"crossdmain.xml" is Macromedia's version of robots.txt.

It basically allows a site to control access by Flash movies to content of their site.  Unlike robots.txt, the assumption is that access is *not* granted if the file is not present.

It's a little XML file that inidicates permissions - the site administrator can control which domains can access the content.  It *must* exist at the top level of the site.

When a Flash movie wants to access content, it compares the domain of the current movie (which is "chumby.com" for the chumby widgets) to the site from which content is being fetched.  If the domains don't match, then the player fetches "crossdomain.xml" to get permission.  If permission is granted, then the player fetches the content.

You can read more about this on Adobe/Macromedia's site at: http://www.adobe.com/cfusion/knowledgeb … d=tn_14213

While it is possible to use a proxy, that proxy must have a crossdomain.xml file.

I'd be interested in helping develop a standardized XML-Request format for the Chumby - something that Chumby developers can use to retrieve information from sites without the crossdomain.xml file. This would also enable easy aggregation of data to the device (for example, you could develop an application that shows latest blog posts from LiveJournal and MySpace, even though these sites do not share a common user list).

This would make information retrieval from the Chumby a LOT easier.

like a modified linksys router running your favorite version of the firmware and a script that returns an "open for chumby" for every request for crossdomain.xml ?

I think that server's very primitive - it's the one built into BusyBox.  I don't know if it's configured for any type of CGI.

Oh, I misread your other post the first time thinking you wanted to develop a flash library.  I'm thinking an open-source server-side proxy might be a good idea, it seems very simple.

We actually use our own HTTP library, but we also have a version that uses CURL in order to provide FTP, HTTPS, etc.

However, this security layer we're talking about has nothing to do with the protocol handlers themselves - they happen at a lower level.

Yes, we *could* do that, but as you point out, that means that we'd be processing all of the third-party content for all of the chumbys out there.  That's not really practical - we can't proxy the entire Internet.

There are other issues, of course - if what we're doing is pulling in Flash movies across the proxy, then relative URLs won't work properly - for instance, a Flash movie pulling in other associated movies or content that is expected to be at the same location.

And the biggest issue - you're effectively getting rid of the whole *point* of the crossdomain system, which is to provide security to the user.

Unfortunately, it's not obvious how the proxy could reliably make that distinction.

A couple of things -

1) You should publish the movie as Flash 6, not FlashLite 1.1 - FlashLite 1.1 is roughly equivalent to Flash 4, so much of the Actionscript simply won't work with that version of Flash selected.

2) Your cam code is referencing the variable "banner", which is apparently the url you want to hit.  However, this variable is defined on the main timeline of the widget, not the cam submovie.  You should probably do:

url = _parent.banner;

...to retrieve the value.

3) For the code to work, the server that the URL points to has to have the crossdomain.xml file, and the cam must supply images in non-progressive JPEG files.

4) Since configuring a widget is optional, it should use some default URL if the user doesn't configure it, so you code probably ought to be more like:

url = _parent.banner;
if (url==undefined) {
    url = "http://www.example.com/some/web/camera/";
}

I had an epiphany the other night, and I have no idea why I didn't think of this originally. If I add chumby.com to my personal sever's cross domain file, and then have that server side script I was talking about hosted on that same personal server, my flash movie should be able to connect and get any XML that I request that way, right? It sounds too good to be true, but this would take the load off of your servers, only put load on my server for widgets that I create, and I can still get any XML feed that I want.

Feel free to squash my dreams, but that sounds like it will theoretically work.

The difference is that the Actionscript referring to the "banner" property in the SimpleBanner movie is on the main timeline, while the Actionscript that does the webcam functionallity is on a clip one level down. The Control Panel puts the variable on the top level - any submovies must use specify a path that resolves to the main timeline to access that variable.

If you want it to work with chumby widgets, then add "*.chumby.com".  If you want the data available to Flash movies from other domains, add those domains.  If you want to make the data available to Flash movies from *all* domains, add "*".