00 · How to use this course
Depth: developed lesson · Prerequisites: none · Time: one 90-minute session.
Deadwire teaches you to explain a system, make a prediction, test a boundary, and defend your conclusion with evidence. The coverage map distinguishes developed material from topics still being written. An outline is a map of intended scope, not a completed course chapter.
Outcomes
- Prepare a first session without confusing course infrastructure with student requirements.
- Write a testable claim and name the evidence that would contradict it.
- Record recall, execution, and explanation separately.
- Choose the next task from demonstrated gaps rather than pages opened.
Start with the right equipment
Reading requires only a browser. The bundled web, detection, and industrial-trace exercises require a repository checkout and Python 3.12 or newer. The HTTP exercise also uses curl. You do not need the book-ingestion pipeline, Docker, a language model, or the private library for those exercises.
Windows-specific commands require a Windows lab. A synthetic worksheet can teach interpretation without that machine, but it does not demonstrate native command execution. Record which exercise you completed. The lab manual describes environment boundaries and reset expectations.
From the repository root, record the versions you actually have:
python3 --version
curl --version
git rev-parse HEAD
Do not paste the expected version into your evidence. If a requirement is missing, record the setup gap before attempting an exercise that depends on it.
Use one question per experiment
A useful question has an actor, an action, an object, and a condition:
In the fixed synthetic web lab, can simulated Alice read Bob's record while her identity stays unchanged?
This question predicts a response that can be inspected. “Is the application secure?” is too broad for one request. “Does changing an identifier always work?” also goes beyond the two-record fixture.
Write four lines before testing:
Question:
Prediction:
Observation that would support the prediction:
Observation that would contradict it:
For the example, predict a denial without Bob's record. A response containing Bob's record under unchanged Alice identity would contradict that prediction. An unavailable server would answer a different question: the experiment did not reach its intended decision point.
Your first 90 minutes
| Minutes | Task | Deliverable |
|---|---|---|
| 0–20 | Explain authentication, authorization, and evidence from memory | A baseline answer with uncertain points marked |
| 20–35 | Read foundations | Correct the baseline using a different color or dated note |
| 35–75 | Complete one bounded experiment from that chapter | Prediction, command, result, interpretation and reset record |
| 75–90 | Explain the result without the chapter open | A short teach-back and one next question |
These are planned time allocations, not claims about your progress. If setup consumes the lab block, save the setup evidence and carry the experiment forward. Do not report execution just to keep the schedule tidy.
Lab: calibrate an evidence claim
Consider this fictional note:
The request returned 200, so the account is an administrator and the server is compromised.
Rewrite it using only an observation that the note actually contains. Then list what is missing: the requested resource, expected policy, body content, identity context, and the operation being claimed. A response code alone cannot supply those facts.
Now use this richer fictional record:
Mode: vulnerable
Simulated actor: alice
Requested object: 202
Returned owner field: bob
Declared policy: each actor reads only their own record
Write the narrow finding this supports. Compare it with “Alice can modify every record.” The second statement needs an operation and a scope not present in the record.
Finally, create a counterexample to your finding. If the declared policy intentionally allowed Alice to read Bob's record, the same returned data would have a different authorization interpretation. Evidence must be compared with the intended rule.
Record three different abilities
| Dimension | Question to answer | Suitable evidence |
|---|---|---|
| Recall | Can I reconstruct the mechanism without notes? | A dated, closed-book answer and corrections |
| Execution | Can I carry out the bounded procedure and reset it? | Environment, commands, observations and cleanup |
| Explanation | Can I explain why the result happened and its limits? | A teach-back that handles a counterexample |
Use the assessment rubric for reviewed work. A score is not a certificate: retain the underlying observation and reviewer feedback. The planner requires evidence across all three dimensions before prerequisite promotion; reading alone cannot unlock the path.
The current command-line learning state is not a complete recoverable event history. Keep your Markdown session records even if you also record scores. No automated run can manufacture seven days of human practice or demonstrate a 30-day learning improvement.
What to do when you get stuck
Classify the obstacle before changing several things at once. A missing command is an environment problem. A refused connection is a reachability observation. A denied request may show an effective boundary. A surprising body may reveal a policy issue or a mistaken assumption.
Write the smallest next experiment that distinguishes two explanations. For example, compare the health endpoint with the protected endpoint while keeping host, port and mode unchanged. Changing identity, object, method, and server mode together makes the result harder to interpret.
Evidence
Save your version record, baseline answer, corrected claim, counterexample, and next-session question using the evidence template. Your first-session acceptance check is that another person can distinguish your prediction from your observation without asking which is which.
Safety and scope
Start with the supplied synthetic fixtures. Keep notes private when they include host or account identifiers. Do not substitute a workplace or public target for a missing lab, and stop if you cannot identify the process you are interacting with.
Teach-back
- Why does a failed experiment sometimes teach more than a copied successful command?
- Which evidence distinguishes a missing prerequisite from a working security control?
- Why are a score, an observation, and a reviewer decision different records?
- What will you test next, and what result would change your mind?
Continue: 01 · Foundations, then 07 · Linux and networking. Lesson numbers identify topics; the weekly plan supplies the intended order.