Streamed Music Services

Best In Show

The Register Hardware today published a snapshot comparison table showing how a dozen streaming music services compare to each other. Now, a table is a very fine thing indeed, and a reliable statistician's friend. But you and I prefer pictures, right? So I decided to analyse the data provided, using my own personal and completely arbitrary criteria for preferences and priorities. The aim was to reduce each service evaluation to a single number, and so rank them to help decide which I should select - when the day arrives, and I step over my own cold corpse, to sign and pay up for online music. Spoiler: Deezer wins.

Explanatory note: I do pay for music: offline music. Physical media, which I then own, and don't lease from anyone.

How They're Ranked

Okay, so you're a typical streaming music box. How do you earn my favour?

Well, you start from your base score, which is just the number of tracks offered by your service, in millions. So for example at today's levels, Xbox Music leads the field at this stage with 30, while Spotify and Last.fm currently trail on 18 and 12 respectively. Then, you try to earn bonuses.

The first available bonus, 10%, is for services supported on both web and desktop app platforms. If you have only an app, or only web support, you get zut.

Secondly, we look at mobile support. Almost everyone supports Android and iOS. But Rara is Android only, while the iOS offering by Grooveshark requires a jailbreak, and those by Samsung and Xbox are not quite ready yet, so they lose 10%. Conversely, services offering additional mobile coverage, such as BlackBerry, Palm, Symbian, WebOS and/or Windows Phone, get a token 5% bonus for trying a little harder. Similarly for those with additional, non-mobile platforms such as smart TVs, cable, or non-native game consoles.

You don't have an offline mode? Sorry, that's a 10% tax. My advice to you would be shut up and accept this, the appeal court will only double it to punish your insolence. Why shouldn't I be able to hear the music I've paid for, it will say, on my frequent hiking trips to Dunnet Head?

Finally, there's your price. I regard a standard (non-premium) monthly subscription of £5 as quite reasonable for an unlimited, on-demand, streamed music service. If you disagree (Samsung, Xbox) then help yourself to a 50% kick in the nuts. If on the other hand you think £5 is too much (Deezer, Grooveshark, Last.fm) here's a free cuddly toy and a 25% boost for your awesomeness.

For future reference: I'm likely to introduce a massive penalty for Facebook buy-in. Please, just stop it, all of you.

The Results

La France-based Deezer is my surprise winner, scoring over 26; Spotify the more predictable second, at just shy of 19. Then there's little to choose between Grooveshark, Napster, Pure Music, Rdio and Sony. And, it has to be said, what a thoroughly unimpressive lot they all are!

Ribbon Principles

Just Say No

This is a follow-up to my previous article on the Microsoft Office 2007 ribbon style of user interface (UI). It's prompted by a too-long history of design meetings where apparently everything must be reset to a previous decade, and where new people drop in to ask the same fundamental questions yet again, proposing top-of-the-head suggestions that have already been comprehensively discounted by thorough and painstaking research. A blank slate isn't always the best point of departure.

I've listed a very few, key takeaways from Jensen Harris's presentation on the history and evolution of the ribbon UI. The technology is well matured by now, and these caveats, or something like them (preferably a smallish superset), need to become integral to the our new jumping-off point.

No to the Ribbon (sometimes)

The ribbon was never just a fad to be copied, for the sake of looking like Office 2007. For many applications, those containing a few dozen operations, the menu and toolbar approach is still superior - and using a ribbon just looks silly. It's only when you migrate closer to the region of 50, 100 or more unique user-executable commands, that you should be thinking of switching to this more fluent alternative. Remember, Microsoft were driven to develop this UI by the sheer, exponentially, ever-increasing bloat in the numbers of nested menus, toolbars and task panes, in Office 2003 and its immediate predecessors.

No to Command-Oriented Design

Microsoft's Office 2007 group emphasised instead Results-Oriented Design:

• Think about features instead of commands
• Present functionality at a higher level
• Illustrate features by their results
• Use galleries to let the user close to the result they want to achieve as quickly as possible
• Visual! Tactile! Responsive!

No to Ribbonisation

You don't just "ribbonise" a form, any more than you "webify" an arbitrary desktop application. The most visible part of this UI design, the ribbon itself, must be supported by a host of other equally essential concepts and devices:

• Galleries e.g. for Visual Styles and Pictures
• Live Preview
• Contextual Tabs
• Quick Access Toolbar
• Mini Toolbar
• Enhanced Tooltips
• Enhanced Status Bar
• Live Zoom
• Customisable Status Bar
• KeyTips and Keyboard Navigation
• Streamlined Options
• Context Menus

No to the Task Pane

What's missing is as important as what's provided. With the ribbon scheme, Microsoft got rid of more than just the endlessly proliferating dockable multilevel menus and toolbars on every side of the display; also gone is the stack of task panes. Why? Added complexity, for one thing. Task panes don't actually replace anything, they just occupy more space, less productively, giving the user yet another place to search for functionality. Remember, one of the biggest ideas behind the ribbon is having a single point of access for that functionality.

Also: in Office 2003, everybody wanted to add a whole new task pane to the stack, for just their one feature.

No to Customisation

It can seem arrogant to lock down the UI, preventing users from arranging their toolbars, buttons and menus in their "favourite" configuration, or the one deemed most productivity-enhancing (who decides?) for their specific roles or requirements. In truth, more users hate their toolbar and menu docking freedoms. For example, two features of Office 2000 designed to simplify the UI by modifying it, namely adaptive menus and rafted toolbars, actually added so much complexity and disorientation to the user experience that most customers, especially those in corporate environments, turned both off.

As Jensen Harris puts it, 99% of all users' requirements were met by their eventual "static" ribbon design. But 1% of 200 million customers is still two million people; so, the status bar, and a single customisable toolbar, were left in for just those 1%. The point to note is that Microsoft in 2007 were in the happy position of having amassed so much customer feedback (over 3 billion data sessions collected from Office users; 2 million sessions and 40 million command bar clicks per day; 6000 individual data points; etc.), they didn't have to hypothesise about such things - they just looked at the data. You probably don't have that luxury. So, it's even more important that you allow your pet UI features to be questioned. Ruthlessly tortured, in fact. Probably killed.

No to Exceptions

Design tenets have to be religion. Microsoft's design tenet set in the summer of 2003 looked a bit like this:

• A person's focus should be on content, not on the UI. Help people work without interference.
• Reduce the number of choices presented at any given time.
• Increase efficiency.
• Embrace consistency, but not homogeneity.
• Give features a permanent home. Prefer consistent-location UI over "smart" UI.
• Straightforward is better than clever.

Religion: as in, consistently adhered to and applied.

The "Ribbon" User Interface

Update: someone suggested this article has appeared five years too late. Clearly not a Raymond Chen reader.

Caution!

We have added the Microsoft Office 2007 "Ribbon" style of User Interface (UI) to a number of our products in recent years. The results have ranged from the frankly perfunctory, in the case of our internal or consultants' tools, to the very professional, as with all of our high profile market offerings. In this process, we discovered a great number of troublesome issues, difficult decisions, points of contention, and design dilemmas. All of which, I hasten to add, are a good thing.

This is not a conversion that can be approached lightly, since - particularly by comparison with traditional menus and toolbars - the Ribbon UI:

• takes away so much of the user's freedom;
• eliminates "multiple ways" to execute actions;
• removes the comfortable familiarity a user has built up with your app over the years;
• occupies a bigger chunk of valuable screen real estate than the scheme it replaces.

For some people, myself included, just this short list of disadvantages has been enough reason to avoid ribbons, or at least try to, for years on end. If you are still in that category, then may I suggest that watching the following video. It might just win you over to what Microsoft tried to do in 2007. Yes it's as long as a football match, but it's absolutely fascinating, full of insights, sly ironies and unexpected twists. It's worth the price of admission just to play the archaeologist, to marvel at the long trail of rejected early prototypes. If you have any involvement at all in crafting the customer-facing surface of your app, then you owe it to yourself to let Jensen Harris walk you through the surprise-filled design process behind what was possibly the last ever WinForms, non-touch UI revolution of its size:

SCARB Does Security!

A Good End to the Day

Today I led SCARB, our internal Security Coding and Architecture Review Board, in a software security related meeting. As always seems to be the case, I found the agenda changing repeatedly up to and including half an hour before the start. Now that I think of it, in fact that agenda actually kept changing after the start of the meeting, too...

But that wasn't a bad thing! Thanks in part to the vagaries of the way these meetings are set up and run, we ended up with a larger than usual committee, and with representatives from across several different projects: Windows Forms, Web, and both; CQRS and relational; old and new. My presentation, detailing a good half dozen specific security related issues - and their mitigation - in one project, drew comments about the desirability of software and system security reviews in practice, and specifically mentioning the obvious advantages of starting such processes at the same time as the projects themselves.

People seem to particularly like concrete examples. Now, to obtain examples from your own code base, you have to have done a partial security review already. Which was in fact the case for us, at least with two of the projects concerned. Both had previously been taken into the stages of developing a data flow diagram of the system, and of identifying processes, data stores, data flows and the trust boundaries where the vulnerability categories must be investigated.

Now I know what I need to get buy-in, and push the review process further. More examples! SQL injection attacks that work and are demonstrable. XSS attacks, likewise. These can be taken from many resources available around the Internet, but I guess the closer to your own app in terms of applicability, the better. They'll also provide an excellent way of opening the mind to the plethora of attack vectors available to the attacker, encouraging the inclusive, brainstorming, "yes - and..." approach vital to the success of the review process.

And next time, we will have a game of cards.

Prokofiev, Stravinsky, Shostakovich

Prokofiev (Soviet stamp, 1991 centenary)

Building a Collection

If the key to building up a coherent collection of classical music is to have some kind of structure, some skeleton of dry bones on which to hang the meat, then Project Listen To A Crapload Of Symphonies, which started out as my Symphonic listening project before swelling to incorporate concerti, symphonic (tone) poems and ballets, surely qualifies. From an origin point provided by The 100 Greatest Classical Symphonies at Digital Dream Door (which I'll call D3), this bonework has mushroomed, like a badly mixed metaphor, to include at last count over 350 works of enormous merit. Having now completed its genesis of hyper inflation, the list has moved into an era of sustained, steady, but perceptibly accelerating growth.

Of course it still has boundaries. I'm pretty sure I've included nearly all the great symphonists who will ever make it into the list. Though many gifted, modern composers still till the croft, these practitioners are no longer symphonic specialists¹. Similar remarks apply to the concerto. Tone (or symphonic) poems, despite thriving more in modern music, are still limited by the general unpopularity of the genre², ballets even more so. And I don't intend to add any opera to it; my primary interest is instrumental music, not songs.

Stravinsky (Ukrainian stamp, 2007)

The Three Russians Expansion Policy

No, the main area of feature creep is completism - the gradual incorporation of a composer's entire repertoire. Mozart write over 50 symphonies, Haydn more than 100; quite often, it is instructive to consider relationships, similarities and differences between the individual opera (in the sense: plural of opus) of a given maestro. Particularly when the composer and his long form works are already among your favourites at the very outset. So it is for me, with the great Russian triumvirate of Sergei Sergeyevich Prokofiev, Igor Fyodorovich Stravinsky, and Dmitri Dmitriyevich Shostakovich.

Three out of seven Prokofiev symphonies (ignoring revisions) were included in the original D3 list. Two out of four Stravinskys. And six out of fifteen Shostakoviches in the top 120, although an additional two are found bubbling under as the BRMB used to say. That's just not enough! Yet where are we to insert the others, and who or what has to be thrown out to make room for them? Worse still, what about the other composers already on the list, whose excluded works we are still to hear? And worst of all, what of composers not yet listed? Can we be sure that our favourites merit precedence above all of these?

Shostakovich (Russian stamp, 2000)

The Need to Compromise

Obviously not without having already heard every work, both on and off the list, and compared each to every other. But the whole purpose of the list was just to start that very process!

Xорошо, let all additions occur at the bottom of the list until we get a feel for it. And anyway, I still don't feel confident rating even the best known symphonies against each other. I still think Beethoven's sixth (Pastorale) is the best thing since baked wheat, yet it's only at number seven. Ho-hum.

Devil take HTML table editing; I'll maintain the symphony list in a Google Docs spreadsheet here. Later I'll add the concerti, etc. Update: done.

Prokofiev

Wikipedia describes Prokofiev as an iconoclastic composer-pianist, a notoriously, ferociously dissonant virtuoso, who after the revolution left Russia for USA and then Europe. There in 1936, increasing economic deprivation prompted a return to Russia, where in response to the 1941 Nazi invasion, he wrote the opera War and Peace. In 1948 his "anti-democratic formalism" saw his income severely curtailed, and he was forced to compose Stalinist works.

Stravinsky

With perhaps the least politically troubled life³ of our three Russian heroes, Stravinsky too lived in Europe (France) and USA (West Hollywood) at different times. He had inexhaustible desire to explore and learn about art, literature and life, and enjoyed many high profile collaborations, particularly while living in Paris. It was in the 1950s that he began to experiment with Schoenberg's tone rows in his compositions.

Shostakovich

Both Prokofiev and Stravinsky, as well as Gustav Mahler, were initially strong influences on Shostakovich, who subsequently developed his own "hybrid" style, easily fusing post-romantic elements with the neo-classical. In later life, chronic ill health, including polio and several heart attacks, permeated his works with a sense of mortality. After suffering a series of falls, he wrote jokingly:

Target achieved so far: 75% (right leg broken, left leg broken, right hand defective. All I need to do now is wreck the left hand and then 100% of my extremities will be out of order.

Well, perhaps he did, but then found himself unable to write about it.

¹ Shostakovich, 1906-1975, has been called The last great symphonist.
² Classical music, by de facto definition, is not popular music.
³ Although he was famously threatened with a $100 fine for adding an unconventional major seventh chord to The Star Spangled Banner!

Windows 8 Bootkit

UEFI Technology: Say Hello to the Windows 8 Bootkit!

Writing a bootkit couldn't be an easier task for virus writers with the UEFI framework available, much easier than before when they needed to code in pure assembly.

ITSEC director Marco Giuliani sounds less than impressed by the security of the Windows 8 kernel, specifically its porting of the legacy BIOS firmware and Master Boot Record (MBR) into the new Unified Extensible Firmware Interface (UEFI), first fully supported by Microsoft in 64-bit Windows 7. Here he is referring to the fact that UEFI provides a C development environment option, whereas assembly language skills were mandatory for VXers in BIOS days.

http://www.itsec.it/2012/09/18/uefi-technology-say-hello-to-the-windows-8-bootkit/

This isn't the first Windows 8 bootkit to emerge. Last year, Vienna-based Peter Kleissner's Stoned and Stoned Lite proved the concept of loading boot malware from a USB or CD drive on older machines, However these kits didn't circumvent the UEFI. Now this has been shown to be trivial, the only remaining line of defence is to enable SecureBoot by default - an option which many critics complain could limit or even prevent the installation of such alternatives as Linux and FreeBSD.

Simple Regex #6½: More Lazy Quantifiers

Hush. Hush.

The security-related components of my work continue to comprise only product-specific threats and mitigation, which means I can't exactly blog about them in a public forum like this one. Instead, here's a little more on the subject of that previous application of Regular Expressions to music catalogues.

Oh and about that previous article, I have to be honest and say that I've been getting complaints! Apparently the level of explanation offered wasn't even up to my usual low standards of lucidity? Let's try to rectify that here. The goal you'll remember was to parse a list of classical music pieces like this,

49. Violin Concerto in E major, RV271 "L'amoroso" - Antonio Vivaldi

subject to the proviso that while an item's rank (here equal to 49), title (Violin Concerto) and composer name (Antonio Vivaldi) are all mandatory, the key (E major), opus/catalogue number (RV271) and nickname (L'amoroso) are all optional. Here's an analysis of the Regex pattern I'm using to split these records into fields:

private const string rank = @"(\d+)\.";
private const string title = @" (.+?)";
private const string key = @"(?: in ([A-G](?: flat| sharp)?(?: major| minor)?))?";
private const string number = @"(?:, (.+?))?";
private const string nickname = @"(?: ""(.+)"")?";
private const string composer = @" - (.+)";
private const string pattern = rank + title + key + number + nickname + composer;

The @ symbol is an artifact of the C# language. Most of its appearances above are redundant, but regardless, I do tend to use it habitually when working with Regex. It saves having to double all backslashes. So the first line

private const string rank = @"(\d+)\.";

matches one or more decimal digits (followed by a literal period, which is outside the capturing parentheses, and so doesn't itself get included in the captured group). The second line

private const string title = @" (.+?)";

matches a space (again excluded, being outside the group) followed by one or more characters of the title, but matching as few characters as possible consistent with an overall successful match.

It helps to apply these two visual filters when inspecting the various groups in patterns like the third line above:

(?: starts a non-capturing group;
)? ends an optional group.

So for example, the overall key group pattern above is both non-capturing, since it starts with (?:, and optional, since it ends with )?. Nested within it is the main capturing group (labelled c1 in the expanded analysis below) for the key text, and nested in turn within that are two further, non-capturing, optional groups, n1 and n2:

private const string n1 = @"(?: flat| sharp)?";
private const string n2 = @"(?: major| minor)?";
private const string c1 = @"([A-G]" + n1 + n2 + ")";
private const string key = @"(?: in " + c1 + ")?";

More Music Maestro!

Hopefully that's as much analysis as we need for this pattern. It's a little more complex than previously, because of the addition of this opus/catalogue number field, appearing when I generalised the listening project, originally featuring just symphonies, to include also the concerti, symphonic poems and ballets in the following lists:

• Symphonies (129)
• Concerti (60 piano, 50 violin, 40 other)
• Tone Poems (50)
• Ballets (16)

That should be enough to keep HMV in business for a few more weeks! I wanted the project to include all our classical favourites, so piano concerti became a necessity (Grieg for me, Tchaikovsky #1 for the wife), as did tone poems (The Planets, for both of us) and ballets (Bolero). Anyway, the addition of opus/catalogue number field seemed like a good idea. And obviously being optional, it had to be added with yet a third lazy quantifier. Equally lazy is my detection of the number field's existence, which is triggered by the presence of a comma in the title (but after the key, if any). It would be possible to do more, since this field does have certain structure, although not as much as the key field. Noticing that only one record contained commas in the actual title,

106. Symphony No. 14 for soprano, bass, strings, and percussion – Dmitri Shostakovich

I just deleted them. Well sometimes, and particularly with Regex, the best solution is to get a life.