Let's say I write a script that can do a few fairly simple things.
1.) It can tell if I have admin or not.
2.) It can tell if any Superadmins are on the server.
3.) It can get a list of all clients that are on the server and that are joining.
All of these are relatively simple things to do. Now I mate this up to an automatic banner.
Let's say a ban packet is sixteen bytes plus the length of its ASCII string.
The first byte is the packet type. In this case we'll say it's zero, for "command to server". Others could be "ping", "move", "trigger", so on.
The second and third bytes are a ushort representing the server command. In this case it's 'ban', which is 40.
The next four bytes are a presumably unsigned integer representing the object ID of the victim. We'll say it's 12345.
Then we have another integer, let's say it's signed this time, representing the Blockland ID of the victim. We'll say it's 11239.
The twelfth byte is the length of the victim's name, in this case 5.
Finally, we have another four bytes representing the ban time. Let's say it's -1 - which also means this one, at least, HAS to be a signed integer.
So here's what our final packet to ban that annoying Xalos might look like, in hexadecimal.
00 00 28 00 00 30 39 00 00 2B E7 05 58 61 6C 6F 73 FF FF FF FF
Let's take the worst case on the string and say that each player's name is 32 characters long. (The maximum displayed length for a server nameEDIT1 is 32, including host name, so that's where I'm getting this upper limit.) That means that we have 48 bytes per banned client. Multiplying 48 bytes byte 98 players (assuming a limit of 99 players and not banning ourselves), we get 4704 bytes, or ~4.6 kilobytes.
Assuming this host is working off a 56k modem (with 99 players?! WTF!!!), that means that I can ban every player on the server in roughly two thirds of a second - easily before any other admins can react to ban me. If I wrote the script to target admins first, then even slower network speeds could still be workable.
Now someone joins. My script instantly knows that they joined, and so bans them before they have time to even react. Any non-SAs are banned before they can ban me, meaning I can easily DoS a server by someone clicking the wrong button and giving me admin for what would have otherwise been only half a second.
TL;DR: We need a default timeout for bans.
Note that this post uses several assumptions, such as minimizing packet size for the /ban command but only to that of its (normal) userland arguments. If only the client ID were sent for clients which exist on the server, size could be reduced further. Since its arguments are actually transmitted as text, its actual size is probably much higher.
