Yes. This means that a correct implementation can only invoke a remote procedure by identifier. Unfortunately, at least one buggy implementation has allowed callers to invoke arbitrary Perl code on the server. This muddies the waters.