Re: [PHP3] Re: [PHP-DEV] More SOAP or Dampen Thy Evangelical Fires oh Disciples

I won't fight about how to best battle Microsoft. I'm tired of all the hot air and foot stamping that involves. My commitment is to provide the best, cheapest, most effective solution to my customers. If Microsoft does that (which it nearly never does) I'll go with Microsoft. I shall say no more on this topic. As for this comment: Security - > > Security is always an exercise left to the reader. Don't do stupid things and > > bad things won't happen to you. Since SOAP rides on HTTP, it is no more or > > less secure than that protocol. It's what you allow it to do that makes it > > dangerous. A SOAP request doesn't do anything unless you make it. Don't make > > it do stupid things. Simple. > > This is totally off. Your saying SOAP rides on HTTP, so it cant be less > secure then HTTP. Thats like saying, Visual Basic Script can be no more > dangerious then the text file it resides in. An unknown SOAP object > running on your machine when you run "joebobapp" can connect to a remote > host via http, and share out the box via itself. And it would be > unblockabe via firewalls. Major security risk. > Well, you're just dead wrong here. VBScript is not dangerous to me. It rides on HTTP, but I run Netscape under Linux. Look, HTTP is just a transport. Transport SOAP over it, and it won't do anything unless there is code on the receiving machine that acts on the SOAP packet. My point was that if you build a secure SOAP application it will be secure. If Microsoft had built Outlook securely, Malicious VBScript would be no danger. The whole point is that SOAP DOES NOT allow you to execute arbitrary code on a remote machine. In fact, the protocol doesn't allow you to execute any code. The receiving application processes the request and decides "Do I honor this request?" Put in checks. Don't honor all requests. Authenticate requests. Tunnel them over SSH or SSL or HTTPS. My point is, simply, that SOAP is no more or no less dangerous than HTTP. It's what you do with it that is more or less dangerous. Ryan Gaul