> "A trivial silly mistake like this is... not what I expected considering OpenBSD's reputation for security." Forgetting that "_shutdown" is 9 characters is d

> "A trivial silly mistake like this is... not what I expected considering OpenBSD's reputation for security." Forgetting that "_shutdown" is 9 characters is definitely an oversight on their behalf. But you need superuser privileges to create groups, and at that point you can also just toss any user right into the regular _shutdow(n) group. There's not really anything to exploit here, but if this type of comparison is present in other software - whether OpenBSD's system tools or not - I can definitely see how it has a general potential to cause a sysop to accidentally "cross-pollinate" his or her users, e.g. "ftpuser<some digits>".