Sun Backs Rival's Web Services Security Effort

Sun Backs Rival's Web Services Security Effort

By Richard Karpinski

Microsoft, IBM, and Verisign this week submitted their Web Services Security (WS-Security) specification to the OASIS standards body and picked up a new friend along the way -- Sun Microsystems.

The jockeying over Web services standards has grown to a frenzied pace. By moving WS-Security over to OASIS, which is the home for many key Web services standards, IBM and Microsoft were able to convince Sun -- and a slew of other companies -- to back the security effort.

WS-Security aims to specify how to secure Web services -- including encryption and access control -- in a platform-independent manner. Security has emerged as key driver -- and potential stumbling block -- in the deployment of Web services by enterprise customers.

Other backers of WS-Security at OASIS include Baltimore Technologies plc., BEA Systems Inc., Documentum Inc., Entrust Inc., Netegrity Inc., Novell Inc., Oblix Inc., RSA Security Inc., SAP AG, Sun, Systinet Corp., and Vodafone Group plc.

WS-Security defines a set of Simple Object Access Protocol (SOAP) headers that can be used to implement security measures for Web services. Vendors and enterprises would use the base WS-Security protocol to hook federation, policy, access, and trust systems into their Web services frameworks.

Companies will be able to license the ultimate WS-Security specification on a royalty-free basis.

Sun had been devising its own rival Web services security specification, but the royalty-free licensing of WS-Security specifications allayed its concerns, a source familiar with the negotiations said.

Sun has been actively lobbying for a board slot on the Web Services Interoperability (WS-I) Organization, a group led by IBM and Microsoft that is working to create Web services best practices and technologies that will run on a cross-platform basis.

So much for your objections over security.

Oh, so now none of this has to be tested or proven yet?

Again, you so misunderstand me. I don't trust Sun any more than the rest of them.

Show me, don't sell me. These companies have an interest in selling something, and that makes their sales pitch suspect, and requires a savy consumer to wait for proof.

I'll believe it when I see the working specs in a production system. Until then, it's vaporware.

The vast majority of all security problems are implementation errors.

You're an MS shill. For reasons of your own, if MS is for something you have to be for it.

I, on the other hand, am just an independent developer. My job depends on knowing which solution is best, regardless of vendor.

Sun being for this doesn't in any way, shape or form influence me. I don't care who is selling it. I want to see results before I'll buy it.

"I, on the other hand, am just an independent developer. My job depends on knowing which solution is best, regardless of vendor. "<>p>Harr, come on, you are so anti-Microsoft and know so little of .NET that you couldn't possibly be independent, much less know what solution is best.

While I won't claim to be a J2EE expert, I do know the Microsoft solutions that I present are excellent and the best cost. I don't have to bend to the liberal idea of a technical group hug and embrace all technologies before I am allowed to know that I provide proper solutions. I am an expert with Microsoft products and technologies and have experience with many other systems. For that, I know what I am providing, and I don't need to know how Java would have done it.

If a Ford mechanic doesn't know Dodge, it doesn't mean he is a bad mechanic. If a pilot of a 767 has never flown a 777, it doesn't mean that he isn't an excellent pilot. Trying to state that you are agnostic is a very liberal concept. It is the equivalent of a group hug. “I embrace everybody!” Experts in the computer industry cannot be deep if they try to be wide, because there is just way too much that must be known to be an expert.

Ya know, if Bill Gates farted you’d try to claim that he was trying to take over the wind.

For that, I know what I am providing, and I don't need to know how Java would have done it.

If you provide solutions and solve problems, then in order to select the best solution, you have to have knowledge of all alternatives. If, like you, you *don't* know the way Java would have done it you don't know if the Java way would be better.

That's a simple, undeniable truth.

This is one thing that just amazes me about MS-only techies.

I do believe you provide your clients with some good, workable solutions. I just also know you don't always give them the best solution, nor for the best price. Sometimes, sure. Especially for small clients with simple needs, an MS-only solution can be adequate, and cheaper. In those cases, I use MS solutions.

But not always. There are many, many times when a Java solution is superior. In those cases, I provide a Java solution.

It's like with Insurance Agents. Are you better off with an agent who only works for *one* company, or an independent agent who knows the prices of all the companies and selects the best solution for your needs, regardless of vendor?

If you're MS-only for business reasons, that's understandable. If you want to specialize on one skill set, say. You probably can provide a better MS-only solution than I can, for a better price. But don't pretend that's the best way to provide service to your client. You're MS-only for your own reasons.

"If you provide solutions and solve problems, then in order to select the best solution, you have to have knowledge of all alternatives."

You are confusing business needs with technical capability. A best solution is far from one that is technically perfect. Maybe .NET or Java isn't the perfect technical solution in any given case, but it may be the best. Other reasons such as employee capability, operational support, total cost, time to market, current environment, etc., all play a role in what is perfect. Both J2EE and .NET do things very well, some things better than the other. What is important is the total solution. I can present in 99.99% of the cases a .NET solution that Java would also be well suited for. Java would fit 99.99% of the cases against .NET. It is almost a total wash, technically speaking. What is most important is my company's capability to use the tools and the client's ability to absorb our proposed solution. I am damned good at what I do, and it isn't because of the tools; it is because of my ability as an expert and my use of the tools to create solutions. Business needs beget tools. Tools do not beget solutions.

It is almost a total wash, technically speaking.

Having knowledge of both, I disagree.

You, of course, just don't know this, since you lack the knowledge of Java solutions. There are absolutely many, many situations in which a Java solution is certainly the best for the client. And you can't give the client the best solution, in those cases.

Java has become the dominant choice for new development. There are technical reasons for that.

If you had health problems, would you be better served going to a doctor who was an expert in one drug company's products only?

Or would you prefer a doctor independent of the drug companies, one who will select the best solution for you regardless of vendor?

Again, the decision seems obvious.

One of the biggest problems with a single-vendor provider is that many times, they will *try* and sell you on a solution that isn't the best, but tell you it's the best, for their own business needs.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.