3 ms·

I remember using XML-RPC back in the day to communicate between a desktop client and a web service. It was fantastic. And then designer went off with a commit

I remember using XML-RPC back in the day to communicate between a desktop client and a web service. It was fantastic. And then designer went off with a committee somewhere and produced SOAP. The regret with XML is that it continued to evolve into a monstrosity. Thankfully JSON came along and got back to the simplicity of early XML and XML-RPC and stayed there.

user5994461 6y ago
I remember killing some old XML-RPC applications. Deserialization and remote code execution vulnerabilities all over the place. That was brutal. Who thought this was a good idea to pass arbitrary function names and arguments for the remote servers to resolve and execute blindly? The regular vulnerabilities in the XML parsing libraries themselves was the nice cherry on top.
- wvenable 6y ago
  > for the remote servers to resolve and execute blindly I'm not sure who would would to that but I certainly didn't. Ultimately XML-RPC is no different from REST/JSON except it's in a different format. What you did with that format is a totally different issue.
  - user5994461 6y ago
    Just take the first example from wikipedia: <?xml version="1.0"?> <methodCall> <methodName>examples.getStateName</methodName> <params> <param> <value><i4>40</i4></value> </param> </params> </methodCall> The thing is meant to call arbitrary functions with arbitrary arguments. It doesn't take long until there is a straight up exec functions exposed or some accidental command injection. It's strange to look at it 20 years later. The adoption of JSON really got developers to stop shipping RCE vulnerabilities every other week. Yet nobody must have thought of that when deciding what to use.
    - wvenable 6y ago
      What do you think happens with REST and JSON? Or SOAP? This is exactly identical to: { "methodName": example.getStateName "params": [14] } Although you'd probably instead have an REST endpoint contain the method name and the entire JSON body is the parameters. But the difference is minor. There's no reason this allows arbitrary execution than anything else. Methods directly exposed to the web is how 99% of all MVC frameworks work.
enriquto 6y ago
> I remember using XML-RPC back in the day to communicate between a desktop client and a web service. It was fantastic. My favorite quote about XML-RPC (from the plan9 people): Some part of me desperately wants to believe that XML-RPC is some kind of elaborate joke, like a cross between Discordianism and IP Over Avian Carriers I have exactly the same feeling regarding the JSON "protocols" and whatnot.
- wvenable 6y ago
  If you think about it, it is truly crazy. You're using HTTP over TCP/IP to send JSON to do RPC. Some form of RPC has effectively been around forever. But despite the layered complexity there is something to doing RPC this way that just works. Maybe it's that you can leverage several decades of work on load balancing and firewalling HTTP connections. Maybe it's that binary RPC protocols are too brittle and change is too difficult. I don't know.

user5994461 6y ago

I remember killing some old XML-RPC applications. Deserialization and remote code execution vulnerabilities all over the place. That was brutal. Who thought this was a good idea to pass arbitrary function names and arguments for the remote servers to resolve and execute blindly? The regular vulnerabilities in the XML parsing libraries themselves was the nice cherry on top.

wvenable 6y ago
> for the remote servers to resolve and execute blindly I'm not sure who would would to that but I certainly didn't. Ultimately XML-RPC is no different from REST/JSON except it's in a different format. What you did with that format is a totally different issue.
- user5994461 6y ago
  Just take the first example from wikipedia: <?xml version="1.0"?> <methodCall> <methodName>examples.getStateName</methodName> <params> <param> <value><i4>40</i4></value> </param> </params> </methodCall> The thing is meant to call arbitrary functions with arbitrary arguments. It doesn't take long until there is a straight up exec functions exposed or some accidental command injection. It's strange to look at it 20 years later. The adoption of JSON really got developers to stop shipping RCE vulnerabilities every other week. Yet nobody must have thought of that when deciding what to use.
  - wvenable 6y ago
    What do you think happens with REST and JSON? Or SOAP? This is exactly identical to: { "methodName": example.getStateName "params": [14] } Although you'd probably instead have an REST endpoint contain the method name and the entire JSON body is the parameters. But the difference is minor. There's no reason this allows arbitrary execution than anything else. Methods directly exposed to the web is how 99% of all MVC frameworks work.

enriquto 6y ago

> I remember using XML-RPC back in the day to communicate between a desktop client and a web service. It was fantastic. My favorite quote about XML-RPC (from the plan9 people): Some part of me desperately wants to believe that XML-RPC is some kind of elaborate joke, like a cross between Discordianism and IP Over Avian Carriers I have exactly the same feeling regarding the JSON "protocols" and whatnot.

wvenable 6y ago
If you think about it, it is truly crazy. You're using HTTP over TCP/IP to send JSON to do RPC. Some form of RPC has effectively been around forever. But despite the layered complexity there is something to doing RPC this way that just works. Maybe it's that you can leverage several decades of work on load balancing and firewalling HTTP connections. Maybe it's that binary RPC protocols are too brittle and change is too difficult. I don't know.