Comment by dmurray

I see the contradiction there!

The bit about the "aims of the module" comes from its aims to get people thinking in a certain way about security, something I definitely already had. But that doesn't mean it had nothing to teach me - it was quite a while ago that I took it, but one exercise about the nuances of the setuid bit and how misconfigurations could be exploited stands out as something I doubt I'd have come across otherwise. There was also plenty of content on cryptography and basic binary reverse engineering/attacks that I'd not seen before.

My level of ability and knowledge isn't consistent - some places I'd dug into more, and some less. With tech, there's always a more detail to be explored and more learning to be done, even in areas I'm familiar with.

(I wrote the article)

To me, the first paragraph you quoted seems to be describing the modules themselves in the abstract, whereas the latter is about the university testing environment. There are plenty of things that I could do given ample time and the ability to look things up but would struggle to answer detailed questions about in a timed context without any notes or access to the internet. l think it's a fairly well-established concept that actively restating something you already know helps with recall later, like how the act of writing notes is considered to be useful even independent of studying them later. In the outside world, if you already know these concepts, you'll be able to refresh yourself about them easily enough whenever you end up needing to use them, but when you're getting tested in school, you need to do the refresher beforehand, and going through the exercises as they're intended is a pretty reasonable way to do that.

When you do problems from books, you do them to get faster and to discover edge cases and that is where you learn stuff. Being able to mount a disk image is a good thing to know how to do in security research, but it is not enough.

I do not know how these exercise were made but it sounds like in the beginning they had a central server for tests probably not security things and then someone just moved that software to VMs to let the students be more flexible.