4 ms·

I have spent far too much of my life on SharePoint. Having it internet facing has never been a good idea. Not really what it is meant for, though the promo ver

I have spent far too much of my life on SharePoint. Having it internet facing has never been a good idea. Not really what it is meant for, though the promo verbiage on that has changed over different versions. Some folks wanted SharePoint as their "web server", I would set that installation up entirely separted from all other instances they may have on the network.

miffy900 1y ago
Actually it wasn't too long ago, in the early-2010's, that Microsoft was promoting SharePoint for internet sites; I think at one point some Europoean car manufacturer (BMW? Ferrari?) had their global marketing site on SharePoint. Of course that didn't last long, as Microsoft licensed it at a crazy price ($40k per site or something like that).
- 010101010101 1y ago
  I worked on a couple of public facing SharePoint 2010 sites for large, well known companies before while it was in RC and immediately after - MS had a big marketing push to get people to build more than Intranet portals on it at the time. It seems like that died off entirely once Office 365 came around, and it was never a good idea in the first place, but it was definitely a thing.
  - xcrunner529 1y ago
    2013 literally came with a tool to built a theme from your html and css and other features for hosting web sites.
- tecleandor 1y ago
  And it probably needed a very hefty bunch of servers, even after caching, if you needed just a little bit of dynamic content or interaction with the site.
- yabones 1y ago
  Well, they would have had to purchase one Client Access License per potential device or user that would access the website. Since there's about 5-6 billion people with internet access, and a CAL is about $50 a pop, that would be roughly two hundred and fifty billion dollars to fully and correctly license a public server.
- mpyne 1y ago
  The Navy still runs more than a few web servers using Sharepoint, albeit behind dedicated network firewall appliances. The Secretary of the Navy's page (at https://www.secnav.navy.mil/Pages/default.aspx https://www.secnav.navy.mil/Pages/default.aspx) for instance, is a Sharepoint site. I used to maintain a Navy website hosted under there, and had a bunch of Hugo-specific scripts to convert a Hugo static site into something I could upload to the Sharepoint and have it mostly still work (which involved things like rewriting links and renaming files to end in .aspx).
frollogaston 1y ago
I've only interacted with SharePoint briefly one time years ago, thought public web hosting was the entire purpose.
prmoustache 1y ago
Isn't Office365 an online sharepoint?
- samch 1y ago
  Yes, as is OneDrive and Teams file sharing. Those, however, are part of SharePoint Online. SPO is distinct from this CVE, which only applies to the standalone SharePoint Server.
  - prmoustache 1y ago
    Yes I know. What I was kind of implying is that if the codebase is not that different maybe there has been a complete breach of office365 and Microsoft has stayed quiet about that.
Plasmoid2000ad 1y ago
Microsoft.com and Office.com used to be entirely built upon SharePoint, as SharePoint solutions. It was to prove it out as possible, eat your own dogfood. I think the shift away started in 2013 or 2014, but you can imagine the throw away effort spent on it. Not sure about microsoft.com, but office.com frontend "rendering" SharePoint instances were read-only, not plain SharePoint exposed as-is.

miffy900 1y ago

Actually it wasn't too long ago, in the early-2010's, that Microsoft was promoting SharePoint for internet sites; I think at one point some Europoean car manufacturer (BMW? Ferrari?) had their global marketing site on SharePoint. Of course that didn't last long, as Microsoft licensed it at a crazy price ($40k per site or something like that).

010101010101 1y ago
I worked on a couple of public facing SharePoint 2010 sites for large, well known companies before while it was in RC and immediately after - MS had a big marketing push to get people to build more than Intranet portals on it at the time. It seems like that died off entirely once Office 365 came around, and it was never a good idea in the first place, but it was definitely a thing.
- xcrunner529 1y ago
  2013 literally came with a tool to built a theme from your html and css and other features for hosting web sites.
tecleandor 1y ago
And it probably needed a very hefty bunch of servers, even after caching, if you needed just a little bit of dynamic content or interaction with the site.
yabones 1y ago
Well, they would have had to purchase one Client Access License per potential device or user that would access the website. Since there's about 5-6 billion people with internet access, and a CAL is about $50 a pop, that would be roughly two hundred and fifty billion dollars to fully and correctly license a public server.
mpyne 1y ago
The Navy still runs more than a few web servers using Sharepoint, albeit behind dedicated network firewall appliances. The Secretary of the Navy's page (at https://www.secnav.navy.mil/Pages/default.aspx https://www.secnav.navy.mil/Pages/default.aspx) for instance, is a Sharepoint site. I used to maintain a Navy website hosted under there, and had a bunch of Hugo-specific scripts to convert a Hugo static site into something I could upload to the Sharepoint and have it mostly still work (which involved things like rewriting links and renaming files to end in .aspx).

frollogaston 1y ago

I've only interacted with SharePoint briefly one time years ago, thought public web hosting was the entire purpose.

prmoustache 1y ago

Isn't Office365 an online sharepoint?

samch 1y ago
Yes, as is OneDrive and Teams file sharing. Those, however, are part of SharePoint Online. SPO is distinct from this CVE, which only applies to the standalone SharePoint Server.
- prmoustache 1y ago
  Yes I know. What I was kind of implying is that if the codebase is not that different maybe there has been a complete breach of office365 and Microsoft has stayed quiet about that.

Plasmoid2000ad 1y ago

Microsoft.com and Office.com used to be entirely built upon SharePoint, as SharePoint solutions. It was to prove it out as possible, eat your own dogfood. I think the shift away started in 2013 or 2014, but you can imagine the throw away effort spent on it. Not sure about microsoft.com, but office.com frontend "rendering" SharePoint instances were read-only, not plain SharePoint exposed as-is.