RE: SOAP-RPC and REST and security
> -----Original Message----- > From: Paul Prescod [mailto:paul@p...] > Sent: Wednesday, February 20, 2002 9:25 AM > To: xml-dev@l... > Subject: Re: SOAP-RPC and REST and security > > >... > > I see you saying that REST is inherently more secure than RPC, and > >further claiming that bruceS agrees with you. I am just > pointing out > >that you may be completely wrong on both. > > It's clear that BruceS thinks that SOAP is security problem. > He's in favor of the lack of SOAP. I'm in favor of the lack > of SOAP. "Implementation of Microsoft SOAP, a protocol > running over HTTP precisely so it could bypass firewalls, > should be withdrawn." Whether he is an HTTP or XML fan, I > can't speculate. He hasn't spoken out against them. > What I'd like to know is WHY he is against SOAP. In the old days I could understand why people didn't want various RPC services exposed on their machines because they were a security risk due to all the buffer overflows and the like that existed in them. <aside> A default install of Redhat 6.2 while I was in college was 0wn3d in the amount of time it took me to make dinner due to one of the rpc.statd </aside> Nowadays that web servers allow requests that execute server side code from servlets to ASP to CGIs, I'm not sure exactly why anyone would be opposed to what is simply another mechanism for telling a server to execute some preset operation on the server. Unless Bruce Schneir us simply against all mechanisms that would allow clients to execute code on the server even if the code was already predetermined. -- THINGS TO DO IF I BECOME AN EVIL OVERLORD #119 I will not attempt to kill the hero by placing a venomous creature in his room. It will just wind up accidentally killing one of my clumsy henchmen instead.
PURCHASE STYLUS STUDIO ONLINE TODAY!
Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!
Download The World's Best XML IDE!
Accelerate XML development with our award-winning XML IDE - Download a free trial today!
Subscribe in XML format