The update column stores a bit, not a day count

Lesson map

Lesson 07. Map, example, EX053.

flowchart TD
  N["Predicate name: updates within 14 days"] --> B["Cell value is 0 or 1"]
  B --> Z["Zeros: FB03 and FB07"]
  Z --> M["No overdue day-count is stored"]
  F["Friday prose: twelve within 14 days"] --> R["Prose is not a new matrix"]
  M --> R

The threshold is in the label. The cell does not store a number of days.

Logical drawing

label    updates<=14d
values   1 or 0 only
zeros    FB03, FB07
causes   one full disk, one paused update
binding  the file does not say which laptop had which cause

Learning outcomes

After this chapter, you should be able to:

1. Explain why updates<=14d cannot be turned back into a number of days.
2. Keep the two named causes unassigned to particular keys.
3. Refuse an exploit-prediction score, a vulnerability identifier, or a product version that the file does not contain.

7.1 A threshold in a label is not a measurement of age.

The first check is named updates<=14d. The relation "less than or equal to fourteen days" is the predicate Leah chose. The dictionary does not store the age. It stores whether the predicate held, as 1 or 0. Two cells are 0: FB03 and FB07. The print's 10/12 is the other ten ones. From those bits alone, a reader cannot say that one laptop was fifteen days behind and the other was a year behind. Both statements would be inventions. The file is silent on the magnitude.

Chapter 1 names two causes for the two failures, and it names them without a key. One laptop had a full disk, so the update could not be downloaded and installed. The other had updates paused. The prose does not say which of FB03 and FB07 had which cause. Assigning the full disk to FB07 because that row is otherwise the worst would be a guess. The minimum-sum result in chapter 5 is not a cause code. Leah's repair is also prose: free space, including a move of old files to the cloud service, remove the pause, install automatically, and restart outside opening hours. No clock time is printed. The browser and the PDF reader are named as further software that must update itself. No product name and no version string are printed.

NIST SP 800-40 Rev. 4 treats patching as preventive maintenance. A laptop that still opens yesterday's document has not thereby passed updates<=14d. Maintenance is a recorded predicate, not a feeling that the machine works. Jacobs and colleagues define EPSS as a probability that a vulnerability will see exploitation activity. Li and Paxson studied security patches at large scale. Nappa and colleagues studied delay where code is shared across products. This spreadsheet has no vulnerability identifier, so it has no EPSS input and it cannot borrow a rate from those papers. SP 800-53's SI-2 is the catalog name for flaw remediation. Fenwick did not produce an assessment against that control. Friday's sentence, that all twelve are within fourteen days, remains a later note about the predicate. It still does not fill in a day count, and it still does not rewrite the two zeros in the embedded lists.

7.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. Automatic install and the outside-hours restart stay prose. No version is added.

Errors and limits

A paused update can leave a working laptop. Working is not the predicate. The predicate is the bit.

Apply

• EX053 — Bit or age? Someone writes that FB07 was forty days behind, that the full disk belonged to FB03, and that an exploit-prediction score shows the fleet is fine. Which of those can the column support?
  Show marking criteria

  Rubric: 3 = none of them; the zeros stay FB03 and FB07; no day count, no cause-to-key assignment, no vulnerability identifier and no score are in the file; Friday's note stays prose;; 2 = the bit stays a bit;; 1 = one refusal;; 0 = none.