Flex - cross-domain-policy - I just don't get it...

I installed Flex Builder 2 plugin last night, - and overall I'm very impressed.

I'm particularly impressed with the documentation, and in particular the lessons - each lesson is really short, but they cover the basics very quickly - great for someone like me who has no previous experience with Flex, and very little with flash.

I've been working through the lessons, and in the second lesson, it goes through creating a (basic) RSS feed reader.

So I went through the example, using the RSS feed given as an example in the lesson (for Matt Chotin's blog). This worked fine, so I though - that's cool, lets point the feed at my own blog...

This didn't do anything, so, I worked out how to view debug mode (for some reason debug mode is only working with IE on my machine, not Firefox - probably an installation issue), and saw the following error:

• Security error accessing url...

I'm sorry - but I don't get this - on the domain on which the RSS feed is hosted, you have to set-up a file detailing which domains can host flex / flash applications which access the source domain...

The flash application is responsible for checking this file before deciding whether to access the remote data source...

So... this file on the remote server, instructs the client application to check whether it has permission to access the remote server, based on the domain on which the client app thinks its being served on...

So what on earth does this achieve?

I can see 2 cases where you might want to lock things down:

1. The remote server is hosting a service with restricted access, and needs to make sure the client is authorised to serve the data before allowing it to be served
2. The application is running on a local machine, and you want to restrict the sites that the application has access to

The first point is not achieved by the use of the "crossdomain.xml" file - as one of the 1st rules of implementing security within a client-server environment, is that the server is responsible for implementing security, not the client. In addition, I would assume that the flash application knows where it being served from based on the host headers (as it is running in the local machine, not on the domain from which it is served) - which presumably (and I've not checked) could be faked through the use of the hosts file etc.

The second point is not implemented at all - as the crossdomain.xml file is implemented on the remote server - not on the client.

So what on earth does this crossdomain.xml file achieve - other than requiring hosts of a public service to make a concious decision that they will allow flash clients to access the service. Surely the point of open standards such as RSS - is that they are open - and it is the choice of the consumer, how they consume them...

PLEASE - if I have completely missed the point here, let me know - as from what I can see, the crossdomain.xml "security" implementation would appear to be both pointless and obstructive...

I could see the point if the crossdomain.xml file were optional and advisory - a bit like robots.txt - an indication of a preference, if implemented, rather than an absolute requirement if data is to be served to a remote domain.