> This mean hub must trust all client's commands, and just forward to
> client(s) depending to the first char?

What's there to trust/not trust?

I have not seen this while reading but you are right. This is great, it will be the first protocol to have a built-in DoS feature. DoS is good for you :)

It doesn't take a degree in computer science to make this a configuration
option in the hub, for instance "allow these commands"...
Besides, flooding with known commands seems more efficient since they have
resource-taking side effects while an unknown one will simply be discarded
by all clients...

/J