~/tutorials/022-two-sources-that-disagree.md

022: Two sources that disagree

One source is a claim. Two sources that agree is corroboration. Two sources that disagree is work, and the work is deciding which one to believe and saying why. This lesson uses a pair you already have: the scan and the zone.

The disagreement

The scan says this host is three ports and one machine. The zone says this domain is two names, four mail exchangers, and a handful of policy records. Neither is lying. They are answering different questions, and the disagreement is in your head until you name the questions.

nmap -sV 127.0.0.1 | grep nginx | wc -l
dig l1ackers.com | grep netsol | wc -l

Two and four. Two doors on this box claim nginx, and four different machines answer for this domain's mail. The scan describes one host. The zone describes a domain's commitments across infrastructure it does not run. When someone asks "how big is l1ackers.com" the honest answer is two numbers and the sentence explaining why they differ.

Which wins, and why

Neither wins outright, because each is authoritative inside its own question and silent outside it. The scan is authoritative for "what answers on this box, this second". The zone is authoritative for "what does the world's routing do with this name". The failure mode is not picking wrong, it is asking one source the other's question: reading the four MX records as four machines you must defend, or reading the three ports as the domain's whole exposure. Both readings are common, and both are category errors.

The rule that travels: name the question each source answers, then check the answers are about the same thing before you reconcile them. Most disagreements between tools dissolve at this step, and the ones that survive are real findings.

When both are stale

The scan is a snapshot stamped 2026-09-21. The zone is a snapshot stamped 2026-09-21. Two sources can agree perfectly and both be describing yesterday, and agreement is not freshness. This is the quiet trap of corroboration: two stale sources corroborate each other into confidence. The timestamp is part of the data, and matching timestamps across sources is what makes a comparison honest.

The same lesson with files

Two files disagree in a smaller way. The same news event lands in two files with different framings:

cat ~/news/2026-09-10-aws-security-agent-bucket-ownership.md | head -6
cat ~/news/2026-09-10-mikrotik-routeros-privilege-escalation.md | head -6

Same date, same frontmatter shape, different class line: cloud-misconfig against exploited-in-the-wild. Which wins depends on the question again. For "what kind of thing happened", the class line is the site's judgement and it is the answer. For "what actually happened", the source line in each file points at the primary document, and that is where the tiebreaker lives. When two of your own sources disagree, the primary document is the court of appeal, and this site wires it into every item.

Try it

Each of these has one answer, and the shell gives it to you. Check yourself.

1. Run both counts. Two doors and four mail exchangers: say in one sentence why those numbers are allowed to differ.
2. Ask the scan the zone's question: how many mail servers does 127.0.0.1 answer for? Read what comes back, because the mismatch is the lesson.
3. Read the class line of both same-day files and the source line under it. Which file's judgement would you defend from the primary document, without opening it? Then open it.
4. Find a number that appears in two lessons of this batch and check whether the timestamps of the two sources agree. Corroboration with mismatched stamps is a weaker claim, and saying so is free.

Both sources are stamped. The commands are the current truth, and they disagree only when you read them carelessly.