Here's the finger client. The ampersand expansion is done client-side instead of server-side for some reason: <https://github.com/freebsd/freebsd/blob/1d6e4247415d264485ee94b59fdbc12e0c566fd0/usr.bin/finger/util.c#L67> RFC 1288: The Finger User Information Protocol (December 1991) does not talk about ampersands. But that's probably where the GECOS subfields come from (so the current field is unlikely to have anything to do with the old GECOS operating system anymore - it should be called the finger field instead). Since the other subfields besides the full name have traditionally been used for: - user's office number - user's work phone number - user's home phone number it doesn't seem to matter whether we expand ampersands in those fields or not. I don't suppose phone numbers and office numbers contain ampersands. If we leave ampersands unexpanded in those fields, that's simpler, and the imaginary users who will have to worry about that stuff can write their own ampersand expander.
