Re: IBM i in the cloud (was social media)

[Henrik RÃtzou <hr@xxxxxxxxxxxx>]

Richard,

HTTPS does provide some security,

but a real REST enabled application is like having a totally free Command
Line in 5250,
enter PWRDWNSYS and the system will do as it is told.

The trick is to create an enviroment where any program (service) that can be
reached from
the outside is protected not only by a session id but also by the server has
granted permisson
for the client to run it with the limitation the server also grants - e.g.
you are allowed to delete
this order but you are not allowed to delete *ALL

You may be able to retreive data from this service - but it is limited to
your own - this is what
the security layer should be able to do - and this is what EGL and other are
not in general able
to do.