Editing TheFramework (section)

==Security==
* Client needs some way to know responses coming from other services are from the same central authority.
* Client's should reject requests that don't originate from the central authority (but can come from different IP addresses).
* Client's can't view things they don't have permission to see.
* Client's can't modify things they don't have permission to modify.
* Could use/require digital signatures.
** Players in a p2p game could be proven to have cheated if other players/the_server disagrees with their messages.
** Potential timing attack, player could withhold messages from opponent, then send after the fact... Make server check time/ordering?
** Would their be any possibility of the client suppressing sending messages it doesn't like? Probably not since this would just be like not moving and if it only send it to another player then they could forward it onto the server.
** Could digital signatures be used for security?
* Some kind of access control lists? For data? For RPC functions? Some kind of dynamic ACLs?
** I'm <CLIENT_ID: NORMAL_USER>, I need to BE_ALLOWED to see my list of my projects.
** I'm <CLIENT_ID: HAXOR>, I need to BE_DENIED a list of <CLIENT_ID: NORMAL_USER> projects.
** I'm <CLIENT_ID: SERVER_ADMIN>, I need to BE_ALLOWED to see a list of <CLIENT_ID: NORMAL_USER>'s projects. Or all projects. I have physical access so I can basically do what I want (unless encryption is used)...
** I'm <CLIENT_ID: GROUP_ADMIN>, I need to BE_ALLOWED to see a list of <GROUP_ID>'s projects.
** I'm <CLIENT_ID: GROUP_ADMIN>, I need to BE_DENIED list of <CLIENT_ID: NORMAL_USER>'s projects, even though they are in my group.
** I'm <CLIENT_ID: GROUP_ADMIN>, I need to BE_ALLOWED to see a list of the group projects <CLIENT_ID: NORMAL_USER> is in.