Mispeled, educate on what an aimbot/wallhack/etc looks like, %100 agreement.
My ongoing suggestion, one which I am too thick headed and ignorant of C to implement, has been a username/password scheme.
*Player goes to website (any website, one set up and/or supported by a server operator or numerous server operators)
*Player sets up a username/password to access a server (website can be created by the operator/operators and all it does is store that info in a mysql DB.)
*Player connects to server X using said username/password.
*Server recieves username/password(hash really, which it could unencrypt with it's private key or using another method to prevent sending usernames/passwords unencrypted over the wire) against DB to see if this user is allowed access.
This is not easy, as it would require a modified client and server (which is my complete guess, but seems a reasonable guess.)
Its not centralized. Noone is responsible for keeping the DB up to keep tremulous going. Operators could choose to share a db, creating a type of centralization that is solely based on choice, but is neither required nor need be the only DB.Potential benefits
Multiple servers could choose to share a db, a player kicked from one server "could" be kicked from all servers sharing that particular db, be it 2 servers or 20.
Setting up of usernames/passwords could be moderated. It doesn't have to be instantaneous, and blocking access from proxies, while not %100 effective, can stop most casual greifers/botters from bothering to set up multiple usernames.
Servers could use there own DB, or could choose to share a DB. Banned greifers could end up being banned simultaneously from multiple servers, making a ban more severe.
Bans could be tracked based on their source server, and other servers could pick and choose which servers bans they would automatically support.
Admins could be tracked in the DB. A server could pick and choose which server's admins they'd trust (though I see this as possible, I suspect most operators would choose to pick their own admins, and wouldn't trust other operators admin picks as much as they'd trust other admins bans.)
Servers could choose to allow X number of unauthenticated "unnamed players" to let untrusted people in to play freely.Complications
I imagine it would require a considerable amount of modifications to the tremulous source to work.
DB design could become complicated to account for tracking various servers, bans, admins, whitelists.
DB access would need to be tightly controlled.
DB going down could mean no access to any server, unless the server side code defaulted to letting someone in if DB access could not be obtained. An admin whitelist could exist on the DB for individual servers, but actual admin rights held on the server so admins could still "admin" if the server went down, and calls to the DB are not required for each admin command.
The operator of a shared DB would have to be a highly trusted member of the community, as they would have an incredible amount of power over who is/isn't banned, etc depending on the number of servers sharing their particular DB.
Again, I have no ability
to make this a reality. Learning C, learning the tremulous code, learning the design necessary to connect securely to a remote DB, etc. I suppose theoretically I could, realistically it would take me an enormous amount of time and it would probably end up filled with security flaws and bugs.
I've thought more about this, about the DB design to keep servers independent but leave them the ability to integrate to whatever level they choose while still sharing a db, but this is so long it's even boring me, so I'll stop
edit: Nah, forget it. Lets follow david's suggestion and repackage loads of adware as "trembot-2007" and the like!