I remember dealing with a small ISV that was told to make an RPC API, so they used SOAP (via WCF). That would have been fine, except that every function took a single "string" parameter that was
invalid XML that a normal parser couldn't read. You had to use their hand-rolled parser.
And then the whole thing was "encrypted"... with a static RSA key. I don't mean they used a stream cipher based on a hard-coded key, which would bad enough. No, they used the RSA keys directly for bulk data encryption.
I flat rejected their solution, then was overruled as being "too picky", and this monstrosity went into production.
