Hacker News Reader

Comment by ThinkBeat | Hacker News Reader

I have spent far too much of my life on SharePoint. Having it internet facing has never been a good idea. Not really what it is meant for, though the promo verbiage on that has changed over different versions.

Some folks wanted SharePoint as their "web server", I would set that installation up entirely separted from all other instances they may have on the network.

View on HN

Actually it wasn't too long ago, in the early-2010's, that Microsoft was promoting SharePoint for internet sites; I think at one point some Europoean car manufacturer (BMW? Ferrari?) had their global marketing site on SharePoint. Of course that didn't last long, as Microsoft licensed it at a crazy price ($40k per site or something like that).

I worked on a couple of public facing SharePoint 2010 sites for large, well known companies before while it was in RC and immediately after - MS had a big marketing push to get people to build more than Intranet portals on it at the time. It seems like that died off entirely once Office 365 came around, and it was never a good idea in the first place, but it was definitely a thing.

2013 literally came with a tool to built a theme from your html and css and other features for hosting web sites.

And it probably needed a very hefty bunch of servers, even after caching, if you needed just a little bit of dynamic content or interaction with the site.

Well, they would have had to purchase one Client Access License per potential device or user that would access the website. Since there's about 5-6 billion people with internet access, and a CAL is about $50 a pop, that would be roughly two hundred and fifty billion dollars to fully and correctly license a public server.

The Navy still runs more than a few web servers using Sharepoint, albeit behind dedicated network firewall appliances.

The Secretary of the Navy's page (at https://www.secnav.navy.mil/Pages/default.aspx) for instance, is a Sharepoint site. I used to maintain a Navy website hosted under there, and had a bunch of Hugo-specific scripts to convert a Hugo static site into something I could upload to the Sharepoint and have it mostly still work (which involved things like rewriting links and renaming files to end in .aspx).

Microsoft.com and Office.com used to be entirely built upon SharePoint, as SharePoint solutions. It was to prove it out as possible, eat your own dogfood.

I think the shift away started in 2013 or 2014, but you can imagine the throw away effort spent on it.

Not sure about microsoft.com, but office.com frontend "rendering" SharePoint instances were read-only, not plain SharePoint exposed as-is.

I've only interacted with SharePoint briefly one time years ago, thought public web hosting was the entire purpose.

Isn't Office365 an online sharepoint?

Yes, as is OneDrive and Teams file sharing. Those, however, are part of SharePoint Online. SPO is distinct from this CVE, which only applies to the standalone SharePoint Server.

Yes I know.

What I was kind of implying is that if the codebase is not that different maybe there has been a complete breach of office365 and Microsoft has stayed quiet about that.

Reply on news.ycombinator.com