RE: [xml-dev] SOAP-RPC and REST and security

["Dare Obasanjo" <dareo@microsoft.com>]

> -----Original Message-----
> From: Paul Prescod [mailto:paul@prescod.net] 
> Sent: Wednesday, February 20, 2002 9:25 AM
> To: xml-dev@lists.xml.org
> Subject: Re: [xml-dev] SOAP-RPC and REST and security
> 
> >...
> > I see you saying that REST is inherently more secure than RPC, and  
> >further claiming that bruceS agrees with you.  I am just 
> pointing out  
> >that you may be completely wrong on both.
> 
> It's clear that BruceS thinks that SOAP is security problem. 
> He's in favor of the lack of SOAP. I'm in favor of the lack 
> of SOAP. "Implementation of Microsoft SOAP, a protocol 
> running over HTTP precisely so it could bypass firewalls, 
> should be withdrawn." Whether he is an HTTP or XML fan, I 
> can't speculate. He hasn't spoken out against them.
> 

What I'd like to know is WHY he is against SOAP. In the old days I could
understand why people didn't want various RPC services exposed on their
machines because they were a security risk due to all the buffer
overflows and the like that existed in them. 

<aside>
A default install of Redhat 6.2 while I was in college was 0wn3d in the
amount of time it took me to make dinner due to one of the rpc.statd 
</aside>

Nowadays that web servers allow requests that execute server side code
from servlets to ASP to CGIs, I'm not sure exactly why anyone would be
opposed to what is simply another mechanism for telling a server to
execute some preset operation on the server. 

Unless Bruce Schneir us simply against all mechanisms that would allow
clients to execute code on the server even if the code was already
predetermined. 

-- 
THINGS TO DO IF I BECOME AN EVIL OVERLORD #119
I will not attempt to kill the hero by placing a venomous creature in
his room.
It will just wind up accidentally killing one of my clumsy henchmen
instead.