ChrisSD

What's the Python issue?

I've done a small straw poll from a range of ages (20's to 70's). Only the older people (60's+) seem to have vaguely heard of it but none knew what it is or had any particular reaction to me mentioning it.

Note though that my sample size for older people is very small due to the lack of 50's+ in my immediate vicinity (one person in their 60's and one person in their 70's).

`printf` isn't exactly modern!

I mean, Vista is ~15 years old at this point. If anything that's still part of Windows makes the backspace mistake then if nothing else it's impressive it's survived this long without being noticed.

No, it's UTF-16 with no validation at the kernel level. Invalid UTF-16 is also invalid UCS-2 as those code points were explicitly barred from use.

In practice, only malware will create such broken names. High level software (e.g. Microsoft's own VSCode) will not handle broken UTF-16. And indeed the in-built UTF-8 code page will lossily decode UTF-16 (unpaired surrogates are replaced with the Unicode replacement character).

Sure. I did not mean to imply that SEH itsef requires the C runtime. However, the __CxxFrameHandler3 that Rust/llvm uses would need to be rewritten.

IIRC llvm itself generates calls to __CxxFrameHandler3 when SEH is being used, making it awkward to replace with something that's not compatible.

At a minimum Rust would have to run the C initializers as these are used even in pure Rust code. It might also make use of the security cookie but I'm uncertain about that. Also the C runtime is needed by the SEH handling code (in vcruntime) so Rust would have to replace that before it can replace the C startup/shutdown.

To be clear, this is feasible but it'll require someone knowledgable to put in the work of rewriting this in Rust.

Rust needs the C runtime for startup/shutdown code (and vcruntime for panics). It also needs basic memory functions such as memcpy and stack probes. There is no way round this except rewriting those in Rust.

A string is encoded in memory as an array of numbers so in this case "ordinal" means that it simply compares the two arrays number by number.

A non-ordinal string comparison may take into account other things such as iterating by actual characters and comparing them in language and culture-aware ways. This is useful for ordering things by name when showing a list to users.

It does not. Invalid UTF-16 (aka unpaired surrogates) are replaced by the Unicode REPLACEMENT_CHARACTER (�) However, in practice such filenames are only produced by malicious software and many large products won't work with them anyway (e.g. Microsoft's own VSCode).

UTF-32 was an interesting choice. Was that done for the sake of completeness or was there a specific use case for it?

The Rust standard library has contortions in order to support invalid UTF-16. To do this it uses an encoding called "WTF-8"[0], which is an extension to UTF-8.

If the standard library dropped this requirement and only supported valid Unicode then it could simply use normal UTF-8 instead of WTF-8.

[0]: https://simonsapin.github.io/wtf-8/

You would need libraries. E.g. the C runtime and system import libraries (msvcrt.lib, vcruntime.lib, kernel32.lib, etc).

Ken Thompson was the one scribbling on a napkin. Rob was the one telling the story later on.

Thanks! That's super helpful.

While you're here, do you happen to know if mingw will gain support for native thread local storage? Emulated TLS is still the only option, right?

Eh. They're basically right. Windows "11" is just rebranding. There's no reason why it couldn't have been a Windows 10 feature update, except that they wanted to drop support for older hardware.

Eh. Tbh I'm find both powershell and unixy shells have their advantages and warts. I'm not sure either is "better". Maybe I'm just not a fan of shells in general.

There is a guarantee that this path is stable:

https://github.com/Microsoft/vswhere/wiki/Installing

> This is a fixed location that will be maintained.

`%ProgramFiles(x86)%\Microsoft Visual Studio\Installer`

The is true no matter where Visual Studio is installed to.

`vswhere` is for querying a variety of information about all visual studio installs. It does far more than the "simple" problem of finding libraries.

If they were doing conversions manually, I suspect such a major encoding error would have shown up quite quickly. It's bound to cause errors when a file is unopenable in a lot of programs that can't handle non-unicode (heck, Microsoft's own VS code can't handle them).

I doubt even really old NT programs (pre 2000) using UCS-2 would have included unpaired surrogates because IIRC those code points were never mapped to actual characters so I don't think that's an issue in practice.

Windows is actually quite a bit better. The APIs require you to use an encoding. The multibyte `A` APIs can be whatever encoding the current process is using and will be automatically converted to valid UTF-16. The `W` APIs are for UTF-16. The issue is the latter does not enforce valid UTF-16.

So in practice the only way invalid UTF-16 shows up is from malicious programs (or people testing their handling of non-unicode).

> can't Visual Studio statically link in whatever extras it needs

It can but you have to change some options (`/MT` iirc). And if you want to be really minimalist you only need to statically link the runtime (if you avoid using the C++ standard library).

No. I'm saying it provides vaccine information which people can use to make an informed decision.

Maybe I'm just old fashioned but I believe in individual freedom. I should have the right to choose. I should have the right to associate with who I want to associate with.

I'm really uncertain why people are so intent on taking away essential rights. Even though you may not agree with the choices people make, they should be allowed to make them.

I'm struggling to see your point? If someone wants to exercise their freedom of association during a pandemic they should be able to do so. I feel very strongly about this and don't like the alternative of restricting people's rights unnecessarily.

Huh? The NHS COVID Pass does. It allows sharing vaccine status in both domestic and international contexts.

You have the right to choose. A passport gives others necessary information so they can choose.

Managing public health is difficult enough even without people forcing their choices on to others.

If the crate is actively malicious then crates.io should be informed immediately and the crate removed. Probably the author too. If need be RustSec can issue a security advisory.

These do all seem to be things that apply to most package managers of this kind. So it would be good if Rust could find solutions that can be applied more broadly.