## Chapter 11 — Sorted names are not appearance order ### Lesson map Lesson 11. Map, example, EX057. ```mermaid flowchart TD S["today minus baseline"] --> T["Two names, no order"] T --> A["sorted: character order"] A --> P["AlertPopup, then TemplateUpdater"] P --> Q{"Did the set literal's writing order win?"} Q -->|No| K["A comes before T"] ``` The print is alphabetical. The set literal is not a timeline. ### Logical drawing ```text set literal writes the new names as TemplateUpdater, then AlertPopup sorted difference prints NEW: AlertPopup NEW: TemplateUpdater reason A before T not stored which name appeared first ``` ### Learning outcomes After this chapter, you should be able to: 1. Read `sorted(today - baseline)`. 2. Explain why AlertPopup prints before TemplateUpdater. 3. Refuse "appeared first" as a meaning of that order. ### 11.1 A set drops writing order. `sorted` imposes character order. `today - baseline` is a set of the names that are in `today` and not in `baseline`. The members are `TemplateUpdater` and `AlertPopup`. A set has no order, so the fact that the set literal wrote `TemplateUpdater` before `AlertPopup` is not a property the set keeps. `sorted` then orders the two strings by their characters. `A` comes before `T`, so `AlertPopup` prints first and `TemplateUpdater` prints second. That order is not "appeared first". The script has no field for which startup name was registered earlier. It also is not the order of the set literal. A classmate who swaps the NEW lines to match the literal has built a different print. A classmate who says AlertPopup "showed up first" has added a story the difference does not contain. MITRE ATT&CK groups programs that start at logon under a persistence class called Boot or Logon Autostart Execution. Naming the class is enough here. The lab does not score either NEW line against that matrix, and this chapter does not give a procedure for creating a startup entry. | Order someone might expect | What actually happens | |---|---| | Literal order, TemplateUpdater first | The set drops it | | Time order | No time is stored | | Character order | `sorted` prints AlertPopup first | | A severity order | No score is stored | ### 11.2 Worked example | Offered reading | What `sorted` did | Decision | |---|---|---| | AlertPopup then TemplateUpdater | `A` before `T` | Keep | | Both names are the whole difference | Two members | Keep | | "TemplateUpdater appeared first, so print it first." | Appearance is not a field | Refuse | | "The set literal's order is the timeline." | Sets do not keep that order | Refuse | > **Synthetic case.** The two NEW lines are the whole difference. ### Errors and limits Do not narrate a race between the two names. ### Apply - **EX057 — Sort order.** The set literal writes `TemplateUpdater` before `AlertPopup`, and the print does the opposite. Does the print mean AlertPopup appeared first? *Rubric:* 3 = no; `sorted` orders by characters; `A` comes before `T`; the set stores no appearance time;; 2 = character order, not a timeline;; 1 = one name;; 0 = none. ### Continue studying — lesson 11 (chapter 11 of 20) [← Chapter 10](#ch-10) · [Course chapter index](../SUBJECTS.md) · [Chapter 12 →](#ch-12) Continue to the next authored lesson. ## Worked answers **EX057.** No. `sorted` orders by characters, and `A` comes before `T`. The set stores no appearance time.