0.2 The learning flow

Reading about security produces people who can talk about security. Doing the exercises produces people who can do it. Every chapter is built for this loop.

   +--------------------------------------------------------------------+
   |                                                                    |
   |  1. READ        2. EXPLAIN      3. DO IT        4. BREAK IT        |
   |  (15 min)       (5 min)         (20-40 min)     (10 min)           |
   |                                                                    |
   |  Read the  -->  Close the  -->  Run the    -->  Change something   |
   |  chapter        guide and       commands        so it FAILS, and   |
   |  once.          say it in       yourself.       watch how.         |
   |                 your own                                           |
   |                 words.              |                |             |
   |                      |              |                |             |
   |            can't? re-read           +-------+--------+             |
   |                                             |                      |
   |                                             v                      |
   |  5. CHECK: answer the questions from memory.                       |
   |  6. WRITE: one line in notes.md --                                 |
   |     "X protects against Y, and fails when Z."                      |
   |                                                                    |
   +--------------------------------------------------------------------+
                                  |
                                  v
                every ~6 chapters: ATTACK something you built

Why step 4 matters more here than in any other subject

In most engineering, you learn by making things work. In security you learn by making things fail. A TLS config you've never seen reject a bad certificate is a TLS config you don't understand. Every chapter has a "break it" exercise for exactly this reason.

The rules

Time-box confusion to 20 minutes. Note the question, mark it TODO, move on. Cryptography especially tends to click two chapters later.
Never skip the hands-on sections. Reading about AES-GCM teaches you nothing; encrypting a file and then corrupting one byte teaches you everything.
Type the commands. Do not copy-paste. Typos teach you the syntax.
Keep notes.md with: one-line summaries, every command that surprised you, and every error you hit plus its fix.
One pass, then depth. Get through the whole guide once before going deep.