<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>
<channel>
	<title>Comments on: Reinventing the WS Stack</title>
	<atom:link href="http://72.249.21.88/nonintersecting/?year=2007&#038;monthnum=01&#038;day=03&#038;name=reinventing-the-ws-stack&#038;feed=feed" rel="self" type="application/rss+xml" />
	<link>http://72.249.21.88/nonintersecting/2007/01/03/reinventing-the-ws-stack/</link>
	<description>Life and Technology (non-intersecting)</description>
	<pubDate>Fri, 05 Dec 2008 03:05:24 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6.3</generator>
		<item>
		<title>By: protocol7 &#187; Blog Archive &#187; links for 2007-01-31</title>
		<link>http://72.249.21.88/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-3064</link>
		<dc:creator>protocol7 &#187; Blog Archive &#187; links for 2007-01-31</dc:creator>
		<pubDate>Wed, 31 Jan 2007 12:19:08 +0000</pubDate>
		<guid isPermaLink="false">http://wanderingbarque.com/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-3064</guid>
		<description>[...] Reinventing the WS Stack (tags: rest webservices SOAP soa architecture by:pete_lacey) [...]</description>
		<content:encoded><![CDATA[<p>[...] Reinventing the WS Stack (tags: rest webservices SOAP soa architecture by:pete_lacey) [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Stu Charlton</title>
		<link>http://72.249.21.88/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2505</link>
		<dc:creator>Stu Charlton</dc:creator>
		<pubDate>Mon, 08 Jan 2007 06:15:38 +0000</pubDate>
		<guid isPermaLink="false">http://wanderingbarque.com/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2505</guid>
		<description>The issue with reusing WSS is that it's for XML infosets only.  MTOM extends this to other media types, but we still lack message-level integrity and encryption for entire HTTP representations.  Since HTTP headers are the "authoratative" metadata, they too will need integrity protections, with something like HTTPSec.

As for ripping out one's MOM and replacing it with HTTP -- I don't see vendors rushing to commoditize their MOM implementations with highly reliable and scalable implementations of WS-RM.  I think fronting a MOM with HTTP for better interoperability with certain consumer classes, is absolutely a pragmatic and sensible thing to do.
  
IT folks are using SOAP happily, and will continue to (myself included)... but the wall likely is to occur when true IT investment begins on the next round of WS-* specs:  WSDL 2.0,  WS-ReliableMessaging, WS-Addressing, and WS-Policy (specifically WS-SecurityPolicy, and WS-ReliableMessagingPolicy).   The explosion in complexity is staggering - particularly the mess of combining HTTP, WS-A, and WSDL 2.0, and for questionable benefit until we actually start seeing alternative transports take off, like SOAP/UDP or SOAP/MQ.

We, as an industry of technologists, don't have a good understanding of how hypermedia has transformed systems integration.  Its organizational and social consequences are difficult to accept.  It's sort of like the advent of the microcomputer confusing the heck out of minicomputer &#38; mainframers.</description>
		<content:encoded><![CDATA[<p>The issue with reusing WSS is that it&#8217;s for XML infosets only.  MTOM extends this to other media types, but we still lack message-level integrity and encryption for entire HTTP representations.  Since HTTP headers are the &#8220;authoratative&#8221; metadata, they too will need integrity protections, with something like HTTPSec.</p>
<p>As for ripping out one&#8217;s MOM and replacing it with HTTP &#8212; I don&#8217;t see vendors rushing to commoditize their MOM implementations with highly reliable and scalable implementations of WS-RM.  I think fronting a MOM with HTTP for better interoperability with certain consumer classes, is absolutely a pragmatic and sensible thing to do.</p>
<p>IT folks are using SOAP happily, and will continue to (myself included)&#8230; but the wall likely is to occur when true IT investment begins on the next round of WS-* specs:  WSDL 2.0,  WS-ReliableMessaging, WS-Addressing, and WS-Policy (specifically WS-SecurityPolicy, and WS-ReliableMessagingPolicy).   The explosion in complexity is staggering - particularly the mess of combining HTTP, WS-A, and WSDL 2.0, and for questionable benefit until we actually start seeing alternative transports take off, like SOAP/UDP or SOAP/MQ.</p>
<p>We, as an industry of technologists, don&#8217;t have a good understanding of how hypermedia has transformed systems integration.  Its organizational and social consequences are difficult to accept.  It&#8217;s sort of like the advent of the microcomputer confusing the heck out of minicomputer &amp; mainframers.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: William Vambenepe&#8217;s blog &#187; Blog Archive &#187; Give and take</title>
		<link>http://72.249.21.88/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2470</link>
		<dc:creator>William Vambenepe&#8217;s blog &#187; Blog Archive &#187; Give and take</dc:creator>
		<pubDate>Thu, 04 Jan 2007 10:57:25 +0000</pubDate>
		<guid isPermaLink="false">http://wanderingbarque.com/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2470</guid>
		<description>[...] I wasn&#8217;t looking for yet another &#8220;REST vs. Web Services&#8221; thread but Pete Lacey sucked me in (and many others) by hooking us with a hilarious bait post and since then he&#8217;s been pulling strongly on the line with very serious discussions on the topic so we haven&#8217;t been able to let go. The latest one left me a little puzzled though. In the security section Pete writes that it would make sense to use WS-Security indeed (and the SOAP envelope as a wrapper) if there was a need for message-level security rather than simply transport-level security. And then, barely catching his breath, he dismisses WS-Transfer and WS-Eventing in the following paragraph on the basis that &#8220;these specifications effectively re-implement HTTP&#8221; (not really true for WS-Enumeration but let&#8217;s leave that aside). More importantly, how am I to reconcile this with the previous paragraph? Once I use WS-Security and the SOAP envelope, I can&#8217;t use pure HTTP anymore. But the patterns supported by HTTP are still very useful. That&#8217;s what WS-Transfer is for. That&#8217;s what SOAP is for more generally, providing a hook-up point for things like WS-Security that composes with the rest of the message. I don&#8217;t understand how Pete can concede that in some cases message-level security is useful but then take away the possibility to do a GET in these circumstances. Is he saying that for some reason the scenarios that justify message-level security are scenarios in which REST-style interactions don&#8217;t apply? [...]</description>
		<content:encoded><![CDATA[<p>[...] I wasn&#8217;t looking for yet another &#8220;REST vs. Web Services&#8221; thread but Pete Lacey sucked me in (and many others) by hooking us with a hilarious bait post and since then he&#8217;s been pulling strongly on the line with very serious discussions on the topic so we haven&#8217;t been able to let go. The latest one left me a little puzzled though. In the security section Pete writes that it would make sense to use WS-Security indeed (and the SOAP envelope as a wrapper) if there was a need for message-level security rather than simply transport-level security. And then, barely catching his breath, he dismisses WS-Transfer and WS-Eventing in the following paragraph on the basis that &#8220;these specifications effectively re-implement HTTP&#8221; (not really true for WS-Enumeration but let&#8217;s leave that aside). More importantly, how am I to reconcile this with the previous paragraph? Once I use WS-Security and the SOAP envelope, I can&#8217;t use pure HTTP anymore. But the patterns supported by HTTP are still very useful. That&#8217;s what WS-Transfer is for. That&#8217;s what SOAP is for more generally, providing a hook-up point for things like WS-Security that composes with the rest of the message. I don&#8217;t understand how Pete can concede that in some cases message-level security is useful but then take away the possibility to do a GET in these circumstances. Is he saying that for some reason the scenarios that justify message-level security are scenarios in which REST-style interactions don&#8217;t apply? [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Manuzhai</title>
		<link>http://72.249.21.88/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2469</link>
		<dc:creator>Manuzhai</dc:creator>
		<pubDate>Thu, 04 Jan 2007 08:55:32 +0000</pubDate>
		<guid isPermaLink="false">http://wanderingbarque.com/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2469</guid>
		<description>As an aside, I think the open XMPP standard (the basis for Jabber, standardized by the IETF in RFCs 3920 and 3921) should be(come) the de facto standard when thinking about MOM. It's very easy to understand, yet supports a lot of the desired characteristics (such as PubSub, through XEP-0060).</description>
		<content:encoded><![CDATA[<p>As an aside, I think the open XMPP standard (the basis for Jabber, standardized by the IETF in RFCs 3920 and 3921) should be(come) the de facto standard when thinking about MOM. It&#8217;s very easy to understand, yet supports a lot of the desired characteristics (such as PubSub, through XEP-0060).</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Michael Champion</title>
		<link>http://72.249.21.88/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2463</link>
		<dc:creator>Michael Champion</dc:creator>
		<pubDate>Thu, 04 Jan 2007 00:56:57 +0000</pubDate>
		<guid isPermaLink="false">http://wanderingbarque.com/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2463</guid>
		<description>Hmmm ... I come away feeling that you more or less agree that a lot of the basic ideas of the WS stack (such as envelopes and the WS-Security model) would be preserved if it were rewritten by RESTifarians.  

I think the main way various parties to this discussion see the world differently is that some start from the Web and ask "why can't the enterprisey people just do it the Web Way?"  The WS-* folks start from the enterprisey world today(where reliable messaging Just Works, even across multiple nodes and across oceans, gigabytes a day) and ask "how can we achieve these service levels over the internet?"  So, the hybrid system is the only one of interest, AFAIK, since you can indeed do things better with a MOM if you don't have to worry about the Web. 

So I don't understand your conclusion "But the multi-hop/multi-protocol issue is not going to be the impetus". HTTP may be multihop already, but the people who have bet the farm on MQ for the last 30 years are *not* going to rip out their MOM and replace it with HTTP, so fuggidaboudit.  (I know Pete isn't advocating this). 

The nub of the issue is "all of the above messaging styles, while possible, currently exist by agreement between individual clients and servers. They are not standardized, and therefore not subject to common tooling."  SOAP, like XML, may not be elegant or optimal for much of anything, the question is whether it is good enough to provide a standardized tool platform that is better than all those ad hoc agreements that would be needed without a standard.  I don't work in that world anymore, so I don't really know. But the enterprisey people that do know seem to be ignoring this whole debate and just using the WS stuff.  I don't believe that's just because Gartner and IBM and Microsoft et al. tell them what to think, I suspect that many enterprisey types share the sentiments in http://www.macleans.ca/topstories/life/article.jsp?content=20061030_135406_135406 "Pornography, gambling, lies, theft and terrorism: The Internet sucks".  They do NOT trust the Web, they spend their days trying to keep the mess out of their nice clean machine rooms.  
So, a lot of the points about how one might use HTTP in a reliable, secure, multi-hop way without WS-* seem technically valid, but pragmatically implausible.

The bit I like best from this post is "WSS wonâ€™t be reinvented, weâ€™ll simply leverage WSS as it exists and thank the authors for all their hard work."  That's more or less the "Dove" answer that I was hoping for; people are more likely to agree on what to do than why to do it. Use what works, ignore the rest, let Father Darwin sort it all out in the long run.  The real world Web isn't purely RESTful, the real world enterprise needs to accommodate the Web to some degree, let's quit arguing about abstract principles and discuss what works in which scenarios.</description>
		<content:encoded><![CDATA[<p>Hmmm &#8230; I come away feeling that you more or less agree that a lot of the basic ideas of the WS stack (such as envelopes and the WS-Security model) would be preserved if it were rewritten by RESTifarians.  </p>
<p>I think the main way various parties to this discussion see the world differently is that some start from the Web and ask &#8220;why can&#8217;t the enterprisey people just do it the Web Way?&#8221;  The WS-* folks start from the enterprisey world today(where reliable messaging Just Works, even across multiple nodes and across oceans, gigabytes a day) and ask &#8220;how can we achieve these service levels over the internet?&#8221;  So, the hybrid system is the only one of interest, AFAIK, since you can indeed do things better with a MOM if you don&#8217;t have to worry about the Web. </p>
<p>So I don&#8217;t understand your conclusion &#8220;But the multi-hop/multi-protocol issue is not going to be the impetus&#8221;. HTTP may be multihop already, but the people who have bet the farm on MQ for the last 30 years are *not* going to rip out their MOM and replace it with HTTP, so fuggidaboudit.  (I know Pete isn&#8217;t advocating this). </p>
<p>The nub of the issue is &#8220;all of the above messaging styles, while possible, currently exist by agreement between individual clients and servers. They are not standardized, and therefore not subject to common tooling.&#8221;  SOAP, like XML, may not be elegant or optimal for much of anything, the question is whether it is good enough to provide a standardized tool platform that is better than all those ad hoc agreements that would be needed without a standard.  I don&#8217;t work in that world anymore, so I don&#8217;t really know. But the enterprisey people that do know seem to be ignoring this whole debate and just using the WS stuff.  I don&#8217;t believe that&#8217;s just because Gartner and IBM and Microsoft et al. tell them what to think, I suspect that many enterprisey types share the sentiments in <a href="http://www.macleans.ca/topstories/life/article.jsp?content=20061030_135406_135406" rel="nofollow">http://www.macleans.ca/topstories/life/article.jsp?content=20061030_135406_135406</a> &#8220;Pornography, gambling, lies, theft and terrorism: The Internet sucks&#8221;.  They do NOT trust the Web, they spend their days trying to keep the mess out of their nice clean machine rooms.<br />
So, a lot of the points about how one might use HTTP in a reliable, secure, multi-hop way without WS-* seem technically valid, but pragmatically implausible.</p>
<p>The bit I like best from this post is &#8220;WSS wonâ€™t be reinvented, weâ€™ll simply leverage WSS as it exists and thank the authors for all their hard work.&#8221;  That&#8217;s more or less the &#8220;Dove&#8221; answer that I was hoping for; people are more likely to agree on what to do than why to do it. Use what works, ignore the rest, let Father Darwin sort it all out in the long run.  The real world Web isn&#8217;t purely RESTful, the real world enterprise needs to accommodate the Web to some degree, let&#8217;s quit arguing about abstract principles and discuss what works in which scenarios.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mark Baker</title>
		<link>http://72.249.21.88/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2460</link>
		<dc:creator>Mark Baker</dc:creator>
		<pubDate>Wed, 03 Jan 2007 22:46:23 +0000</pubDate>
		<guid isPermaLink="false">http://wanderingbarque.com/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2460</guid>
		<description>Just wanted to point out that HTTP is already multi-hop, and there's a ton of experience with that viz a viz caches, firewalls, surrogates; basically every intermediary configuration dreamed up by SOAP advocates and then some.  HTTP doesn't have a processing model that includes intermediary targetting, nor are intermediaries first class (not identified by URI, but by IP/port), but I'll take feature-deficient-and-widely-interoperable over untested specware anyday.  Anyhow, Waka's supposed to address those deficiencies IIRC.</description>
		<content:encoded><![CDATA[<p>Just wanted to point out that HTTP is already multi-hop, and there&#8217;s a ton of experience with that viz a viz caches, firewalls, surrogates; basically every intermediary configuration dreamed up by SOAP advocates and then some.  HTTP doesn&#8217;t have a processing model that includes intermediary targetting, nor are intermediaries first class (not identified by URI, but by IP/port), but I&#8217;ll take feature-deficient-and-widely-interoperable over untested specware anyday.  Anyhow, Waka&#8217;s supposed to address those deficiencies IIRC.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Stefan Tilkov's Random Stuff</title>
		<link>http://72.249.21.88/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2458</link>
		<dc:creator>Stefan Tilkov's Random Stuff</dc:creator>
		<pubDate>Wed, 03 Jan 2007 19:25:18 +0000</pubDate>
		<guid isPermaLink="false">http://wanderingbarque.com/nonintersecting/2007/01/03/reinventing-the-ws-stack/#comment-2458</guid>
		<description>&lt;strong&gt;(Not) Reinventing the WS Stack...&lt;/strong&gt;

Yet another excellent post by Pete Lacey. I&#8217;m in violent agreement and don&#8217;t have much to add; one thing I&#8217;ll note is that Mark has convinced me long ago that protocol independence is a bug, not a feature. I assume this is a sentiment...</description>
		<content:encoded><![CDATA[<p><strong>(Not) Reinventing the WS Stack&#8230;</strong></p>
<p>Yet another excellent post by Pete Lacey. I&#8217;m in violent agreement and don&#8217;t have much to add; one thing I&#8217;ll note is that Mark has convinced me long ago that protocol independence is a bug, not a feature. I assume this is a sentiment&#8230;</p>
]]></content:encoded>
	</item>
</channel>
</rss>
