that crafty.

dlsymvor 13 Jahren

admin:admin doesn't work.

stefsvor 13 Jahren

file a bug report "login is broken"

dopameanvor 13 Jahren

This is the best idea in this thread.

antidailyvor 13 Jahren

tried that too. LOL.

donbronsonvor 13 Jahren

Pinterest and Instagram are both using Django. Then again, when you are scale like these sites, you start to build new architecture around existing stuff. Reference: http://highscalability.com/blog/2013/4/15/scaling-pinterest-...

IgorPartolavor 13 Jahren

Pinterest: http://pinterest.com/django

tompvor 13 Jahren

Makes me wonder why there aren't more jobs for Django; Ruby on Rails still seems to be far more popular for new startups!

cwhvor 13 Jahren

i believe it's because Rails is as easy as grabbing a shovel to dig a hole for yourself.

pacifi30vor 13 Jahren

How do you mask your admin portal when you are small enough that you dont have an intranet. Someone on hacker news pointed out to me about my admin portal being open but I never understood how to mask it. http://www.truffle.io/admin/ Any suggestions?

StavrosKvor 13 Jahren

Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.

pacifi30vor 13 Jahren

Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.

StavrosKvor 13 Jahren

That's a normal HTTPS cert, I'm talking about this:

http://www.ibm.com/developerworks/lotus/library/ls-SSL_clien...

Really, though, unless you're extremely security-conscious, a hidden URL over HTTPS with a good password is sufficient for your purposes.

Also, don't serve any pages over plain HTTP, login pages even less so.

pacifi30vor 13 Jahren

Thanks, I guess I ll explore the option that you described above. Also there is one more thing I am curious about, so heroku does gives a free SSL certificate but that only works for their domain meaning something like truffleapp.herokuapp.com, it doesn't work for the custom domain. Do you know any way where I can save money on buying SSL certificate and rather use heroku's certificate. All the certificates put atleast a 1000$ hole in the pocket but eventually in a week or so if I can't figure out how to use heroku SLL, I have to spend that money

tingletechvor 13 Jahren

If you are just using ssl on your admin site; you could roll your own.

  openssl req -new -x509 -nodes \
        -out /nuxeo/certs/server.crt \
        -keyout /nuxeo/certs/server.key \
        -batch

you will get a warning about the certificate being suspect; but at least the traffic will be encrypted

tjohnsvor 13 Jahren

StartCom offers free SSL certificates that are recognized by most browsers: http://cert.startcom.org/

Heroku will still probably charge you a basic fee for enabling SSL, since each certificate requires a dedicated (non-shared) IP address... at least until SNI support becomes more commonplace.

Edit: Just to reiterate what others have said, this is a server-side certificate, which is primarily used for encryption. You'll also want to generate a client-side certificate for authentication purposes. That's something you'd do entirely on your own, no need to go through a third-party CA for that.

pfgvor 13 Jahren

Note that StavrosK is probably talking about SSL client authentication, which isn't what most people think about when talking about SSL. Basically, it enables you to allow access only to people with a certain client certificate installed in their browser (i.e., proving the clients' identity to the server, not just the other way around).

Unfortunately I have no idea how this would work on Heroku.

There's a great article about client authentication for HAProxy (might be interesting even if you're not using HAProxy): http://blog.exceliance.fr/2012/10/03/ssl-client-certificate-...

dalorevor 13 Jahren

There is a module for django to do client ssl cert authentication. I haven't used it though but it seems maintained.

https://github.com/kimvais/django-ssl-client-auth

Keyframevor 13 Jahren

you can also put up a htpasswd if you can on that directory, every bit helps.

ing33kvor 13 Jahren

tbh , was not aware of creating private ssl certificates for this purpose .. Thanks

cdjkvor 13 Jahren

Limit access in the firewall/load balancer/webserver to whitelisted ip addresses. If you don't have static ips at your office or a vpn, include the ip of a VPS or dev server, and use ssh forwarding (-D for a socks proxy) to access the admin site. And if you're running everything from one server, you can even limit connections to localhost and tunnel connections through there.

the_cat_kittlesvor 13 Jahren

I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.

craigkerstiensvor 13 Jahren

A post or code snippet that does this would be great, seems like a really simple but useful people others may like

sevenproxiesvor 13 Jahren

Simple browser-side CSS does the trick. I use Stylish[1] for Chromium. I believe there is also a Firefox version.

[1] - https://chrome.google.com/webstore/detail/stylish/fjnbnpbmke...

the_cat_kittlesvor 13 Jahren

I changed django admin's base.css:

    #header {
       ... css ...
       background: <whatever color you want>;
       ... more css ...
    }

workhere-iovor 13 Jahren

I'm not sure what the point in linking to this is. If you regard it as security hole, alert Instagram. If you just want to let people know that Instagram uses Django... well, that information is already on https://www.djangoproject.com.

aetvor 13 Jahren

I guess the point is that maybe you should restrict "people from the internet" from being able to access the login page.

workhere-iovor 13 Jahren

I understand. My point was that it would be better to alert Instagram rather than direct a lot of HN users to a page that offers no value.

aetvor 13 Jahren

I agree. (Already fixed?)

lukashedvor 13 Jahren

BlackJet Django admin: https://www.blackjet.com/admin/

wrboycevor 13 Jahren

It seems to have (just) changed to a non-standard (different to the rest of Instagram's) 404 page.

rajbalavor 13 Jahren

They removed the link to the admin page.

mikeykvor 13 Jahren

Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected).

We're also part of Facebook's bug bounty whitehat program (https://www.facebook.com/whitehat/bounty/), if anyone comes across something in the future, we welcome responsible disclosure and pay out bounties through the program as well.

MattBearmanvor 13 Jahren

Out of interest, would something as easy to find as this qualify for the bug bounty?

davis_mvor 13 Jahren

I would hope so. It shouldn't matter how "easy" something is to find. If the bug was really that easy, the team should have never let it out onto production.

tptacekvor 13 Jahren

Off the top of my head I can't speak to Facebook's program, but Google's terms include "substantially affects the confidentiality or integrity of user data". A login page that shouldn't be exposed is a marginal finding and might not qualify.

Also: obviously I don't speak for either Facebook or Google, but I strongly recommend against brute-forcing login prompts to try to prove the point that an exposed console is a real finding.

dylangs1030vor 13 Jahren

"Report a bug that could compromise the integrity of Facebook user data, circumvent the privacy protections of Facebook user data, or enable access to a system within the Facebook infrastructure"

^That's Facebook's. Theoretically, an exposed login page "could...enable access to a system within the Facebook infrastructure", but to be fair, I doubt they had that in mind.

jchungvor 13 Jahren

Did you inform Instagram first before posting it to HN?

pjanvor 13 Jahren

And they're not alone: mixpanel Django site admin: https://mixpanel.com/admin/

techaddict009vor 13 Jahren

Has anyone taken the snapshot of it ? As instagram has fixed it and i have missed a chance to see it.

danielsamuelsvor 13 Jahren

It just looked like the default Django login - http://www.djangobook.com/en/2.0/_images/login.png