A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Bash variables are untyped strings until a command or arithmetic context interprets them differently. `count=3` stores characters, while `$((count + 1))` asks Bash to perform arithmetic. Assignments are sensitive to spaces: `name = value` attempts to run a command named `name`. That tiny syntax detail has broken more shell scripts than exotic Bash features ever will.
| Question to ask | Why it matters |
|---|---|
| Use scalar variables without confusing strings with numeric intent | Keeps the lesson tied to an observable security outcome. |
| Failure signal | Use exit status and raw evidence to separate “no finding” from “check failed”. |
Use `printf` instead of `echo` when you care about predictable formatting. Double quotes expand variables while preserving embedded spaces; single quotes prevent expansion. Arrays are addressed separately later, but even simple scripts benefit from treating every external input as text until you deliberately validate and convert it.
Assigns a string containing spaces; the right side stays one shell word. The useful habit here is to treat the command output as evidence about one system fact, not as a magical diagnosis.
The common mistake is assuming `read -r` or command output will be “one value.” Newlines, glob characters, and leading dashes are still data. The safest default is to quote variable expansions and make the command that consumes them explicit about whether it expects one argument or many.
Arithmetic expansion produces a numeric result while the stored variable remains shell data. Read the result in context: the same command can be correct yet insufficient if a permission boundary, alternate configuration, or different backend changes what it reports.
Uses parameter expansion to select a fallback when `HOME` is unset or empty. In a production workflow, save the raw result when the observation contributes to a finding. That keeps later analysis honest and makes troubleshooting reproducible.
A practitioner’s checkpoint: compare the observed behavior with the assumption your script is about to make. If the assumption is broader than the evidence, narrow the rule. If the evidence is incomplete, report the uncertainty instead of converting it into a confident finding.
Lab discipline: stay inside the declared course environment, prefer read-only checks for learning exercises, and preserve the original output of security tools before transforming it.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.