End Run Around the Standards Bodies

In February 2002, Microsoft and IBM, along with seven other vendors, founded the Web Services Interoperability Organisation, or WS-I (famously excluding Sun from the group's board at first, but later allowing it to join). WS-I is not a standards organisation per se, but it combines different Web services pieces in an installation-ready package. It calls these packages of Web services "profiles", and offers tools and guidelines for installing them. The first profile, called the Basic Profile, was released last August.

"[WS-I is] a supra-standards body that ratifies which of these standards will be the baseline for Web services," says Dan Sholler, vice president and director of technology research services at Meta Group.

The problem, critics say, is that WS-I can pick and choose the pieces it wants to include in the profiles. "With WS-I, Microsoft and IBM have set up a shadow government for standards," charges Susy Struble, program manager of Web standards and technologies for Sun.

The first profile, for example, contains versions of SOAP and WSDL (Web services description language) that were never ratified as standards by W3C but are included in Microsoft and IBM products. But W3C has approved versions of SOAP and WSDL that have been modified from the versions contained in the WS-I profile. That means CIOs are being presented with two different versions of the core standards for Web services.

"These standards are always evolving," says Microsoft's VanRoekel, who is a member of the marketing committee for WS-I. "W3C ratified SOAP late in the process of putting together the first profile. [The W3C standard version] will be incorporated into the next profile." IBM's Eisenstadt agrees, adding: "These versions of SOAP and WSDL have the broad industry adoption that is needed."

But what if competing standards come out of W3C and Oasis?

"Multiple proposals indicate lots of interest - it's not evil," says IBM's Eisenstadt. "The market should decide which proposals are best. Interoperability is the whole point of Web services, so single standards will emerge."

Adds VanRoekel: "WS-I will take a look at what customers are implementing and decide [which standard to include in a profile] based on that." He encourages those with concerns about the process to join WS-I. "IBM and Microsoft aren't the only members of WS-I," he says. "We don't decide what the WS-I does."

Indeed, Microsoft and IBM are not alone in contributing to the confusion. Sun has co-founded its own standards group, Liberty Alliance, to develop a Web services standard for identity management that uses SAML (security assertion markup language), an Oasis security standard. (Microsoft and IBM have released a specification called WS-Security that, according to Sai Allavarpu, group manager of Sun One Network Identity, treads near the same turf.)

But with their combined market clout, Microsoft and IBM have the power to push their own specifications and ignore others to death. At least that's what AMR's Austvold predicts will happen to the WSCI business process specification now before W3C. "That's going to be dead within 24 months," he says.

"Can you have a standard without Microsoft's and IBM's participation?" asks Meta Group's Sholler. "Yes." But if that standard does not appear on the Windows platform, which commands upward of 95 per cent of the PC market in the US, and does not appear in IBM's Unix and mainframe platforms, will anyone use it? he asks.