write-ups.html

<!DOCTYPE html>
<html lang="en" data-theme="dark">

<head>
	<meta charset="UTF-8" />
	<title>Write-ups &amp; Blog — Rob Williams</title>
	<meta name="viewport" content="width=device-width, initial-scale=1.0" />
	<meta name="description"
		content="Rob Williams — lab walkthroughs and an honest blog on studying for CPSA, transitioning from military engineering into cyber security, and building in public." />

	<link rel="stylesheet" href="style.css" />
	<!-- Preconnect: opens the CDN connection while the HTML is still parsing -->
	<link rel="preconnect" href="https://cdnjs.cloudflare.com" crossorigin />
	<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css"
		integrity="sha384-PPIZEGYM1v8zp5Py7UjFb79S58UeqCL9pYVnVPURKEqvioPROaVAJKKLzvH2rDnI"
		crossorigin="anonymous" referrerpolicy="no-referrer" />
</head>

<body>
	<a class="skip-link" href="#main">Skip to main content</a>
	<header class="site-header">
		<a href="index.html" class="logo">
			RW <span class="logo-dot"></span>
		</a>

		<div class="header-controls">
			<div class="theme-switcher">
				<span class="theme-label">Theme</span>
				<button id="theme-toggle" class="theme-toggle" type="button" aria-label="Toggle colour theme">
					<span class="theme-icon" aria-hidden="true">🌙</span>
				</button>
			</div>

			<button class="menu-toggle" type="button" aria-label="Toggle navigation" aria-expanded="false"
				aria-controls="site-nav">
				<span class="menu-toggle-bar"></span>
				<span class="menu-toggle-bar"></span>
				<span class="menu-toggle-bar"></span>
			</button>

			<nav class="main-nav" id="site-nav">
				<a href="index.html#about">About</a>
				<a href="index.html#overview">Overview</a>
				<a href="index.html#contact">Contact</a>
			</nav>
		</div>
	</header>

	<main id="main">
		<section class="page-header">
			<p class="eyebrow"><a href="index.html#overview">← Back to Overview</a></p>
			<h1>Write-ups &amp; Blog</h1>
		</section>

		<section class="section">
			<h2>Write-ups</h2>
			<p>
				TryHackMe and HackTheBox walkthroughs, written in the format expected
				of a professional penetration test report: objective, methodology,
				commands, findings, remediation. The first walkthroughs land after
				the CPSA exam window — HackTheBox Blue is first in the queue.
			</p>
		</section>

		<section id="blog" class="section">
			<h2>Blog</h2>
			<p>
				Learning out loud — honest notes from the study desk and the career
				transition. What worked, what didn't, and what I'd tell someone a
				few months behind me on the same road.
			</p>

			<article class="blog-post">
				<p class="post-meta">6 July 2026 · CPSA study</p>
				<h3>Recognition is not recall</h3>
				<p>
					I got 87% on a practice exam a while back and felt pretty good about
					it. Second time through the same question bank, mind — same questions,
					shuffled order. I did it in 29 minutes. The first run took me 44. That
					should have told me something.
				</p>
				<p>
					A week or so later I sat a harder bank cold. Questions I'd never seen.
					62%. That's the real number.
				</p>
				<p>
					What happened on the first one is I wasn't remembering the material, I
					was remembering the questions. You see the shape of one and you know
					which answer felt right last time. It feels exactly like knowing the
					subject. It isn't. In the real exam the wording will be new and
					there's nothing to recognise, so the only thing that counts is what I
					can pull out of my head cold.
				</p>
				<p>
					A few things I've changed since.
				</p>
				<p>
					I don't trust any score off a repeated bank now. It's a warm-up,
					nothing more. If I'm quoting a mock score as evidence I'm ready, it
					has to come from questions I'd never seen before that sitting.
				</p>
				<p>
					I book the re-test on the day of the mock. Learned that one the hard
					way. I had a topic at 70% after a good session and assumed it was
					sorted. Six weeks later it was at 20%. Nothing warned me, because I
					never scheduled anything to warn me. The gap between a cold first pass
					and a re-sit a few weeks later is the only retention signal you get,
					and you don't get it unless you actually book the re-sit.
				</p>
				<p>
					And when I was marking the cold paper I noticed I'd put <code>dpkg
					-l</code> down for a Solaris question and a Red Hat question. Two
					wrong answers, one mistake: under pressure I default to the tool I
					know best. One line sorted both. dpkg is Debian, rpm is Red Hat,
					pkginfo is Solaris, pkg_info is BSD. Worth checking your own wrong
					answers for that. If a few of them have the same cause, fix the cause.
				</p>
				<p>
					None of this is new. But nobody selling practice exams is going to
					tell you your 87% might be mostly memory of the questions. Sit a paper
					you've never seen and trust that number instead.
				</p>
			</article>

			<article class="blog-post">
				<p class="post-meta">6 July 2026 · CPSA study</p>
				<h3>Theory needs something you can break</h3>
				<p>
					I spent two evenings, about four hours all in, on firewall theory and
					a virtual machine installer that wouldn't play. At the end of it I
					hadn't written a single firewall rule.
				</p>
				<p>
					By then I could describe a default-deny policy in exam-ready language.
					I just hadn't built one. The plan said pfSense lab, the installer kept
					failing, and I kept pushing at it because that was the plan. The
					mistake wasn't the installer. It was me not changing course sooner.
				</p>
				<p>
					The reset took twenty minutes. I binned the VM (virtual machine) lab
					and used iptables instead, which was already sitting on my Kali box.
					Default-deny on the INPUT chain, then allow rules for loopback,
					established connections and pings. Generated some traffic and watched
					the packet counter on rule 2 tick up. 1 packet to 5, 76 bytes to 412.
					Four packets, hardly anything. But they were my packets hitting my
					rule, and the concept landed in a way four hours of reading never
					managed.
				</p>
				<p>
					I'm doing this as a career changer, so I don't get hands-on exposure
					at work. It has to come from study time, which means study time can't
					be all reading. What I've changed:
				</p>
				<p>
					Every session now has to produce something I can see. A rule written,
					a counter going up, scan output on the screen. If nothing visible
					happened, the session isn't done, whatever I've read.
				</p>
				<p>
					The cheapest tool that shows the concept wins. Twenty minutes of
					iptables beat a ninety-minute pfSense build that never got past the
					installer. The proper lab can come later. The concept can't wait for
					it.
				</p>
				<p>
					And I've set myself a tripwire. Thirty minutes with nothing to show,
					stop and ask whether a simpler tool shows the same idea. So far the
					answer has always been yes.
				</p>
				<p>
					In my old trade we'd never sign off a repair on theory alone. You run
					the system and watch it work. Study is no different. If nothing moved,
					nothing counted up and nothing broke, I'm not convinced the knowledge
					went in either.
				</p>
			</article>

			<article class="blog-post">
				<p class="post-meta">6 July 2026 · Building in public</p>
				<h3>What a no-build website forces you to learn</h3>
				<p>
					My site has one hard rule: clone it, open <code>index.html</code>, and
					it runs. No build step, no framework, no bundler. Plain HTML, CSS and
					JavaScript, plus two CDN (Content Delivery Network) dependencies, and
					that's it.
				</p>
				<p>
					I set the rule because I'm a beginner at front-end and I wanted to
					learn the platform itself, not a framework's version of it. This week
					I ran a full audit of the site, and the results showed me what that
					rule has actually been teaching me.
				</p>
				<p>
					The contrast finding stung a bit. My light-theme green measured
					roughly 3.8:1 against the page background, and the WCAG (Web Content
					Accessibility Guidelines) standard wants 4.5:1 for body text. It
					looked fine to me. That's the point though. My eye signed it off and
					my eye was wrong. The fix was one shade darker, checked with the
					actual luminance maths rather than by squinting at the screen. A
					framework theme would have handled all that for me, and I'd never have
					learned it was a thing you check.
				</p>
				<p>
					The one that bothered me more: my chart library was loading from its
					CDN unpinned. Whatever version they shipped next is what my site would
					have got, and a breaking release would have quietly killed the skills
					chart on my qualifications page. It's pinned now, with an integrity
					hash, so the browser refuses the file if it ever changes underneath
					me. For someone heading into security work that's a bit embarrassing
					to have missed. Supply-chain hygiene starts on your own site.
				</p>
				<p>
					Smaller one, but it taught me something too. The site was all-
					monospace, everywhere, because that was the terminal look I wanted.
					Turns out monospace is measurably harder to read at length, so I've
					moved to a split: monospace for headings, navigation and labels, where
					the character of the site lives, and a normal system font for
					paragraphs, where the reading happens. On a framework that's a theme
					toggle. In plain CSS I had to understand the decision: two font
					stacks, custom properties, and a call on which elements carry identity
					and which carry reading.
				</p>
				<p>
					The habit underneath all of this isn't technical. In my old trade,
					nothing got signed off just because it looked right. Someone
					independent inspects it, every time, and the audit caught exactly the
					faults my own eye had passed. Websites deserve the same suspicion.
				</p>
				<p>
					The repo is public on my <a href="https://github.com/Rob-JW/portfolio"
					target="_blank" rel="noreferrer">GitHub</a> if you want to see the
					working. Mistakes, fixes and commit history included.
				</p>
			</article>
		</section>

		<section id="contact" class="section">
			<h2>Contact</h2>
			<ul class="contact-list contact-icons">
				<li>
					<a href="https://linkedin.com/in/rob-jw" target="_blank" rel="noreferrer" class="contact-icon-link"
						aria-label="LinkedIn profile">
						<i class="fa-brands fa-linkedin-in" aria-hidden="true"></i>
					</a>
				</li>
				<li>
					<a href="https://github.com/Rob-JW" target="_blank" rel="noreferrer" class="contact-icon-link"
						aria-label="GitHub profile">
						<i class="fa-brands fa-github" aria-hidden="true"></i>
					</a>
				</li>
				<li>
					<a href="https://robwilliams.link/" target="_blank" rel="noreferrer" class="contact-icon-link"
						aria-label="Personal site">
						<i class="fa-solid fa-globe" aria-hidden="true"></i>
					</a>
				</li>
				<li>
					<a href="mailto:williams5886@gmail.com" class="contact-icon-link" aria-label="Send email">
						<i class="fa-solid fa-envelope" aria-hidden="true"></i>
					</a>
				</li>
			</ul>
		</section>
	</main>

	<footer class="site-footer">
		<span>© <span id="year"></span> Rob Williams</span>
		<span class="footer-dot">Built with pixels &amp; packets.</span>
	</footer>

	<script src="script.js"></script>
</body>

</html>