3 ms·

Things are already getting quite hairy by page 4[1] of that link. And that example is showing data completely owned by the GObject. If you need to pass a muta

Things are already getting quite hairy by page 4[1] of that link. And that example is showing data completely owned by the GObject. If you need to pass a mutable reference to third party data to a GObject it's not going to work in Rust. Imagine a button that you click to change the contents a GtkTreeModel connected to a GtkTreeView--you're going to need to work hard. You're going to write a fair bit Rust specific glue code to work around these issues. [1] https://gtk-rs.org/gtk4-rs/stable/latest/book/gobject_memory_management.html https://gtk-rs.org/gtk4-rs/stable/latest/book/gobject_memory...

rollcat 5y ago
Asking as someone who's never spent significant time/effort working with Gtk/GObject in C (only a bit in Python). Isn't it still generally desirable to have the compiler yell at you, if you can't convince it you know what you're doing? Rather than allowing the possibility of memory corruption. I do agree that the code in the example is far from beautiful. I wonder if we were to redesign GObject from scratch, if we could make interfacing with Python, Rust, JS, etc a bit less hairy.
- Someone 5y ago
  The work you have to do to show your compiler that certain constraints hold (say that i and j point inside the same array and that i < j can be extremely cumbersome, even in cases where it’s obvious that they do hold. That makes it not seem worth the trouble. Of course, that obvious may turn out to be incorrect for some edge condition. Basically, that’s the same reason why mathematicians don’t put all proofs through a proof assistant.
  - tialaramex 5y ago
    Of course, to the extent you assumed things the machine didn't test that. The core of TLS 1.3 was proved before it shipped. But, the proof makes an assumption which has consequences. It assumes when communicating using an agreed shared secret† you have a separate shared secret for every such pairing. So Alice and Bob need a shared secret but (and this is where humans trip up compared to what was actually proved) the proof says Bob and Alice also need a shared secret different from the one for Alice and Bob. The consequence of this accidentally missed assumption is the Selfie attack. Alice and Bob share a secret S and communicate over the Network using TLS 1.3. Bob fed the cat half an hour ago. The cat has employed Mallory to trick Alice into feeding it even though Bob already did. Alice sends a message on the Network. It is encrypted with S and it says "Did you feed the cat?". Mallory doesn't know S and can't read this message or tamper with it. But Mallory simply redirects the message back to Alice. Alice receives a message, properly encrypted using S, which says "Did you feed the cat?". She presumes this message is from Bob, so she answers "No, go ahead and feed the cat". Mallory redirects this response back to Alice too. Alice receives "No, go ahead and feed the cat" and she concludes Bob hasn't fed the cat so she feeds it again. Oops. The proof was fine, but we brought an assumption along that we did not clearly articulate. † You never use this mode in your web browser, but IoT things might do this because it's easier than all that stuff with certificates.
  - southerntofu 5y ago
    > The work you have to do to show your compiler that certain constraints hold In rust, that's what the unsafe keyword is allowed. It doesn't mean that the code is actually unsafe, but rather that the compiler should trust you on this one.
mmstick76 5y ago
You can avoid virtually all friction by sidestepping shared mutable references altogether and writing your GTK application in a more idomatic Rust way. For example, instead of passing shared references of application state to every widget signal, you can pass async Rust channels to signals. You can spawn a single async event loop attached to GLib's main context that listens for events sent from those signals, and manage all your widgets and application state in one place. There's some libraries that effectively automate GTK in this way, such as relm4.
pjmlp 5y ago
Thanks for the link, the last time I used Gtk-rs, the book wasn't yet a thing, you can imagine how much fun I had learning those patterns on my own. Yes, there is relm nowadays, which was yet to be born when I did my Gtkmm => Gtk-rs port. At least I can also now point others to the book.

rollcat 5y ago

Asking as someone who's never spent significant time/effort working with Gtk/GObject in C (only a bit in Python). Isn't it still generally desirable to have the compiler yell at you, if you can't convince it you know what you're doing? Rather than allowing the possibility of memory corruption. I do agree that the code in the example is far from beautiful. I wonder if we were to redesign GObject from scratch, if we could make interfacing with Python, Rust, JS, etc a bit less hairy.

Someone 5y ago
The work you have to do to show your compiler that certain constraints hold (say that i and j point inside the same array and that i < j can be extremely cumbersome, even in cases where it’s obvious that they do hold. That makes it not seem worth the trouble. Of course, that obvious may turn out to be incorrect for some edge condition. Basically, that’s the same reason why mathematicians don’t put all proofs through a proof assistant.
- tialaramex 5y ago
  Of course, to the extent you assumed things the machine didn't test that. The core of TLS 1.3 was proved before it shipped. But, the proof makes an assumption which has consequences. It assumes when communicating using an agreed shared secret† you have a separate shared secret for every such pairing. So Alice and Bob need a shared secret but (and this is where humans trip up compared to what was actually proved) the proof says Bob and Alice also need a shared secret different from the one for Alice and Bob. The consequence of this accidentally missed assumption is the Selfie attack. Alice and Bob share a secret S and communicate over the Network using TLS 1.3. Bob fed the cat half an hour ago. The cat has employed Mallory to trick Alice into feeding it even though Bob already did. Alice sends a message on the Network. It is encrypted with S and it says "Did you feed the cat?". Mallory doesn't know S and can't read this message or tamper with it. But Mallory simply redirects the message back to Alice. Alice receives a message, properly encrypted using S, which says "Did you feed the cat?". She presumes this message is from Bob, so she answers "No, go ahead and feed the cat". Mallory redirects this response back to Alice too. Alice receives "No, go ahead and feed the cat" and she concludes Bob hasn't fed the cat so she feeds it again. Oops. The proof was fine, but we brought an assumption along that we did not clearly articulate. † You never use this mode in your web browser, but IoT things might do this because it's easier than all that stuff with certificates.
- southerntofu 5y ago
  > The work you have to do to show your compiler that certain constraints hold In rust, that's what the unsafe keyword is allowed. It doesn't mean that the code is actually unsafe, but rather that the compiler should trust you on this one.

mmstick76 5y ago

You can avoid virtually all friction by sidestepping shared mutable references altogether and writing your GTK application in a more idomatic Rust way. For example, instead of passing shared references of application state to every widget signal, you can pass async Rust channels to signals. You can spawn a single async event loop attached to GLib's main context that listens for events sent from those signals, and manage all your widgets and application state in one place. There's some libraries that effectively automate GTK in this way, such as relm4.

pjmlp 5y ago

Thanks for the link, the last time I used Gtk-rs, the book wasn't yet a thing, you can imagine how much fun I had learning those patterns on my own. Yes, there is relm nowadays, which was yet to be born when I did my Gtkmm => Gtk-rs port. At least I can also now point others to the book.