Relevance best practices

whats the difference

  exists 
  (
      values 
      whose
      (
          name of it is "DisplayName"
      )
      of keys of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of registry
  )
  whose
  (
      it as string = "Microsoft Update Health Tools"
  )

/microsoft health update tools

exists keys 
  whose
  (
      value "DisplayName" of it as string is "Microsoft Update Health Tools"
  )
  of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of registry

These relevance appear to solve the same issue, but the top one is a lot more convoluted than the bottom.
Am i doing something wrong or is there a way to know if im down the wrong path?

I think either of these will give the same result. I find the second form far more readable, and it’s likely to be slightly more efficient.

I don’t think there’s a huge efficiency gain, but the first form will examine every value of each key, filtering to the value named “DisplayName”; while the second, will directly query for the “DisplayName” value, without examining the names of every other value in the key.

The second form is also easier to add additional filters - like querying for both a “DisplayName” and a “DisplayValue”, which is common for detecting software installations.

1 Like

I would generally write it like this:

exists keys whose(value "DisplayName" of it as string is "Microsoft Update Health Tools") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries)

And then if I wanted the version, I would do:

unique values of (it as string as version) of values "DisplayVersion" of keys whose(value "DisplayName" of it as string is "Microsoft Update Health Tools") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries)

Relevance should always be plural whenever possible (whenever outside of parentheses)

Relevance should flow from right to left as much as possible… that way you can easily add on more specific relevance on the left side to filter down or inspect deeper.

1 Like

I generally write for left-to-right readability, with an emphasis on being kind to the future, less familiar team member.

2 Likes

I actually do the opposite. I think the best relevance flows from right-to-left, not left-to-right. It is much easer to pull apart or add onto relevance that flows from right-to-left as much as possible. I agree it is confusing for people new to relevance, but I think the relevance ends up being easier to follow and reuse. I also recommend using plural relevance instead of IF-THEN-ELSE as much as possible for similar reasons.

Relevance kind of WANTS to flow from right-to-left in my opinion, and trying to do the opposite gets weird and hard to follow. I want to read relevance as much as possible in a single direction, without having to jump back and forth from one side to the other to figure out what is happening.