[tptacek]

It's funny to me, because the way I came up in Unix, `utmp` was one of the first things you learned about: you were using Unix not because you installed it but because every system you might want to break into (for instance, to get to IRC through an outdial or a gateway) was running it, and they were all multi-user shell machines, and you wanted to make sure you weren't showing up in `who`. I probably knew the `utmp` format before I knew how to use `find`.

You'll find, in archives from hacking sites of the era, a whole variety of "utmp editors".

[JdeBP]

Thanks to setlogin()/getlogin() some operating systems are frustratingly close to the point where all of the relevant information can be read straight out of the kernel's process table, without need for coöperatively maintaining a data file.

On FreeBSD, for example, one can do everything except filter out the terminals where no-one is logged on yet and print a "FROM" column.