Huh, I guess I take being on top of HTTP(s) for granted. Looks like DCOM was on top of TCP, but I'm guessing it had to implement everything else in its own bespoke format...

Yeah, REST, gives you none of that. Thats all done by HTTPS. Using that logic XML (ergo SOAP) has all that for free as well.

Of course HTTPS only applies to transport, not storage...