Finding items that aren't associated

Thanks to some advice from the list earlier, I now have a Permission
model that links User and Thing (using has_many and :through).

I can easily get the list of current users by doing the following:

@thing = Thing.find(params[:id])
@current_users = @thing.users

But in my view, I want to construct a select of those users that haven’t
had permissions added, so they can be added. I’ve tried some pretty
stupid stuff like subtracting @thing.users from User.find :all, but this
doesn’t seem to work.

What is the easiest way of picking out all users that aren’t currently
associated with the given thing? Then, I’ll create a multi-select and
try to work out how to iterate through all the selected ones and add
their permissions.