Forum Discussion
Publish to web clarification
thegeng You should assume that this link is going to be public, or accessible by those who would be interested in discovering those. These aren't warnings to be ignored. If the data contains private information don't use publish to web.
thegeng You should assume that this link is going to be public, or accessible by those who would be interested in discovering those. These aren't warnings to be ignored. If the data contains private information don't use publish to web.
MaxWAdvocate II
Hi Anonymous,
Piggybacking this question, I understand your reply is the 'official' stance, and certainly applies for private information, but can you elaborate on the actual risks?
My use case is to share proof of concept/UAT reports with external parties before embedding in a public website. The data is not confidential, but the reports can be unfinished and buggy which doesn't look great for my brand.The warning says Microsoft might publish it in a public gallery without asking, but how often does this happen? Ever?
You say I should assume someone interested in finding my report could find it - how would they find it?
I appreciate the risk is that a search tool is made available, but does it exist today? Is it in the roadmap?Kind regards,
Max
MaxW The major risk around Publish to Web is with the private company information being exposed to people who shouldn't see it. The URL's generated are not secured, so they are discoverable. In your case, your ultimate use case is external public sites, so it sounds like you just want to validate prior to publishing in the site itself. - valid use case.
To address some of the other questions:
MSFT using it: They haven't yet, but it is certianly a possibility. In that likelyhood, I would assume if you deleted the publish to web link that it would come off any published site.
Discoverability: When the feature was first released we would search portions of the generated URL's and actually get quite a few results simply by search engine. Talking to my security guys, they walked me through several ways in which it apparently wouldn't be that hard to build programs to search for valid links based on the URL strings generated. How someone goes about doing that, I have no idea) But as I mentioned. The danger is around some entity discovering company private information.
A publish to web finder tool: Uh, no.
My stance is based on an abundance of caution, and heeding explicit warnings. In my eyes, it is all about the data exposed. My recommendations are strong because the improper use of this feature could very well land people in a lot of hot water in their workplace if they don't understand the implications. (Company data security policies)
- MaxW
Anonymous
Thanks Seth,
Fantastic reply and exactly the detail I was looking for.
Kind regards,
Max