Instagram Django site admin (opens in new tab)

(instagram.com)

83 pointslest13y ago46 comments

46 comments

36 comments · 15 top-level

pacifi3013y ago· 4 in thread

How do you mask your admin portal when you are small enough that you dont have an intranet. Someone on hacker news pointed out to me about my admin portal being open but I never understood how to mask it. http://www.truffle.io/admin/ Any suggestions?

StavrosK13y ago

Well, first of all, change the URL to something obscure. That'll take care of most of the problems. Afterwards, you could set SSL certificates so only browsers with the private keys could even access it.

pacifi3013y ago

Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.

3 more replies

ing33k13y ago

tbh , was not aware of creating private ssl certificates for this purpose .. Thanks

cdjk13y ago

Limit access in the firewall/load balancer/webserver to whitelisted ip addresses. If you don't have static ips at your office or a vpn, include the ip of a VPS or dev server, and use ssh forwarding (-D for a socks proxy) to access the admin site. And if you're running everything from one server, you can even limit connections to localhost and tunnel connections through there.

donbronson13y ago· 3 in thread

Pinterest and Instagram are both using Django. Then again, when you are scale like these sites, you start to build new architecture around existing stuff. Reference: http://highscalability.com/blog/2013/4/15/scaling-pinterest-...

IgorPartola13y ago

Pinterest: http://pinterest.com/django

tomp13y ago

Makes me wonder why there aren't more jobs for Django; Ruby on Rails still seems to be far more popular for new startups!

cwh13y ago

i believe it's because Rails is as easy as grabbing a shovel to dig a hole for yourself.

the_cat_kittles13y ago· 3 in thread

I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.

craigkerstiens13y ago

A post or code snippet that does this would be great, seems like a really simple but useful people others may like

sevenproxies13y ago

Simple browser-side CSS does the trick. I use Stylish[1] for Chromium. I believe there is also a Firefox version.

[1] - https://chrome.google.com/webstore/detail/stylish/fjnbnpbmke...

the_cat_kittles13y ago

I changed django admin's base.css:

    #header {
       ... css ...
       background: <whatever color you want>;
       ... more css ...
    }

dlsym13y ago· 3 in thread

admin:admin doesn't work.

stefs13y ago

file a bug report "login is broken"

dopamean13y ago

This is the best idea in this thread.

antidaily13y ago

tried that too. LOL.

mikeyk13y ago· 2 in thread

Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected).

We're also part of Facebook's bug bounty whitehat program (https://www.facebook.com/whitehat/bounty/), if anyone comes across something in the future, we welcome responsible disclosure and pay out bounties through the program as well.

MattBearman13y ago

Out of interest, would something as easy to find as this qualify for the bug bounty?

davis_m13y ago

I would hope so. It shouldn't matter how "easy" something is to find. If the bug was really that easy, the team should have never let it out onto production.

1 more reply

workhere-io13y ago· 2 in thread

I'm not sure what the point in linking to this is. If you regard it as security hole, alert Instagram. If you just want to let people know that Instagram uses Django... well, that information is already on https://www.djangoproject.com.

aet13y ago

I guess the point is that maybe you should restrict "people from the internet" from being able to access the login page.

workhere-io13y ago

I understand. My point was that it would be better to alert Instagram rather than direct a lot of HN users to a page that offers no value.

1 more reply

spdy13y ago· 2 in thread

Would love to see the inside. If they use special dashboards etc.

Maybe someone can give some insight.

johndavidback13y ago

It would actually be quite interesting to see how large enterprise clients modify/utilize the Django admin... if at all.

Other than Grappelli, I've historically used the admin pretty much as-is. Creating admin functions is one thing, but lots of custom screens is quite another.

I also think that's one thing really lacking from the Django documentation, really great customization of the Admin.

DirtyMonkey13y ago

Most of the Django projects I've worked on, people tended to make their own admin panels with things like Bootstrap and Foundation. Django's core team have made their goals clear for the next admin, extensibility and adaptability. https://github.com/twoscoops/django-admin2

zalew13y ago· 1 in thread

it may be a honeypot. I sometimes set up a bogus form under /admin/ which logs attempts. adrian holovaty on the other hand, redirects /admin/ to django docs http://www.holovaty.com/writing/admin-easter-egg/

//edit: oh, now I see somebody thought of my idea too https://github.com/dmpayton/django-admin-honeypot

Legogris13y ago

Given that they don't seem to have any automatic tests or similar for their APIs (check out their Google group and you'll see that stuff have been broken for a long time for all users without attention. When stuff has been broken in the past, Instagram people will ask "is this still a problem?", like they have no way of checking their own APIs...), I wouldn't expect them to be that crafty.

techaddict00913y ago· 1 in thread

Has anyone taken the snapshot of it ? As instagram has fixed it and i have missed a chance to see it.

danielsamuels13y ago

It just looked like the default Django login - http://www.djangobook.com/en/2.0/_images/login.png

pjan13y ago

And they're not alone: mixpanel Django site admin: https://mixpanel.com/admin/

gregorkas13y ago

Although it's been a while since I've done anything in Django, seeing this still gives me a warm feeling.

lukashed13y ago

BlackJet Django admin: https://www.blackjet.com/admin/

jchung13y ago

Did you inform Instagram first before posting it to HN?

wrboyce13y ago

It seems to have (just) changed to a non-standard (different to the rest of Instagram's) 404 page.

rajbala13y ago

They removed the link to the admin page.

j / k navigate · click thread line to collapse

46 comments

36 comments · 15 top-level

pacifi3013y ago· 4 in thread

StavrosK13y ago

pacifi3013y ago

Thank you so much. I'll change it to something obscure and for the SSL certificate I am thinking if I can use heroku's SSL certificate.

3 more replies

ing33k13y ago

tbh , was not aware of creating private ssl certificates for this purpose .. Thanks

cdjk13y ago

donbronson13y ago· 3 in thread

IgorPartola13y ago

Pinterest: http://pinterest.com/django

tomp13y ago

Makes me wonder why there aren't more jobs for Django; Ruby on Rails still seems to be far more popular for new startups!

cwh13y ago

i believe it's because Rails is as easy as grabbing a shovel to dig a hole for yourself.

the_cat_kittles13y ago· 3 in thread

I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.

craigkerstiens13y ago

A post or code snippet that does this would be great, seems like a really simple but useful people others may like

sevenproxies13y ago

Simple browser-side CSS does the trick. I use Stylish[1] for Chromium. I believe there is also a Firefox version.

[1] - https://chrome.google.com/webstore/detail/stylish/fjnbnpbmke...

the_cat_kittles13y ago

I changed django admin's base.css:

    #header {
       ... css ...
       background: <whatever color you want>;
       ... more css ...
    }

dlsym13y ago· 3 in thread

admin:admin doesn't work.

stefs13y ago

file a bug report "login is broken"

dopamean13y ago

This is the best idea in this thread.

antidaily13y ago

tried that too. LOL.

mikeyk13y ago· 2 in thread

Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected).

MattBearman13y ago

Out of interest, would something as easy to find as this qualify for the bug bounty?

davis_m13y ago

I would hope so. It shouldn't matter how "easy" something is to find. If the bug was really that easy, the team should have never let it out onto production.

1 more reply

workhere-io13y ago· 2 in thread

aet13y ago

I guess the point is that maybe you should restrict "people from the internet" from being able to access the login page.

workhere-io13y ago

I understand. My point was that it would be better to alert Instagram rather than direct a lot of HN users to a page that offers no value.

1 more reply

spdy13y ago· 2 in thread

Would love to see the inside. If they use special dashboards etc.

Maybe someone can give some insight.

johndavidback13y ago

It would actually be quite interesting to see how large enterprise clients modify/utilize the Django admin... if at all.

Other than Grappelli, I've historically used the admin pretty much as-is. Creating admin functions is one thing, but lots of custom screens is quite another.

I also think that's one thing really lacking from the Django documentation, really great customization of the Admin.

DirtyMonkey13y ago

zalew13y ago· 1 in thread

//edit: oh, now I see somebody thought of my idea too https://github.com/dmpayton/django-admin-honeypot

Legogris13y ago

techaddict00913y ago· 1 in thread

Has anyone taken the snapshot of it ? As instagram has fixed it and i have missed a chance to see it.

danielsamuels13y ago

It just looked like the default Django login - http://www.djangobook.com/en/2.0/_images/login.png

pjan13y ago

And they're not alone: mixpanel Django site admin: https://mixpanel.com/admin/

gregorkas13y ago

Although it's been a while since I've done anything in Django, seeing this still gives me a warm feeling.

lukashed13y ago

BlackJet Django admin: https://www.blackjet.com/admin/

jchung13y ago

Did you inform Instagram first before posting it to HN?

wrboyce13y ago

It seems to have (just) changed to a non-standard (different to the rest of Instagram's) 404 page.

rajbala13y ago

They removed the link to the admin page.

j / k navigate · click thread line to collapse