text: Your Account
  by Robert Cooper
  2. the same envelope complexity also introduces lots of ambiguity. WS-A 1.0 does say 'only one WSA header set in our namespace', but ignores the question of what if I also send conflicting headers in three of the draft namespaces in widespread use. Its up to each stack how they handle that.
  3. There's a really good defcon paper on WS-Security, which shows that it includes lots of potential attack points.
  -steve
  But how often does that really occur? Remember, we frequently pass our most valuable info (credit card, ssn, address, age) over SSL. And I disagree that it's not "hard to use". It's hard for me.
  You mean to say to the web does not support two phase commits and reliable messaging?
  "When you need encryption beyond basic SSL"
  But how often does that really occur?
  But how often does that really occur?
  3. There's a really good defcon paper on WS-Security, which shows that it includes lots of potential attack points.
  Let's just own up to the fact that "lots of potential attack points" applies to almost any web service. The fact is, in the real world, once you pwn DNS, you pwn.
  I recently attended a talk where the presenter compared the 700+ pages you have to grok to do SOAP right with the one page that gets you into REST. The world we live in is one of cost-cutting, lowest-priced providers, outsourcing, and off-shoring. Management wants capability *NOW*; and for *CHEAP*.
  On cost and simplicity, REST is going to give SOAP a shellacking.
  BTW, I'm not a zealot. Just an ordinary guy with a stay-at-home wife, who wants to continue winning bread in an H-1B world.
  I know this has the feel of "10 billion flies", etc. Still, you know, Google.
  © 2015, O’Reilly Media, Inc.
  (707) 827-7019
  (800) 889-8969
  All trademarks and registered trademarks appearing on oreilly.com are the property of their respective owners.