Bytes not infosets

Security is the one area where the WS-* world has developed a set of standards that provide significantly more functionality than has so far been standardized in the REST world. I don't believe that this is an inherent limitation of REST; I'm convinced there's an opportunity to standardize better security for the REST world. So I've been giving quite a lot of thought to the issue of what the REST

[yyamano]

"I've been giving quite a lot of thought to the issue of what the REST world can learn from WS-Security." "one aspect of the WS-* approach that should not be carried over to the REST world is the emphasis on XML infosets."