R – ASP.net Web Services versus WCF

I actually switched our software from traditional .NET Remoting to WCF. The bloat in communication that occurred from Remoting was amazing (just look at a wireshark trace). Before moving to WCF i thought about using just a traditional .NET webservice, but the interfaces we implimented for our remoting calls would require to much modification (We had used some out and ref parameters which an Asp.Net webservice cant do if I am not mistaken).

Really, I cant think of a reason to go with an Asp.Net webservice, but Im not an Asp.Net guy. To me, it offers no advantages over WCF. It may be easier to go with a webservice, but the flexibility WCF offered was what I needed. Especially in the area of message formatting.

I like my WCF service because with one service I can either serve up JSON or SOAP/XML and all the protocols are supported (ipc, tcp, and http).

The bummer with WCF is that its strict bindings require you to define an endpoint for both HTTP and HTTPS if you wish to use it in a web based scenario. Unlike a traditional Webservice which "just works" regardless if its secure or not.

Why is a publicly available WSDL not desirable for security reasons?

I may be willing to admit that publishing an API (which is basically what you are doing with WSDL) makes you a bit more vulnerable than if you didn't, but it would be wrong to assume that hiding the WSDL constitutes any kind of security. This is ironically called security by obscurity, and it will be broken by any determined attacker.

The web service should be secure in itself. WCF offers many security features, but that is perpendicular to your question.

I'd prefer publishing the WSDL. If you don't want to do that, or if there is a policy in place that says that you can't do that, then send the WSDL to the client team so they can use it as they wish.

Precompiling the proxy will only enforce your coding conventions on the client team, and they may not appreciate that - for example, I often prefer my proxies to be generated with the /i switch that makes the generated classes internal. I also like to be able to specify the .NET namespaces so that they fit the rest of my code. That would not be possible if I got a precompiled assembly (I would be able to use it anyway, but it would just annoy me).