OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help



   RE: [xml-dev] SOAP-RPC and REST and security

[ Lists Home | Date Index | Thread Index ]
  • To: "Paul Prescod" <paul@prescod.net>,<xml-dev@lists.xml.org>
  • Subject: RE: [xml-dev] SOAP-RPC and REST and security
  • From: "Dare Obasanjo" <dareo@microsoft.com>
  • Date: Wed, 20 Feb 2002 13:04:49 -0800
  • Thread-index: AcG6M/Nwwr65QDdcR+S5wKoVMVhHEQADmkAQ
  • Thread-topic: [xml-dev] SOAP-RPC and REST and security

> -----Original Message-----
> From: Paul Prescod [mailto:paul@prescod.net] 
> Sent: Wednesday, February 20, 2002 9:25 AM
> To: xml-dev@lists.xml.org
> Subject: Re: [xml-dev] SOAP-RPC and REST and security
> >...
> > I see you saying that REST is inherently more secure than RPC, and  
> >further claiming that bruceS agrees with you.  I am just 
> pointing out  
> >that you may be completely wrong on both.
> It's clear that BruceS thinks that SOAP is security problem. 
> He's in favor of the lack of SOAP. I'm in favor of the lack 
> of SOAP. "Implementation of Microsoft SOAP, a protocol 
> running over HTTP precisely so it could bypass firewalls, 
> should be withdrawn." Whether he is an HTTP or XML fan, I 
> can't speculate. He hasn't spoken out against them.

What I'd like to know is WHY he is against SOAP. In the old days I could
understand why people didn't want various RPC services exposed on their
machines because they were a security risk due to all the buffer
overflows and the like that existed in them. 

A default install of Redhat 6.2 while I was in college was 0wn3d in the
amount of time it took me to make dinner due to one of the rpc.statd 

Nowadays that web servers allow requests that execute server side code
from servlets to ASP to CGIs, I'm not sure exactly why anyone would be
opposed to what is simply another mechanism for telling a server to
execute some preset operation on the server. 

Unless Bruce Schneir us simply against all mechanisms that would allow
clients to execute code on the server even if the code was already

I will not attempt to kill the hero by placing a venomous creature in
his room.
It will just wind up accidentally killing one of my clumsy henchmen


News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS