put it this way, the only things that should be defined on the client (for absolute security, of course not always needed) the only thing that should be made on the client is calls to the server, and possible actions like setting rotation, that dont matter to anyone elses gameplay. for example, lets say you have it so that 60/second your character moves on your machine, one in 6 times your position is updated to everyone else, if it is done on the client, the client could hack your program so that you move 600 times a second so now your character can move 10x as fast as everyone and when it updates to the server, the server doesnt know the difference. of course you could make checks on the server on distances moved, but thats like putting bandage on a gash, better to just be more careful instead.