[mlyle]

> But the client shouldn't be trusting the server anyways so going peer-to-peer shouldn't be an issue.

If there's things like durable money between matches, etc: without someone in the loop to validate what happened you can't really solve this problem peer to peer. (If we define security to encompass "secure game state" and not just "safety from remote code execution")

[kevincox]

This is usually done by logging state to the server which does some validation.

Most validation that the server does can be run on clients just as easily. (The main issue is what information is visible to clients. But if you are doing mostly P2P you usually end up making tradeoff that the client gets most information)