Re: [PHP3] Re: [PHP-DEV] More SOAP or Dampen Thy Evangelical Fires oh Disciples

Sun just announced support for SOAP. > I won't fight about how to best battle Microsoft. I'm tired of all the hot air > and foot stamping that involves. My commitment is to provide the best, > cheapest, most effective solution to my customers. If Microsoft does that > (which it nearly never does) I'll go with Microsoft. I shall say no more on > this topic. > > As for this comment: > > Security - > > > Security is always an exercise left to the reader. Don't do stupid things and > > > bad things won't happen to you. Since SOAP rides on HTTP, it is no more or > > > less secure than that protocol. It's what you allow it to do that makes it > > > dangerous. A SOAP request doesn't do anything unless you make it. Don't make > > > it do stupid things. Simple. > > > > This is totally off. Your saying SOAP rides on HTTP, so it cant be less > > secure then HTTP. Thats like saying, Visual Basic Script can be no more > > dangerious then the text file it resides in. An unknown SOAP object > > running on your machine when you run "joebobapp" can connect to a remote > > host via http, and share out the box via itself. And it would be > > unblockabe via firewalls. Major security risk. > > > > Well, you're just dead wrong here. VBScript is not dangerous to me. It rides > on HTTP, but I run Netscape under Linux. Look, HTTP is just a transport. > Transport SOAP over it, and it won't do anything unless there is code on the > receiving machine that acts on the SOAP packet. My point was that if you build > a secure SOAP application it will be secure. If Microsoft had built Outlook > securely, Malicious VBScript would be no danger. The whole point is that SOAP > DOES NOT allow you to execute arbitrary code on a remote machine. In fact, the > protocol doesn't allow you to execute any code. The receiving application > processes the request and decides "Do I honor this request?" Put in checks. > Don't honor all requests. Authenticate requests. Tunnel them over SSH or SSL or > HTTPS. My point is, simply, that SOAP is no more or no less dangerous than > HTTP. It's what you do with it that is more or less dangerous. > > Ryan Gaul >