[wss] RE: Security Rift

[Anne Thomas Manes <anne@manes.net>]

Darryl,

I just read your article at
http://www.eweek.com/article2/0,3959,599072,00.asp. This is a gross
exaggeration of what's really going on. We're having a discussion. It
certainly shouldn't be characterized as a rift.

Discussions are a normal part of the standardization process.
Standardization is about consensus. Consensus requires agreement among the
entire team. There are about 75 people participating in this group,
representing about 50 different companies, plus a few individuals such as
myself.

I tend to agree (although I'm flexible in my opinion) that the team needs to
produce a specification for the WSDL extensions before releasing an official
OASIS draft of the SOAP extensions specification. You won't achieve
interoperability until you have a standard way to describe the extensions. I
also don't think that a short delay on the part of the WSS team will be
damaging to the industry.

The MSFT/IBM/VRSN spec is publicly available. I don't think it's critical to
put the OASIS stamp of approval on this spec for it to be viewed as valid.
Consider, for example, that SOAP 1.1, WSDL 1.1, and UDDI 2.0x still don't
have an official stamp of approval from any standards organization. Yet
people treat them as standards.

Best regards,

Anne Thomas Manes
617-497-1748 (land)
617-642-3144 (mobile)