3 ms·

I'm not aware of a XML-RPC protocol which is secure.

• dozzie 10y ago
  I don't understand your statement. XML-RPC is not inherently "secure" or "insecure", no more than just HTTP is.
  • grymoire1 10y ago
    You were the one who said RPC should be used instead of SSH. People use SSH because it's secure, despite the issues in passing parameters. Suggesting that RPC be used instead of SSH while ignoring security is terrible advice.
    • dozzie 10y ago
      You know what's the difference between XML-RPC and SSH with regard to payload encryption and client authentication? Only the fact that SSH has the two covered by mandatory parts of the protocol, and XML-RPC has this part optional (HTTPs and either HTTP authentication or client certificates). Nothing prevents you from exposing procedures only through HTTPs and only to authenticated clients. In fact, my xmlrpcd works exactly this way. Security-wise, your advice to use something that makes building correct system virtually impossible (because quoting issues, unnecessary features enabled by default, and others) is simply stupid and dangerous.