I think it's great that we finally have support for Flash/Silverlight on the ACS. However, I think the support is poorly implemented.

The current policy is expressed as

<cross-domain-policy>
<allow-access-from domain="*" secure="true" />
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="true" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

I'd prefer to be able to add the domains that can access the service from Flash/SL via the administrative UI since my use cases for ACS are for single applications, not for the world at large.