We are arriving the version N, of a very complex specification, where on theory, instantiate objects, on JSON form, or binary form using a proxy object embodied on Browser. Since i can perform a request using REST (which is simpliest thant WS-Specs for sure), and the response is consitutude by several objects, cookies, headers, the URI and the response body. Also, i can set up the mime-type, so is almost more complex than CORBA, it is like some years studying, in the mean time you watch and learn, then this response came a binary object, 0's and 1's solely. In a spec done in IDL, and this is not near close to CORBA?
Not that CORBA is the best but it is the same thing, and CORBA can be more simple, you have IIOP resolving names, so you make a request to a proxy endpoint, this endpoint returns just an image that instantiate an object on Browser it is almost the same thing, also returning the IOR in case of CORBA can be created the object at runtime with a logic that encompass with your system. And if the specification does not delineate how the implementation shall define security of the objects, who implement will not take care, is not written there.
Infect will be interesting read the history books on 50-80 years, "Look Dad how they were confused".
