I checked out Slint and immediately closed out when I saw a pricing page. Some software is worth paying for, but a GUI library for me isn't one of them. A community can usually keep a GUI library going because it doesn't change a lot after it matures.

god no. some of the comments are so misinformed that i wonder whether they are actual software people at all.

No language can catch a logic bug.

Someone should train an llm on these guys

What is the vulnerability, what is the attack vector, and how does it work? The technical context from the linked source Edera

This vulnerability is a desynchronization flaw that allows an attacker to "smuggle" additional archive entries into TAR extractions. It occurs when processing nested TAR files that exhibit a specific mismatch between their PAX extended headers and ustar headers.

The flaw stems from the parser's inconsistent logic when determining file data boundaries:

1. A file entry has both PAX and ustar headers.
2. The PAX header correctly specifies the actual file size (size=X, e.g., 1MB).
3. The ustar header incorrectly specifies zero size (size=0).
4. The vulnerable tokio-tar parser incorrectly advances the stream position based on the ustar size (0 bytes) instead of the PAX size (X bytes).

By advancing 0 bytes, the parser fails to skip over the actual file data (which is a nested TAR archive) and immediately encounters the next valid TAR header located at the start of the nested archive. It then incorrectly interprets the inner archive's headers as legitimate entries belonging to the outer archive.

This leads to:

• File overwriting attacks within extraction directories.
• Supply chain attacks via build system and package manager exploitation.
• Bill-of-materials (BOM) bypass for security scanning.

Phoronix comment sections never fail to be cesspools

Something to keep in mind is that Slint is not an Open-Source project. If you'll want to improve Slint you'll have to give away your contribution under the MIT No Attribution License (MIT-0) license, yet if and when you'll want to use Slint, you can get it as a paid or GPLv3 license.

In my mind this is more of a proprietary project closed development model (EDIT for correctness, see comment below). The development model is not around freedom and equal rights, with the project being able to stop giving you access under any open-source license whatsoever, all while continuing to use your contributions.

It's not unfair. In fact, it might be a great project. Just not open-source as a project overall, if you care about this.

Just an addition, as I did not found it on the page through Firefox search: A collection of notable Rust blog posts

I've used something similar in the Scala world. It can be useful, but ultimately I got tired of this and started to prefer simple small projects that I build and execute. Still, I think it's a good feature to have for rare cases. Especially if that feature doesn't have noticable costs in maintenance for the cargo-* team(s).

You have to provide source to a rust repository. Otherwise, it’s impossible to compile and link Rust safely. There was an article in the topic.

Long story short you can prepare and link a binary library, but you can’t guarantee any type safety or additional optimisations.

I disagree. That's how Python works but it sucks because it means instead of a C++ (for example) project with some Python utility scripts scattered inside it, you have to turn it into a proper Python project, when it isn't a Python project; you just have some Python scripts in it.

Basically it throws away the ad-hoc scripting use case entirely.

I really wanted this feature, but when I actually used it, I realized that it's not quite as useful as I would have hoped, at least for the use case of just a "small" rust script.

A workflow I often have is to start hacking away at a problem with bash or some other scripting language, but then my command starts getting too long and unwieldy so I copy my command into a file to keep going. But with rust, you don't really do that, so I never progress to copying my command into a file.

If I eventually decide I want to split my one file script into two files will I be able to?

I honestly would say that's when it goes from a script to a proper project, and you should treat it like that with a Cargo.toml and everything. I think this is a case where it would push you towards better practices and I don't think it should support multiple files like that.

This is awesome. It gets closer to Deno which I think is one of the only things that have actually solved the "ad hoc scripting" challenge, which requires:

1. Easy to install language.
2. Easy to use third party dependencies (from a single file script).
3. Easy to import from other files without setting up a whole project.
4. IDE support.

At one end we have Deno which nails all of those. At the other, Python which fails all of them pretty miserably (despite this being one the most popular use cases for Python).

Seems like with this Rust will have 1 and 2 solved, and I guess 4 isn't too hard. What about 3 though?

If I eventually decide I want to split my one file script into two files will I be able to?

Edit: I had a play and actually it's good news!

• If you want to split up a script you can just do mod foo and it will look for foo.rs (or I guess foo/mod.rs) in the same directory!
• For common code, which you might want to import from e.g. ../../common you can't just use mod but you can add common = { path = "../../common" } to [dependencies]. That directory has to be a proper crate with Cargo.toml but I think that's ok and probably desirable.

The only downsides I found are:

1. No IDE support yet.
2. It prints compilation messages to stdout, which kind of sucks.
3. Even after it has been built, it still does incremental compilation every time you run it, leading to more compilation message noise, and ~100ms startup time.

Thanks, yea from what I gather the term is "idiomatic Rust" but its the same thing really.

As far as the client goes,I've made some slow but decent progress. I've got it connecting using STARTTLS and authenticating, and have been able to send a message to a user. I've got the user interface going as well using Egui and Bevy, its not "connected" to the back end yet, but its been super easy to get going.

Really sad that the license is not enforcing strictly free operating system and usages. But great project otherwise!

From my experience, Rust programmers use the terminology of "design patterns" much less frequently, comparing to how it's used in the Java world. I have only a year or two of Java experience, having quickly moved to Scala for more many years after that, but I think I vaguely remember the vibe around it in Java and it just doesn't exist.

In terms of "building blocks" in the Rust world, I'd say there are the "synchronization primitives" like RwLock's, Arc's and such, there is the big and sometimes difficult async, there is message passing concurrency via e.g. std::sync::mpsc. I haven't heard much about actor systems, they're much less used than e.g. Akka of the Scala(/Java?) world I think. To experiment and design a solution, you probably want to read about these "building blocks" and what they're meant for. For this particular case I don't have a quick advice unfortunately. Maybe look from existing XMPP libs and go from what they have.

On a personal/user level, I'd love to see an XMPP client in Rust!

You know repository info is just metadata, right? You can set it to anything.

And you could have grabbed the actually published versions easily, before randomly fear mongering against a random forked crate.

#/bin/bash

crate_name = $1

while read url; do
  curl -L $url | bsdtar xfv -
done <<(curl -L https://crates.io/api/v1/crates/$%7Bcrate_name%7D/versions | jq -r '"https://crates.io/" +.versions[].dl_path')

Run this for both crates, and you will have these crates locally at:

fnmatch-regex2-0.3.0
fnmatch-regex2-0.4.0
fnmatch-regex-0.1.0
fnmatch-regex-0.2.0
fnmatch-regex-0.2.1

from there

diff -ru fnmatch-regex-0.2.1 fnmatch-regex2-0.4.0

or du -ruN if you want the full content of Cargo.lock in the diff 😉

diff -ru fnmatch-regex-0.2.1/.cargo_vcs_info.json fnmatch-regex2-0.4.0/.cargo_vcs_info.json
***
fnmatch-regex-0.2.1/.cargo_vcs_info.json	1970-01-01 02:00:01.000000000 +0200
+++ fnmatch-regex2-0.4.0/.cargo_vcs_info.json	1970-01-01 02:00:01.000000000 +0200
@@ -1,6 +1,6 @@
 {
   "git": {
-    "sha1": "73bd95ec60b4f9ee3ab2ad8d3475e005df7ddc4a"
+    "sha1": "2f810aaeef8eefcee722a29822e46c4091940c8b"
   },
   "path_in_vcs": ""
 }
\ No newline at end of file
diff -ru fnmatch-regex-0.2.1/.editorconfig fnmatch-regex2-0.4.0/.editorconfig
***
fnmatch-regex-0.2.1/.editorconfig	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/.editorconfig	2006-07-24 04:21:28.000000000 +0300
@@ -1,6 +1,6 @@
 # https://editorconfig.org/
 #
-# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>
+# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>, Martin Bammer <mrbm74@gmail.com>
 # SPDX-License-Identifier: BSD-2-Clause
 
 root = true
diff -ru fnmatch-regex-0.2.1/.gitignore fnmatch-regex2-0.4.0/.gitignore
***
fnmatch-regex-0.2.1/.gitignore	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/.gitignore	2006-07-24 04:21:28.000000000 +0300
@@ -5,3 +5,4 @@
 
 site/
 target/
+Cargo.lock
diff -ru fnmatch-regex-0.2.1/.readthedocs.yaml fnmatch-regex2-0.4.0/.readthedocs.yaml
***
fnmatch-regex-0.2.1/.readthedocs.yaml	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/.readthedocs.yaml	2006-07-24 04:21:28.000000000 +0300
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>
+# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>, Martin Bammer <mrbm74@gmail.com>
 # SPDX-License-Identifier: BSD-2-Clause
 
 version: 2
Only in fnmatch-regex-0.2.1: .reuse
Only in fnmatch-regex2-0.4.0: Cargo.lock
diff -ru fnmatch-regex-0.2.1/Cargo.toml fnmatch-regex2-0.4.0/Cargo.toml
***
fnmatch-regex-0.2.1/Cargo.toml	1970-01-01 02:00:01.000000000 +0200
+++ fnmatch-regex2-0.4.0/Cargo.toml	1970-01-01 02:00:01.000000000 +0200
@@ -10,12 +10,16 @@
 # See Cargo.toml.orig for the original contents.
 
 [package]
-edition = "2021"
-rust-version = "1.58"
-name = "fnmatch-regex"
-version = "0.2.1"
-authors = ["Peter Pentchev <roam@ringlet.net>"]
+edition = "2024"
+rust-version = "1.85"
+name = "fnmatch-regex2"
+version = "0.4.0"
+authors = [
+    "Peter Pentchev <roam@ringlet.net>",
+    "Martin Bammer <mrbm74@gmail.com>",
+]
 build = false
+autolib = false
 autobins = false
 autoexamples = false
 autotests = false
@@ -34,23 +38,23 @@
     "parser-implementations",
 ]
 license = "BSD-2-Clause"
-repository = "https://gitlab.com/ppentchev/fnmatch-regex-rs"
+repository = "https://gitlab.com/brmmm3/fnmatch-regex2-rs"
 
 [lib]
-name = "fnmatch_regex"
+name = "fnmatch_regex2"
 path = "src/lib.rs"
 
 [dependencies.anyhow]
-version = "1.0.69"
+version = "1.0"
 
 [dependencies.itertools]
-version = ">= 0.10.3, < 0.14"
+version = "0.14"
 
 [dependencies.regex]
-version = "1.7.1"
+version = "1.11"
 
 [dependencies.thiserror]
-version = "1.0.38"
+version = "2.0"
 
 [dev-dependencies.rstest]
-version = ">= 0.17, < 0.24"
+version = "0.25"
diff -ru fnmatch-regex-0.2.1/Cargo.toml.orig fnmatch-regex2-0.4.0/Cargo.toml.orig
***
fnmatch-regex-0.2.1/Cargo.toml.orig	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/Cargo.toml.orig	2006-07-24 04:21:28.000000000 +0300
@@ -1,24 +1,21 @@
-# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>
-# SPDX-License-Identifier: BSD-2-Clause
-
 [package]
-name = "fnmatch-regex"
-version = "0.2.1"
-rust-version = "1.58"
-authors = ["Peter Pentchev <roam@ringlet.net>"]
-edition = "2021"
+name = "fnmatch-regex2"
+version = "0.4.0"
+authors = ["Peter Pentchev <roam@ringlet.net>", "Martin Bammer <mrbm74@gmail.com>"]
+edition = "2024"
 description = "Convert a glob-style pattern to a regular expression."
 readme = "README.md"
-repository = "https://gitlab.com/ppentchev/fnmatch-regex-rs"
+repository = "https://gitlab.com/brmmm3/fnmatch-regex2-rs"
 license = "BSD-2-Clause"
 categories = ["encoding", "filesystem", "parser-implementations"]
 keywords = ["fnmatch", "glob", "pattern", "regex"]
+rust-version = "1.85"
 
 [dependencies]
-anyhow = "1.0.69"
-itertools = ">= 0.10.3, < 0.14"
-regex = "1.7.1"
-thiserror = "1.0.38"
+anyhow = "1.0"
+itertools = "0.14"
+regex = "1.11"
+thiserror = "2.0"
 
 [dev-dependencies]
-rstest = ">= 0.17, < 0.24"
+rstest = "0.25"
Only in fnmatch-regex2-0.4.0: NEWS.md
Only in fnmatch-regex-0.2.1: docs
diff -ru fnmatch-regex-0.2.1/mkdocs.yml fnmatch-regex2-0.4.0/mkdocs.yml
***
fnmatch-regex-0.2.1/mkdocs.yml	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/mkdocs.yml	2006-07-24 04:21:28.000000000 +0300
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>
+# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>, Martin Bammer <mrbm74@gmail.com>
 # SPDX-License-Identifier: BSD-2-Clause
 
 theme:
diff -ru fnmatch-regex-0.2.1/pyproject.toml fnmatch-regex2-0.4.0/pyproject.toml
***
fnmatch-regex-0.2.1/pyproject.toml	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/pyproject.toml	2006-07-24 04:21:28.000000000 +0300
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>
+# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>, Martin Bammer <mrbm74@gmail.com>
 # SPDX-License-Identifier: BSD-2-Clause
 
 [tool.publync.format.version]
diff -ru fnmatch-regex-0.2.1/requirements/docs.txt fnmatch-regex2-0.4.0/requirements/docs.txt
***
fnmatch-regex-0.2.1/requirements/docs.txt	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/requirements/docs.txt	2006-07-24 04:21:28.000000000 +0300
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>
+# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>, Martin Bammer <mrbm74@gmail.com>
 # SPDX-License-Identifier: BSD-2-Clause
 
 mkdocs >= 1.4.2, < 2
diff -ru fnmatch-regex-0.2.1/run-clippy.sh fnmatch-regex2-0.4.0/run-clippy.sh
***
fnmatch-regex-0.2.1/run-clippy.sh	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/run-clippy.sh	2006-07-24 04:21:28.000000000 +0300
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>
+# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>, Martin Bammer <mrbm74@gmail.com>
 # SPDX-License-Identifier: BSD-2-Clause
 
 
diff -ru fnmatch-regex-0.2.1/src/glob.rs fnmatch-regex2-0.4.0/src/glob.rs
***
fnmatch-regex-0.2.1/src/glob.rs	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/src/glob.rs	2006-07-24 04:21:28.000000000 +0300
@@ -37,7 +37,7 @@
 //! # use std::error::Error;
 //!
 //! # fn main() -> Result<(), Box<dyn Error>> {
-//! let re_name = fnmatch_regex::glob_to_regex("linux-[0-9]*-{generic,aws}")?;
+//! let re_name = fnmatch_regex2::glob_to_regex("linux-[0-9]*-{generic,aws}")?;
 //! for name in &[
 //!     "linux-5.2.27b1-generic",
 //!     "linux-4.0.12-aws",
@@ -60,7 +60,7 @@
 
 use anyhow::anyhow;
 use itertools::{Either, Itertools as _};
-use regex::Regex;
+use regex::{Regex, RegexBuilder};
 
 use crate::error::Error as FError;
 
@@ -572,3 +572,24 @@
     let re_pattern = parser.flatten_ok().collect::<Result<Vec<_>, _>>()?.join("");
     Regex::new(&re_pattern).map_err(|err| FError::InvalidRegex(re_pattern, err))
 }
+
+/// Parse a shell glob-like pattern into a regular expression.
+///
+/// See the module-level documentation for a description of the pattern
+/// features supported.
+///
+/// # Errors
+/// Most of the [`crate::error::Error`] values, mostly syntax errors in
+/// the specified glob pattern.
+#[allow(clippy::missing_inline_in_public_items)]
+pub fn glob_to_regex_ext(pattern: &str, ignore_case: bool) -> Result<Regex, FError> {
+    let parser = GlobIterator {
+        pattern: pattern.chars(),
+        state: State::Start,
+    };
+    let re_pattern = parser.flatten_ok().collect::<Result<Vec<_>, _>>()?.join("");
+    RegexBuilder::new(&re_pattern)
+        .case_insensitive(ignore_case)
+        .build()
+        .map_err(|err| FError::InvalidRegex(re_pattern, err))
+}
diff -ru fnmatch-regex-0.2.1/src/lib.rs fnmatch-regex2-0.4.0/src/lib.rs
***
fnmatch-regex-0.2.1/src/lib.rs	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/src/lib.rs	2006-07-24 04:21:28.000000000 +0300
@@ -15,7 +15,9 @@
 pub mod error;
 pub mod glob;
 
-pub use glob::glob_to_regex;
+pub use glob::{glob_to_regex, glob_to_regex_ext};
+
+pub use regex::Regex;
 
 #[cfg(test)]
 pub mod tests;
diff -ru fnmatch-regex-0.2.1/tox.ini fnmatch-regex2-0.4.0/tox.ini
***
fnmatch-regex-0.2.1/tox.ini	2006-07-24 04:21:28.000000000 +0300
+++ fnmatch-regex2-0.4.0/tox.ini	2006-07-24 04:21:28.000000000 +0300
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>
+# SPDX-FileCopyrightText: Peter Pentchev <roam@ringlet.net>, Martin Bammer <mrbm74@gmail.com>
 # SPDX-License-Identifier: BSD-2-Clause
 
 [tox]

And you do know that the docs.rs service itself generates docs from published crates in crates.io, and that is the exactly same code you see when viewing sources there, right?

I think it's a script they added to do some sort of check with rustfmt.

Has anyone considered the feasibiluty of using distributed technologies? Torrents can handle arbitrary file sizes and throughput, with no servers whatsoever.

People who download things simply "pay" for their use by providing identical service to others: sharing their brandwidth, their CPU share and their disk space (that one may be for free though, because you do need that library you've downloaded right?).

It's a "business" (resource sharing) model that works, proven by decades pf continuous operation.

Thank you for checking! As for the private thing, they have the source code provided on a different place: https://docs.rs/crate/fnmatch-regex2/0.4.0/source/ Maybe it makes sense now, because they want people to focus on the other source, and do not want to work on Gitlab itself.

Because I never encountered signing into Gitlab before. And the repository of fnmatch-regex itself does not require me to sign in. So i was a bit suspicious. I mean who knows if it would be possible to provide fake sign in. Guess I'm just paranoid.

I believe all you already read the reply from the devtools team lead https://github.com/rust-lang/rustfmt/issues/6678#issuecomment-3382819708

Sounds like Bevy would be the way to go, I found the bevy_egui crate which seems like it might be what I'm looking for to get started.

Quick analysis of code shows that there’s no suspicious build scripts or imports added, just an additional poorly documented and not tested function.

Documentation is additionally published to a third-party website.

Repository is probably is hidden which is ok.