upvote
> You are just swapping a package manager with security by obscurity by copy pasting code into your project

You should try writing code, and not relying on libraries for everything, it may change how you look at programming and actually ground your opinions in reality. I'm staring at company's vendor/ folder. It has ~15 libraries, all but one of which operate on trusted input (game assets).

> fundamental benefits of a package manager.

I literally told you why they don't matter if you write code in a sane way.

> doing C-style bindings is actually quite common

I know bindings for Rust libraries exist. Read the literal words you quoted. "Rust libraries are very rarely used outside of Rust". Got some counterexamples?

reply
https://github.com/memflow/memflow

https://github.com/PyO3/pyo3

https://slint.dev/

https://github.com/dora-rs/dora

It is VERY common in existing codebases that are migrating from C++/C to make heave use of FFI/ existing C

reply
> trusted input (game assets)

Gamedev is its own weird thing, and isn't a model you want to generalize to other industries. It has to optimize for things a lot of software does not, and that skews development.

Vendoring libraries is almost always a terrible idea because it immediately starts to bitrot and become a footgun.

Sometimes it's necessary, but it's not desirable, and you almost always just want to pin your dependencies instead.

reply