Live data from Hacker News

SOAP: The 'S' stands for simple (not really)

harmful.cat-v.org

41–50 of 92 posts

Re: SOAP: The 'S' stands for simple (not really)

#42
post #11

Must be ~5 years since I last used SOAP. Needless to say I hated the stuff. Complex to build, complex to use (interoperability between different stacks - java/.net/... - was like 'cross your fingers and hope for the best'), complex to debug and walk through tcpdump network packets. It's complex in every way but the name. Of course, since that times I've alway advised against web services and so far I've succeeded in…

I'm being asked to create webservices so other developers don't do direct database access and their stuff wont break when things change. How do you manage that?

One of several great motivations for that approach is that you want the power to refactor the database later without being limited by the fact that you have seven applications from seven different divisions of the company all hooked up to a single schema design. You want to be able to moderate through a business logic layer.

Many businesses wind up in this situation by chance, and then have a very painful journey out of the casual schema they created when they were a small business into something which matches their larger business.

Unfortunately, IMO, supplying a good answer to that question is the 'northwest passage' of software development.

I've spent years at it on and off. I can create such a layer, but the solutions I've come up with are unwieldy from the perspective of the business layer programmer, which is an inadequate solution.

--

If I have another attempt, I'll try to create something which would look to the observer quite a lot like visual basic, but where instead of constructing a Windows forms, you're constructing a state, which consists of a set of forms and a variable store.

The datatypes for the fields would be something like this:

    Readonly
    Boolean
    Text (untyped)
    SingleSelect (conceptually like html dropdown)
    MultiSelect (like checkbox)
    ExposeObject (the object is tagged, client
         can bookmark these these objects in its
         session)
    ReferenceSocket (the socket indicates the tags it
         accepts, exposes compatible tags, connection point
         for bookmarked objects with compatible tags)
    Link (like html link)
    Action (like html submit button)
A client API then migrates this with a query language that navigates the states. An example of a dumb session that knows nothing of the app to which it's connecting, and which is rendering a UI on the fly:

    # Remote application knows nothing
    list all
    # It gets back a description of the current state, 'login'

    # Remote application logs in to session
    assert form is login
    set username wizard_2
    set password whatever
    action login
    list all
    # Remote application has control again

    # Remote application wants to know what operations are available
    assert form is portal
    list actions

    # Remote application decides it wants to go to person
    assert form is portal
    link "manage person"
    list actions

    # Remote app decides to add a person
    assert form is "manage person"
    link new
    list all
    # Shows fields and actions

    assert mode is new
    set firstname Wiz
    set lastname Ard
    set age 40
    select male from singleselect 
    action save
    # Application throws an exception with details

    # Client app
    assert mode is new
    set data_of_birth 08081971
    action save
    list form
Just as SQL is a flexible language for a relational model, this language is a flexible language for an interactive state graph. A client progrmamer who know the state mapping of the app could write tighter instructions than this.

That client app can be anything: desktop app, unit test framework, web app, direct rpc over http.

Conceptually the situation of states, objects and actions is very similar to a text adventure, but I'd been working on it for years before I realised this.

Every time the state progresses from one to the next, it keeps a copy of the previous state in memory.

This logic layer has the database underneath it. The DB is now abstracted away from the user-facing application. Major benefits of this approach:

- You can design the application with almost no concern to user interface. Then you can create a streamlined user interface later that leverages the correct business logic. You can separate the costing for both projects. That's how I came to the problem. It would revolutionise software consulting.

- You can wrap a dumb client interface around the engine. Want your entire business logic exposed to the web, securely? Or RPC? Or mobile? Or for the blind? Done, with literally zero extra effort.

- If we had a relational database that had version numbers for its internal state (think git model), you could write applications that could unwind and rewind. Takes a lot of memory, but you could store the states in a nosql database.

--

OK. I'll try to answer your question now with the best I know of current techniques. Things using current technology that somewhat address the question you asked:

- Filter all chat with the database through stored procedures. Problems with this: (1) non-stateful, you don't have the user's application session; (2) stored procedure languages are a pain to work with. This is the sort of solution you'll find most often in large organisations because you can hire a single known skillset (DBA) who knows both stored procedures and schemas. It's awful but it works.

- Put a HTTP layer between the database and the application. Do all interaction with the database through this. In the payload that users send in they could (1) name the action they want to do such as create person and (2) supply the arguments they should send in for that business case. Basically, here you're doing stored procedures but in language of your choice. Latency is higher than with real stored procedures.

- Have a rule that all application programmers integrate with the application using Apache Cayenne or Hibernate or something similar as an object-relational modeler, in a strongly-typed language. Insist on use of Data Access Object pattern (see Fowler) for any original entrypoint to the object graph. Now when you refactor your database, regenerate your schema, and use the static typing checking in Java to rapidly adjust your application to the changed schema. You'd need to get all client apps to do this, but it's a lot more rapid than if you've got application users using SQL.

Re: SOAP: The 'S' stands for simple (not really)

#43

We have the misfortune of dealing with a third party SOAP API at my office. My coworker did it the "correct" way, autogenerating thousands of lines of C# from the WSDL and trying to get the objects transparently serialized and deserialized. That turned out to be a multi-week effort, so finally I got fed up and spent 4 hours writing code to directly extract the values we needed from the raw XML.

If you have a narrow use case for a vast XML API/file format this is always the right approach (whether it's SOAP or not).

Re: SOAP: The 'S' stands for simple (not really)

#44

Earlier quoted context omitted.

I'm being asked to create webservices so other developers don't do direct database access and their stuff wont break when things change. How do you manage that?

Designing an API is a skill in itself, but I think rule 1 is "Don't use SOAP" JSON over REST seems to be flavour of the month FWIW.

"Flavour of the month" might be a bit harsh. It certainly is popular these days, so it's not wholly inappropriate. But it's worth noting JSON/REST is popular with, and largely because of, people who've learned the painful lessons of earlier messes like SOAP.

It's not (just) a hot new thing used by new faces who've never really known any other way.

Re: SOAP: The 'S' stands for simple (not really)

#45

Love it. However at least SOAP is a spec and generally works. REST is an architectural style there is no spec, just a idea! Added to that most folk also only build REST-like services. Implementing a client for REST based services often requires a bunch of (generally simple) coding which takes time and is error prone. Also pure REST is really good for building data access/CRUD services but makes it hard to build RPC t…

> However at least SOAP is a spec and generally works.

SOAP has several versions of the spec and a bunch of vendor-specific cruft. The SOAP use-cases from this comment thread are enough indication of that.

> REST is an architectural style there is no spec, just a idea!

Yeah, but you use REST every day in your web browser. A lot of the times it isn't strongly RESTful, but it's still REST. For example, to view this comment thread and post your reply to someone's comment.

In SOAP, if I call the getUserByID(42) method on your end, and you don't have a user with id 42, what do you do? Do you return an empty response? Do you return some kind of SOAPFault? If so, what kind?

In REST, if I GET http://yourservice.com/users/42 and you don't have user 42, I get HTTP 404. That's the only logical response.

> Implementing a client for REST based services often requires a bunch of (generally simple) coding which takes time and is error prone.

This is no different from SOAP, with the exception that with SOAP you have to have your requests stuffed into XML by some libraries which have read some other autogenerated XML to figure out how to stuff your requests.

With REST, you can write a library (that wraps HTTP calls), or you can use curl, or (for simple GET requests) you can use your browser. Your platform might not support SOAP, but it definitely supports REST.

> Also pure REST is really good for building data access/CRUD services but makes it hard to build RPC type services without mangling the semantics.

This has been said multiple times but let's say it again:

REST is not RPC.

If you're looking to remotely call procedures on your app, REST isn't going to provide that.

The only case where REST doesn't work is the case where your client demands SOAP. In any other case, REST works beautifully. Not everyone does REST right, but even when it's done suboptimally (e.g. not providing hyperlinks to related resources) it's still worlds better than SOAP.

Re: SOAP: The 'S' stands for simple (not really)

#46
post #11

Must be ~5 years since I last used SOAP. Needless to say I hated the stuff. Complex to build, complex to use (interoperability between different stacks - java/.net/... - was like 'cross your fingers and hope for the best'), complex to debug and walk through tcpdump network packets. It's complex in every way but the name. Of course, since that times I've alway advised against web services and so far I've succeeded in…

Seriously? I'm actually surprised that anyone would find SOAP complex. I see it as incredibly simplistic to implement. Are you really saying you avoid web services because you don't understand SOAP? I've done them in both .NET and Java many times.

Re: SOAP: The 'S' stands for simple (not really)

#47
post #17

We have the misfortune of dealing with a third party SOAP API at my office. My coworker did it the "correct" way, autogenerating thousands of lines of C# from the WSDL and trying to get the objects transparently serialized and deserialized. That turned out to be a multi-week effort, so finally I got fed up and spent 4 hours writing code to directly extract the values we needed from the raw XML.

I'm no fan of SOAP, but as a C# guy I'm curious to know what took so long?

I've got the same question. But I've written them in both Java and C#.

I worked on a project recently where we had a team of Java guys who worked on a SOAP implementation for a month. They could not get it to work in any way, shape or form. It was handed to me, and three of us did it a half an hour. All custom SOAP, still worked.

I just don't comprehend why this seems so hard to people on Hacker News. SOAP is just another protocol and as messy as any other.

Re: SOAP: The 'S' stands for simple (not really)

#48
post #11

Must be ~5 years since I last used SOAP. Needless to say I hated the stuff. Complex to build, complex to use (interoperability between different stacks - java/.net/... - was like 'cross your fingers and hope for the best'), complex to debug and walk through tcpdump network packets. It's complex in every way but the name. Of course, since that times I've alway advised against web services and so far I've succeeded in…

I'm being asked to create webservices so other developers don't do direct database access and their stuff wont break when things change. How do you manage that?

mmmm, I'd be very wary of doing this. This kinda of "data" or "infrastructure" level service often devolves into a service that can accept SQL or lands up exposing the oddities of the DB anyway. Because they are low-level they also tend to be very chatty and performance goes right out the window. They probably should be an anti-pattern.

If you image a pyramid of service types:

Business Process

Business Operation

Component

Infrastructure/Data

Then you want to shoot for building "Business Operation" type services. These give you the maximum reuse in an enterprise as they encapsulate a useful atom of business functionality. They hide the complexity of an enterprise's IT systems from consumers and typically use semantics that are business not IT system specific. For example CreateOrder, CreateCustomer etc...

Component services are the other useful one. Typically used to wrap a system with web services. This eases integration and allows for aggregation of these services into Business Operation services.

For instance the CreateCustomer service above might call CreateCustomer in System A, RegisterMember in System BB and write a record into a the Users table of System C (sometimes its impossible/cheaper not to use web services).

As for as the consumer (the helpdesk app, the self service portal etc.) is concerned they just created a Customer within the business and they don't need to know anything about Systems A, B and C.

Re: SOAP: The 'S' stands for simple (not really)

#49
post #11

Must be ~5 years since I last used SOAP. Needless to say I hated the stuff. Complex to build, complex to use (interoperability between different stacks - java/.net/... - was like 'cross your fingers and hope for the best'), complex to debug and walk through tcpdump network packets. It's complex in every way but the name. Of course, since that times I've alway advised against web services and so far I've succeeded in…

Seriously? I'm actually surprised that anyone would find SOAP complex. I see it as incredibly simplistic to implement. Are you really saying you avoid web services because you don't understand SOAP? I've done them in both .NET and Java many times.

Yes, seriously. Life is complex as it is and that is doubly true for programmer. If you're doubting my ability to understand the specs and various implementations, then I must disappoint you. I understand them well enough, it's just pointless to spend inordinate amounts of time to make communication between implementations work.

Re: SOAP: The 'S' stands for simple (not really)

#50
post #4

I think it's a law that any protocol or technology with 'simple' in the name invariably isn't.

I once worked at a company that had a platform named "Occam". While I was learning the system, I asked someone who had been there for a long time if they had chosen that name ironically. He didn't think it was funny.
Post reply on HN