Sorted names are not appearance order

Lesson map

Lesson 11. Map, example, EX057.

flowchart TD
  S["today minus baseline"] --> T["Two names, no order"]
  T --> A["sorted: character order"]
  A --> P["AlertPopup, then TemplateUpdater"]
  P --> Q{"Did the set literal's writing order win?"}
  Q -->|No| K["A comes before T"]

The print is alphabetical. The set literal is not a timeline.

Logical drawing

set literal writes the new names as
  TemplateUpdater, then AlertPopup
sorted difference prints
  NEW: AlertPopup
  NEW: TemplateUpdater
reason
  A before T
not stored
  which name appeared first

Learning outcomes

After this chapter, you should be able to:

1. Read sorted(today - baseline).
2. Explain why AlertPopup prints before TemplateUpdater.
3. Refuse "appeared first" as a meaning of that order.

11.1 A set drops writing order. sorted imposes character order.

today - baseline is a set of the names that are in today and not in baseline. The members are TemplateUpdater and AlertPopup. A set has no order, so the fact that the set literal wrote TemplateUpdater before AlertPopup is not a property the set keeps. sorted then orders the two strings by their characters. A comes before T, so AlertPopup prints first and TemplateUpdater prints second.

That order is not "appeared first". The script has no field for which startup name was registered earlier. It also is not the order of the set literal. A classmate who swaps the NEW lines to match the literal has built a different print. A classmate who says AlertPopup "showed up first" has added a story the difference does not contain.

MITRE ATT&CK groups programs that start at logon under a persistence class called Boot or Logon Autostart Execution. Naming the class is enough here. The lab does not score either NEW line against that matrix, and this chapter does not give a procedure for creating a startup entry.

Lesson table; scroll horizontally to read all columns →

11.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. The two NEW lines are the whole difference.

Errors and limits

Do not narrate a race between the two names.

Apply

• EX057 — Sort order. The set literal writes TemplateUpdater before AlertPopup, and the print does the opposite. Does the print mean AlertPopup appeared first?
  Show marking criteria

  Rubric: 3 = no; sorted orders by characters; A comes before T; the set stores no appearance time;; 2 = character order, not a timeline;; 1 = one name;; 0 = none.