While I agree that embedding of a yet another web-server into installation of some enterprise software is really a very, very bad idea, increasing a vector of attack, and in the scenario of tightened enterprise install it should be avoided at all costs. But, OTOH, I understand the position of developers using full kit of IRIS (not community edition) for those this immediate Apache removal might lead to significant user experience regression. And it would be rather more preferable to "deprecate" it somehow smoother (e.g. change default to not install, but still keep it as part of a kit for developers installations).

But all this sounds like you actually need to have 3 kinds of kits available:

- community with PWS enabled by default;

- developer version, with all theoretical insecurities, but with convenient goodies integrated (i.e. Apache available, may be with vscode+extensions, and so on);

- and tightened, production ready kit, with Apache kit removed.

Interesting article, Alexey!

But we are still eagerly waiting for the 2nd part, when we should expect it?

Could not resist and not mention the fact that I've explained using dynamic JSON objects as "named argument" idiom substitution in Remote proxy objects via dynamic dispatch 3 years ago. Looks like we finally getting the idea :)