Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected).<p>We're also part of Facebook's bug bounty whitehat program (<a href="https://www.facebook.com/whitehat/bounty/" rel="nofollow">https://www.facebook.com/whitehat/bounty/</a>), if anyone comes across something in the future, we welcome responsible disclosure and pay out bounties through the program as well.
it may be a honeypot. I sometimes set up a bogus form under /admin/ which logs attempts. adrian holovaty on the other hand, redirects /admin/ to django docs <a href="http://www.holovaty.com/writing/admin-easter-egg/" rel="nofollow">http://www.holovaty.com/writing/admin-easter-egg/</a><p>//edit: oh, now I see somebody thought of my idea too <a href="https://github.com/dmpayton/django-admin-honeypot" rel="nofollow">https://github.com/dmpayton/django-admin-honeypot</a>
Pinterest and Instagram are both using Django. Then again, when you are scale like these sites, you start to build new architecture around existing stuff. Reference: <a href="http://highscalability.com/blog/2013/4/15/scaling-pinterest-from-0-to-10s-of-billions-of-page-views-a.html" rel="nofollow">http://highscalability.com/blog/2013/4/15/scaling-pinterest-...</a>
And they're not alone: mixpanel Django site admin: <a href="https://mixpanel.com/admin/" rel="nofollow">https://mixpanel.com/admin/</a>
How do you mask your admin portal when you are small enough that you dont have an intranet. Someone on hacker news pointed out to me about my admin portal being open but I never understood how to mask it. <a href="http://www.truffle.io/admin/" rel="nofollow">http://www.truffle.io/admin/</a>
Any suggestions?
I'm not sure what the point in linking to this is. If you regard it as security hole, alert Instagram. If you just want to let people know that Instagram uses Django... well, that information is already on <a href="https://www.djangoproject.com" rel="nofollow">https://www.djangoproject.com</a>.
I changed the top bar color from that blue green to a red on the production deployment of my app- helps avoid forgetting which deployment you are messing with.