Security model and Flash 8.5

As you can read in the posts before I am now developing an IRC client. I am using the Flex 2 Builder Alpha which a lot of people currently talk about. I read on a post by Mike Chambers on Flashkit that Macromedia introduces binary socket support. Great. You could discuss very long about the pros and cons of theese. But I think that is not the main problem here.

Just imagine you want to develop a FTP client which would be possible with the Socket class. You create a nice settings dialog and some nice ftp browser; file-upload etc. All that is possible with AS3. But now there comes the security model into play. An rich internet application like the FTP client could be used by a lot of people and would be very great.

Now everybody has his or her own FTP server and every server has its own ip. You get the idea what I am pointing at? The security model of Flash disallows us to develop such applications because everybody who wants to use that FTP client would need some crossdomain.xml on his server.

What are the sockets good for if you can not use them? It is nice to see Macromedia using Flickr in nearly every presentation but you may take a look here.

There is also another problem. IRC is a protocol which allows to have more than one server in the background. If you dns-lookup irc.quakenet.org you get

Looking up irc.quakenet.org…
Resolved irc.quakenet.org to 62.73.33.48
Resolved irc.quakenet.org to 82.211.16.16
Resolved irc.quakenet.org to 82.211.16.17
Resolved irc.quakenet.org to 85.236.110.226
Resolved irc.quakenet.org to 193.120.201.111
Resolved irc.quakenet.org to 193.213.112.156
Resolved irc.quakenet.org to 194.109.129.222
Resolved irc.quakenet.org to 213.131.131.155
Resolved irc.quakenet.org to 213.131.131.156
Resolved irc.quakenet.org to 217.75.98.139

Now where is Flash looking at? I think there won’t be an Apache running on irc.quakenet.org for example. And what about the routing? This is all too complicated. Why not only some alert which asks the user whether he wants to allow a connection or not?

Update:
Possible workaround: Write a program that runs on a unix server and is just a wrapper for other servers. This means if I connect to je2050.de:6667 and send for example “connect ip” the wrapper would connect to that ip and send all data back to the Flash Socket. Now you only need the evil crossdomain.xml on your own server.