Emotronic Happy Hardcore

They Come From Art Schools

Tightly knit groups of new, high talent. Sometimes they are called Girl School (no, not that one). They fuse abundant skills, folding into their stage acts divers abilities from the performing arts and others. Their musical composition, arrangements, pathos and humour emerge with effortless high quality, recombine and transcend pop culture. They mesmerise, and you swoon. You tell everyone you know, everyone you meet about them. You begin stalking them - once an essay in frustration, now an easy vice, enabled by this age of universal omniscience - you collect every copy of every scrap of every note they play, write, think.

But their incorporation is a callous, uncaring, opportunistic arrangement of convenience. One that will tear out your heart, when their project serves its only purpose, when their vehicle advances their individual creative, artistic, and social growth and development. Tear it out and stake it, rip in half and quarter, turn to dry brown dust. You will rage at this world's injustice, to allow so monstrous a disbanding. Damn you Girl School, you completely ruined my whole life when I was seventeen. And now it's happening again.

Futuristic Retro Champions

Sita

We accidentally caught the best Art School Band since Roxy Music (my description) in September 2009, when we dropped in to King Tut's Wah Wah Hut to see Charlotte Hatherley. The second support act Futuristic Retro Champions, we later learned, emerged from Edinburgh College of Art in 2006, playing their debut gig in that city's famous Wee Red Bar. What they do couldn't be spelt out more clearly in their name. Five years and uncountable plaudits later, they are from left to right:

Photo © futuristicretrochampions.com

Cecilia "Ceal" Stamp - bass, vocals.
Harry Weeks - guitar, vocals, synths, production.
Carla Easton - keys, vocals, occasional saxophone.
Sita Pieraccini - vocals and melodica, occasional tambourine.

This lot are what happy hardcore should have been [...] this is one of the most exciting Scottish bands I have heard in ages.

- Gavin Cumine, Broken English

This band never fail to fill our hearts with colourful sparks of joy. It’s sugary, happy hardcore twee-pop, and all defiant with it.

- The Skinny

With a pure pop sound resplendent with hook-laden choruses they are an engaging and energetic ball of fun, and their whirlwind live show has attracted heaps of praise from press and musical peers alike.

- Gary Flockhart, The Scotsman

There are many more raving acclamations where those came from, but what's the point. The appalling truth is this: despite having upcoming gigs in Glasgow and Edinburgh this April, timed to coincide with their debut 2CD release "Love And Lemonade", Futuristic Retro Champions have already split. Postponed from last December when Ceal shattered her elbow, these are their farewell dates; and the new CD, well that's their final Retrospective. It's already too late to tell you how witty and catchy and varied and original are their songs, how soaringly and technically and sometimes achingly beautiful are their speciality harmonies. If you don't catch their penultimate April 8 show at Glasgow's Captain's Rest, or the final April 9 at Edinburgh's Wee Red Bar where it all began, then your whole life too will be completely ruined, for nothing now can ever come to any good.

Look I Made You A Mixtape (Like A Mathematician)

I called it Bootleg, it's on the Verbatim label, it's all one band. Sorry I can't send it on; the British government would have me arrested and my house severed from the Internet, causing me to die for sharing with you, the music that I love. Also, I want my favourite artists always to be fully compensated for their work. But look, you can get all the tracks from the links below. Some of them you'll have to pay a few pennies for, many others are free. Then to pull it all together from this Scotch Broth of MP3s, FLACs and YouTube vids (and it has to be a CD, because: well, retrochamps, right?) you'll need a few audio tools.

1. Speak To Me (3:50)
2. Epic New Song (4:21)
   
3. Pulling Box Shapes (2:47)
4. Isn't It Lovely (4:11)
5. You Make My Heart (3:37)
6. DIY Lovesong (2:46)
7. Let's Make Out (2:32)
8. Told Ya (4:07)
9. Jenna (4:08)
10. Kitten With A Loaded Gun (3:04)
11. Strawberries And Vodka Shots (2:47)
12. Told Ya (TYGH Remix) (3:59)
13. May The Forth (3:36)
14. Settle Down (4:01)
15. Robert De Niro's Waiting (free) (4:10)
    
16. May The Forth (Miaoux Miaoux) - Glasgow PodcArt link (3:57)
    
17. DIY Lovesong (live) (2:51)
    
18. Jenna (Live at the Mill) (4:09)
19. Nintendo (YouTube) (3:16)
20. Strawberries And Vodka Shots (original demo) (2:46)
21. Uh Oh (No Show) - Ceal's lead vocal debut! (2:30)

Tracks 1-4 are from the Lollipoptastic EP.
Tracks 5-8 are from the FRC EP.
Tracks 9-12 are from the LaChunky EP (FREE).
Tracks 13-15 are from the May The Forth / Settle Down single.

That should keep you going, something to play in the car for the next couple of months, until the 25-track official, retrospective release arrives. The Lollipoptastic EP appears to have disappeared almost completely from the web. I hope the track ordering on April's 2CD release will be a wee bit like mine. I hope the full Lollipoptastic EP is included. I hope there's some new (previously unreleased) demo material on it too, like maybe the early 'Hi!' and 'Lullaby'.

I hope...

Hey, I hope Harry gets his solo project running, and the girls start the new band that we've been promised, but soon!

Still... yes, of course, they must escape their homunculi. The real enemy of this piece is neither the hapless art school student, nor society, nor ambition, nor ambivalence. It is time. It is change itself. These young adults, without exception, already have healthy careers right now outwith the FRC; and yet still more promising future prospects. But still. Wouldn't that be something to see, their mooted reunion, 10 years hence?

Update (Feb 26): being of the firm opinion that such a band deserves one, I created a Futuristic Retro Champions Wikipedia page. And after an initial request for speedy deletion, summarily dismissed, I'm pleased to say my fellow Wikipedians appear to agree.

Electricity - Part 1

Primordial Communications

I was eight years old when my gran bought me the Meccano Elektrikit. After building all the motors, buzzers, bells, and other projects in the manual (including the fantastic, fully functional Telegraph Receiver with Bell and Morse Key, and the brilliant Electric Shock Machine!), I began looking for still more practical applications. I was almost eleven by the time I'd decided to drill a hole through my bedroom floor into the downstairs kitchen ceiling, and push through a pair of wires. These then became a simple serial circuit, comprising a battery and small lamp upstairs, and a switch downstairs.

Now at last I could play Mungo Jerry's In The Summertime, or Hotlegs' Neanderthal Man, at a decent volume on the Dansette. And when dinner was ready, mum - rather than having to come upstairs and bang on the bedroom door - could use her kitchen switch to let me know. Provided, of course, I just happened to be looking directly at the lamp at that precise moment (it wasn't much bigger or brighter than a single fairy light).

More often I'd be freaking out, kneeling eyes closed with a 12½" Meccano girder in each hand, thrashing the bed; the frustrated drummer, performing for his myriad adoring fans. Poor mum would patiently tap her switch until eventually the song ended, and I would notice the signal. Clearly this situation necessitated the introduction of a second channel of communication, pointing in the opposite direction, to let her know when I'd got the message.

The Commons

Before pushing through another pair of wires to support this "back channel", I sketched out the full design - wires, switches, batteries and bulbs - on to my first circuit diagram. On inspection it struck me that here were two copies of the original circuit, behaving completely independently of each other; they should still work correctly if electrically joined at any single point. And, should that point happen to be one of the wires travelling through the floorboards, why then I could physically remove one of those four wires, and get by with just three.

Wait just another minute though. Suppose that common point was the '-' terminal of each of my 4½V batteries. Call that point "zero Volts". Then the '+' terminals of the batteries would both be at the same 4½V level above this. In other words, there's no voltage difference between them; were I also to connect the '+' terminals of my batteries together, no current would flow across the join. But adding this wire meant that I'd have just one battery powering the whole system, instead of two. It's fun discovering things like that for yourself!


A string of enhancements soon followed. Two more series bulbs were added, guarding against filament failure and reassuring the sender that a message was in fact being transmitted. When I discovered diodes, the battery was replaced by the 13V AC output of my Hornby model railway transformer, and the number of connecting wires reduced to two. And then to one, when I co-opted the household mains Earth wire for the return path: yes, I guess I was a preteen criminal.

Next time: the unique sound-to-light system of Blak Ice Disco.

Dansette image courtesy of / © The British Library Board.

Simple Regex #2: Validation

What's a Valid XML Element Name?

Sometimes we want to convert customer entered data to XML. Sometimes we want to use it for an element name. Obviously it'll need some sanitising, so what should we escape? The XML RFC is a wee bit twisty on this question, its section on Start Tags defining a Name roughly, i.e. ignoring so-called combining characters and extenders, like this:

NameStartChar ::= Letter | ‘_’ | ‘:’
NameChar ::= NameStartChar | Digit | ‘.’ | ‘-’
Name ::= NameStartChar (NameChar)*

That's similar to the definition of an identifier in many languages, but with the addition of a few specific punctuation marks. The twist comes when you consider namespaces. The XML Names recommendation states that these assign a meaning to names containing colon characters, and that therefore, authors should not use the colon in XML names except for namespace purposes. Even though XML processors must still accept the colon as a valid name character, as per the above syntax, it gives off the odour of a practice to avoid. So we go with this:

NameStartChar ::= Letter | ‘_’
NameChar ::= NameStartChar | Digit | ‘.’ | ‘-’
Name ::= NameStartChar (NameChar)*

No Colons Then?

That's right. Our element names start with a letter or underscore, then continue with any number of these, possibly in combination with digits, periods, and hyphens. To put it another way (inexactly, but in practice acceptably, for my purpose): an element name is any nonempty sequence of word characters (letters, numbers, underscores), periods, and hyphens; and it must start with either a letter or an underscore.

In the interests of localization, rather than the parochial a-zA-Z_0-9, we should use the Regex word character class \w to represent, erm, word characters. That just leaves the period and hyphen to be mopped up in the main sequence. Similarly, when it comes to specifying the initial letter, rather than a-zA-Z, we should use the letter class \p{L} built for just this purpose:

private static string ToElementName(string input)
{
  // Replace all non-hyphen/period/word characters with underscores.
  var result = new StringBuilder(Regex.Replace(input, @"[^-.\w]", "_"));
  // If input doesn't start with a letter or underscore, prepend an underscore.
  if (!Regex.IsMatch(input, @"^[\p{L}_]"))
    result.Insert(0, '_');
  // Done.
  return result.ToString();
}

A point to note about the first pattern [^-.\w] is that neither the hyphen nor the period need be escaped. Within brackets, the period represents itself, rather than being a wildcard; and the hyphen is similarly literal (as opposed to indicating a range) when it appears as the first item in a set.

Other Useful Character Classes

Why yes, there are some others, I'm glad you asked. These two are probably the droids you're looking for: \p{Lu} for uppercase letters, and \p{Ll} for their lowercase comrades. For the full story about Character Classes in C#, go to http://msdn.microsoft.com/en-us/library/20bw873z.aspx.

Tweets - January 2011

"Saturn, the moon and [...] Spica will appear in the shape of a triangle in the southeastern sky" - msnbc. TL,DR: 3 points form triangle.

— John Kerr (@dogbiscuituk) January 25, 2011

My wife prefers M&S to MacSween's haggis. She's wrong. Also, roast butternut squash to bashed neeps. She's right about that one. #burnsnight

— John Kerr (@dogbiscuituk) January 26, 2011

I know many celebrities with single names, but none with single-letter names (except Prince, as symbol). Yet there must be hundreds of them.

— John Kerr (@dogbiscuituk) January 27, 2011

"Is it me, or is it blowing cold air?" -- If it's you, then it certainly won't be blowing _cold_ air.

— John Kerr (@dogbiscuituk) January 28, 2011

Elevation of Privilege Revisited

A Game Of Cards

I've written about Adam Shostack's brilliant computer security card game Elevation of Privilege once or twice before. Now that we are finally in possession of our first in-house manufactured deck, I'm busy pulling together an introductory course that hopefully will include enough background for us soon to organise an actual game. One in which people can genuinely participate and have fun, learning a little more about computer security and privacy in the process.

One useful resource in this endeavour is a complete list of all the threats included on the cards of the EoP deck. If you have such a deck, this information is available printed on a small set of special cards. Another good resource is the Microsoft TechNet Wiki, where Alun Jones aims to have a page for each of the six STRIDE suits:

• Spoofing
• Tampering
• Repudiation
• Information disclosure
• Denial of service
• Elevation of privilege

At the time of writing the first two are available as a work in progress; they do already contain some useful threat examples and mitigation strategies.

However, like all SDL material now, the game is Creative Commons licensed, which means that the full list of card threats can also be reprinted for nonprofit purposes. Here then are the suits, the cards, and their threats. Note: ACLs = Access Control Lists; see Glossary.

Spoofing

Spoofing describes any threat allowing an attacker to:
Pretend to be someone or something else.

2 - An attacker could squat on the random port or socket that the server normally uses
3 - An attacker could try one credential after another and there’s nothing to slow them down (online or offline)
4 - An attacker can anonymously connect, because we expect authentication to be done at a higher level
5 - An attacker can confuse a client because there are too many ways to identify a server
6 - An attacker can spoof a server because identifiers aren’t stored on the client and checked for consistency on re-connection (that is, there’s no key persistence)
7 - An attacker can connect to a server or peer over a link that isn’t authenticated (and encrypted)
8 - An attacker could steal credentials stored on the server and reuse them (for example, a key is stored in a world readable file)
9 - An attacker who gets a password can reuse it (Use stronger authenticators)
10 - An attacker can choose to use weaker or no authentication
J - An attacker could steal credentials stored on the client and reuse them
Q - An attacker could go after the way credentials are updated or recovered (account recovery doesn’t require disclosing the old password)
K - Your system ships with a default admin password, and doesn’t force a change
A - You’ve invented a new Spoofing attack

Tampering

Tampering describes any threat allowing an attacker to:
Alter or destroy data, where this would normally be disallowed by the application.

2 - [no card]
3 - An attacker can take advantage of your custom key exchange or integrity control which you built instead of using standard crypto
4 - Your code makes access control decisions all over the place, rather than with a security kernel
5 - An attacker can replay data without detection because your code doesn’t provide timestamps or sequence numbers
6 - An attacker can write to a data store your code relies on
7 - An attacker can bypass permissions because you don’t make names canonical before checking access permissions
8 - An attacker can manipulate data because there’s no integrity protection for data on the network
9 - An attacker can provide or control state information
10 - An attacker can alter information in a data store because it has weak ACLs or includes a group which is equivalent to everyone ("all Live ID holders")
J - An attacker can write to some resource because permissions are granted to the world or there are no ACLs
Q - An attacker can change parameters over a trust boundary and after validation (for example, important parameters in a hidden field in HTML, or passing a pointer to critical memory)
K - An attacker can load code inside your process via an extension point
A - You’ve invented a new Tampering attack

Repudiation

Repudiation describes any threat allowing an attacker to:
Perform an action, then deny that they ever did it.

2 - An attacker can pass data through the log to attack a log reader, and there’s no documentation of what sorts of validation are done
3 - A low privilege attacker can read interesting security information in the logs
4 - An attacker can alter digital signatures because the digital signature system you’re implementing is weak, or uses MACs where it should use a signature
5 - An attacker can alter log messages on a network because they lack strong integrity controls
6 - An attacker can create a log entry without a timestamp (or no log entry is timestamped)
7 - An attacker can make the logs wrap around and lose data
8 - An attacker can make a log lose or confuse security information
9 - An attacker can use a shared key to authenticate as different principals, confusing the information in the logs
10 - An attacker can get arbitrary data into logs from unauthenticated (or weakly authenticated) outsiders without validation
J - An attacker can edit logs and there’s no way to tell (perhaps because there’s no heartbeat option for the logging system)
Q - An attacker can say “I didn’t do that,” and you’d have no way to prove them wrong
K - The system has no logs
A - You’ve invented a new Repudiation attack

Information Disclosure

Information Disclosure describes any threat allowing an attacker to:
Expose information to someone not authorised to see it.

2 - An attacker can brute-force file encryption because there’s no defense in place (example defense: password stretching)
3 - An attacker can see error messages with security sensitive content
4 - An attacker can read content because messages (say, an email or HTTP cookie) aren’t encrypted even if the channel is encrypted
5 - An attacker may be able to read a document or data because it’s encrypted with a non-standard algorithm
6 - An attacker can read data because it’s hidden or occluded (for undo or change tracking) and the user might forget that it’s there
7 - An attacker can act as a ‘man in the middle’ because you don’t authenticate endpoints of a network connection
8 - An attacker can access information through a search indexer, logger, or other such mechanism
9 - An attacker can read sensitive information in a file with bad ACLs
10 - An attacker can read information in files with no ACLs
J - An attacker can discover the fixed key being used to encrypt
Q - An attacker can read the entire channel because the channel (say, HTTP or SMTP) isn’t encrypted
K - An attacker can read network information because there’s no cryptography used
A - You’ve invented a new Information Disclosure attack

Denial of Service

Denial of Service describes any threat allowing an attacker to:
Degrade or deny service to users.

2 - An attacker can make your authentication system unusable or unavailable
3 - An attacker can make a client unavailable or unusable but the problem goes away when the attacker stops
4 - An attacker can make a server unavailable or unusable but the problem goes away when the attacker stops
5 - An attacker can make a client unavailable or unusable without ever authenticating but the problem goes away when the attacker stops
6 - An attacker can make a server unavailable or unusable without ever authenticating but the problem goes away when the attacker stops
7 - An attacker can make a client unavailable or unusable and the problem persists after the attacker goes away
8 - An attacker can make a server unavailable or unusable and the problem persists after the attacker goes away
9 - An attacker can make a client unavailable or unusable without ever authenticating and the problem persists after the attacker goes away
10 - An attacker can make a server unavailable or unusable without ever authenticating and the problem persists after the attacker goes away
J - An attacker can cause the logging subsystem to stop working
Q - An attacker can amplify a Denial of Service attack through this component with amplification on the order of 10:1
K - An attacker can amplify a Denial of Service attack through this component with amplification on the order of 100:1
A - You’ve invented a new Denial of Service attack

Elevation of Privilege

Elevation of Privilege describes any threat allowing an attacker to:
Gain privileges they would not normally have.

2 - [no card]
3 - [no card]
4 - [no card]
5 - An attacker can force data through different validation paths which give different results
6 - An attacker could take advantage of .NET permissions you ask for, but don’t use
7 - An attacker can provide a pointer across a trust boundary, rather than data which can be validated
8 - An attacker can enter data that is checked while still under their control and used later on the other side of a trust boundary
9 - There’s no reasonable way for a caller to figure out what validation of tainted data you perform before passing it to them
10 - There’s no reasonable way for a caller to figure out what security assumptions you make
J - An attacker can reflect input back to a user, like cross site scripting
Q - You include user-generated content within your page, possibly including the content of random URLs
K - An attacker can inject a command that the system will run at a higher privilege level
A - You’ve invented a new Elevation of Privilege attack

In addition to these special suit summary cards, the full deck also contains Instruction and Strategy cards.

Heroes

When It Happened

Sitting alone in my little office with the door to the adjacent factory area open, as the people there worked cheerfully building their circuit boards, wiring harnesses and custom housings, I was preoccupied with the authoring of some graphics software. Subconsciously listening to the joking going on next door, and to the music of BBC Radio One coming from their tiny communal FM radio. The door to the reception area opened, and my boss appeared there. Glancing at my face, he told me to cheer up. Then he disappeared again, having assured me that "It might never happen."

But then it had just happened. Why did nobody seem aware of it yet? Everything appeared to be continuing as normal. Yet only a moment earlier, loud and clear the radio announcer's voice had punched through the humdrum chatter and pop, telling me that Space Shuttle Challenger had just exploded on launch. That was exactly twenty five years ago today, at this hour, as I'm sitting and writing these words now. My brain took a snapshot of that moment, one that I can still examine today, as if it were a physical photograph.

Looking Back

Like many people at the time, I'd lost much of my initial interest in the American space program. It had seemed routine for a while. As if they had it down to a fine art, a daily set of procedures that always resulted in exactly what it should: yet another successful mission, with no big discoveries or artifacts to share with the world's mass media. Then, the newspapers got wind of NASA's latest publicity scheme: the first civilian in space. Christa McAuliffe, a teacher from Concord High School, New Hampshire, was to fly in the next shuttle and present lessons to her class from space.

Clearly the idea was a successful one, as every news network carried images and interviews with the first space teacher. The concept captured the public imagination. Without the big dramatic climax of say, the moon landings I'd watched since age 10, or the unwelcome suspense of Apollo 13, NASA seemed to have found a cost effective, everyman route, to promote simultaneously itself, and space travel, and science. When I heard the terse announcement that day, all I could think of was that teacher, racing skywards and full of hope, optimism, and the educational purpose that was her life's work.

Thank You

My real life heroes are those champions of the promotion of the public understanding of science: Carl Sagan, Charles Simonyi, Richard Dawkins, and so on. But real life space heroes, pioneers like Christa McAuliffe and her crew mates, combine that dedication with a commitment to exploration. True leaders of mankind, always risking and sometimes losing their lives, they follow remorselessly their vision of a larger and more enlightened universe, and in so doing they create it, for us all to inhabit one day.

Photo: NASA. Christa McAuliffe is in the back row, second from the left. Each January, NASA's Day of Remembrance honours the fallen crews of Apollo 1, Challenger and Columbia, and all of those who have given their lives in the cause of exploration.

Simple Regex #1: Metacharacters

Useful Concepts: Opacity

Oh sure, I know there's no shortage of guides to regular expression on these Internets. However, questions about them continue to land on my desk with a satisfyingly fitting regularity. So I've decided to write about them, starting with this one. Colleague C wants to parse some data from Discogs, the music database / marketplace. Credits on individual tracks follow a comma separated format like this:

Piano, Guitars [Lead, Bass, 12 String Acoustic], Drums, Kitchen Sink

followed by the artist's name. What C wants to do, is to parse each individual instrument or grouping of instruments, ending up with something like this:

Piano
Guitars [Lead, Bass, 12 String Acoustic]
Drums
Kitchen Sink

Obviously the "wrinkle" is that bracketed sections can contain commas, which we don't want to act as field separators. In fact (and this is key to the answer), we don't care at all what's inside the bracketed areas. Everything after a left bracket, up to and including the first right bracket if any, should be preserved just as it is. Such is frequently the situation with string encodings; separators and terminators are implicitly "escaped" when parenthesised. We may also term such bracketed content "opaque", meaning that our parser "cannot see inside it" - to discern, for example, those commas.

My First Metacharacter

That being the case, we might as well treat an entire bracketed expression as a single, inscrutable and indivisible (meta)character. One example of a pattern matching such an expression is:

\[[^\]]*]

which is to say, a literal left bracket "[", followed by any number of non-"]" characters (the sub pattern for such a sequence is shown underlined), followed by a final right bracket "]". For the sake of clarity and language independence I'll be omitting pattern delimiters in most of my examples; you should add your own enclosing @"" or // as appropriate for your environment. Now we can say that each match in our output is a sequence of atoms, where every atom is one or other of these:

• any single character, which is neither a comma, nor a left bracket;
• a bracketed expression, as recently defined above.

Here then is the pattern that matches one of our newly identified atoms:

[^,[]|\[[^\]]*]

Note the use of the OR operator "|" between the two underlined sub patterns for matching (1) a single character, and (2) a bracketed expression. Now, a match can be expressed as a sequence comprising any number of atoms:

([^,[]|\[[^\]]*])*

Here the underline spans a single atom. If we now test this solution, we find that it has two bugs. It intersperses zero-length matches between the desired ones, and it preserves spaces after commas in the input string, manifesting these as leading spaces in the second and subsequent output matches. Both issues can be addressed by insisting that a match additionally starts with at least one non-comma, non-space character (prepended and underlined below):

[^, ]([^,[]|\[[^\]]*])*

And that, assuming only that bracketed expressions aren't nested, is one final answer to the case of the Discogs Parsing Regex.

Previously: Regex Fuzzing; Quantum Regex.