Mark O'Neill on PKI and SOA

+1 for Mark O'Neill on this post:

...SOA is Dead... reminds me of another Three letter Acronym which 
Was declared dead. Back then, eight years ago, it was PKI which was declared dead. There are similarities with SOA. In the case of PKI, there was a tendency towards what in France are called "grands projects", ie large complex deployments. The "full blown PKI", with its CA, RA, hardware stores, etc etc, was a classic example of this. Banks and governments were seduced by this, and often built out architecture for the sake of architecture. What was missing from PKI? The focussed applications. It is hard not to see the analogy with SOA "grands projects", complete with UDDI, etc.

In the meantime while PKI was being declared dead, VeriSign had created their own PKI in the "cloud", (which they never called a PKI). Savvy organizations started to focus on the applications (chiefly SSL) and outsourced the PKI itself to the Cloud (VeriSign) to deal with key issuance, certificate expiry management, etc. VeriSign did very well out of this. While "PKI" became a dirty word, VeriSign prospered with a cloud PKI. Who is the VeriSign in the SOA analogy? Amazon. Without ever calling their services, or indeed their services hosting platform, an "SOA", they have build the successful SOA in the cloud.

And what is the equivalent of SSL, ie the simple and useful application of the techhology? The answer this time is REST, SaaS, and the direct EDI-style XML messaging which we have seen many Vordel customers successfully use. 

By the way, whatever about SOA, I don't agree that SOAP (and the many WS-* technologies) is dead. *building it from scratch* is dead, but any glance under the hood of Microsoft .NET shows it is very much alive and is becoming more and more a core part of Windows (just as Microsoft build PKI into Windows server products quite successfully and quietly). And it is not a case or "either / or" SOAP or REST: XML Gateways (such as Vordel's) do a very successful job of mediating between the two.

We know Microsoft is light years ahead of the Java community on security, I wonder when we will see the Java folks at Sun and IBM catch up to where Microsoft is now on message level security?

Like PKI, the "grands projects" approach to SOA is dead. But that opens up the opportunity for focussed applications, for cloud providers, and for XML Gateways which, through protocol mediation, make the "SOAP vs REST" debate moot.

Heck, Mark I don't care for grand projects either, I am a bottom up guy 98% of the time, I am not picky and would be happy with people put in authN and authZ whichever service style they choose. 

I guess the thing I come back to is that people built out web apps for 5 or more years before people finally started thinking about XSS, SQL Injection and stuff, so we are on about 5 or 6 years of people building Web services, maybe soon the herd (outside of Redmond) will start figure out where the vulns are at?

Comments

[Marinus van Aswegen]

Most three letter fads don't have a killer app, nor a proper business case. Should we be surprised that they end up as dirty words?