One key is not a clean verdict

Lesson map

Lesson 07. Map, example, EX053.

flowchart TD
  K["One digest in known_bad"] --> G{"Is the full digest that key?"}
  G -->|Yes| L["Fake-template adware (synthetic)"]
  G -->|No| D["the string no match"]
  D --> Q{"Does no match mean safe?"}
  Q -->|No| S["It means absent from this dict"]

The default string is an absence. It is not a clearance.

Logical drawing

known_bad
  one key, one label
hit
  Fake-template adware (synthetic)
miss
  no match
list note
  known adware (list v1)
  a date is written in practice
  no calendar date is printed here

Learning outcomes

After this chapter, you should be able to:

1. Count the keys in known_bad.
2. Read no match as the default string.
3. Refuse the word clean, and refuse a calendar date for list v1.

7.1 The default is what .get returns when the key is absent.

known_bad is built with one entry. The key is the SHA-256 hex digest of b"synthetic installer bytes - not a real program". The value is the label Fake-template adware (synthetic). There is no second key, and there is no known-good dict beside it. known_bad.get(h, 'no match') returns the label when h is that key. Otherwise it returns the literal no match.

The spreadsheet row and the photo row both take the default. They share a string because both digests are absent, not because the script compared the two files with each other. ISO/IEC 27042 separates what was observed from what someone concludes. The observation is "absent from this one-key dict". The conclusion "safe" is a different sentence, and the script does not print it. Priya's note uses "known adware (list v1)" for the hit. She also writes the date of the list she used. This book never prints that date, so a later page cannot invent one.

NIST's National Software Reference Library is a collection of known software hashes, often used to set ordinary files aside. This lab did not query it. A miss against one synthetic key is not an NSRL "known" hit, and it is not a clearance.

Lesson table; scroll horizontally to read all columns →

7.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. The known-bad dict has one synthetic key.

Errors and limits

Do not promote a default string into a safety verdict.

Apply

• EX053 — Default string. budget.xlsx and photo.jpg print no match. Does that word mean the file is safe, and is a calendar date for list v1 available to copy?
  Show marking criteria

  Rubric: 3 = no; no match means absent from the one-key dict; the installer label is the only hit; list v1 has no printed date;; 2 = the default is an absence and the date is unprinted;; 1 = one row;; 0 = none.