Regardless of whether LUS should be used for service browsing or another service should be used - I can see the issue with PREFERRED.LIST. It is really unfortunate that the client must download something just to make a decision whether it must download anything... Thinking out loud - isn't it (yet another) case for annotating classes with objects - as I proposed in another thread discussing possible unmarshalling DoS attacks. That way we could provide the client with some class loading information (namely - preferred list but possibly something else as well) in band while still maintaining out of band code download.
Michal
