Exactly, or grep would have worked. Dude just was used to doing this and picked the exact wrong moment to have it on his screen. He earned a finding with that one.

That’s the people who use vi to view a file. Watched a guy almost get fired when he shared his screen during an audit and had ‘sudo vi /etc/shadow’ right there in the command window. Auditor saw it and called him on it. He swore that he was only viewing the file to look for a user’s id, but the auditor didn’t care, because he could have modified it either on purpose or by accident.