But as you point out, how do you know that the components, particularly those downloaded from the Internet, do...
not contain malicious code that could destroy the integrity of your application? Many popular packages, such as Sendmail and OpenSSH, have been infected with malicious Trojans, and software distributions sites at the Free Software Foundation and SourceForge, for example, have also been successfully compromised in the past.
Firstly, I would be very cautious about using a component for which the source code was not available. Without the source code, you can never be sure of how the component works and what it does and doesn't do. If the source code can't be purchased as part of the component package, which can be the case with more complex components made by more established companies, I would strongly favor those that have been digitally signed. Software digital signatures show which publisher has provided the software package. They also verify that the package has not been tampered with since it was signed.
Code signing does not necessarily guarantee the quality or functionality of the software. Because software vendors' reputations are based on the quality of their code, however, there is an incentive for them to fix any problems. Before installing third-party packages, always check for a vendor's known vulnerabilities and then keep up with any patches and advisories. This will mean subscribing to its mailing list so that you are notified about any problems or issues. Also consider how to update and maintain your own product if one of its components needs urgent patching.
Many software products provide interfaces that enable third-party developers like you to integrate their software. Some vendors of such products, such as German software giant SAP, have set up integration certification programs to ensure the quality of products that interact with their own. If you are looking to develop such a product, I would recommend that you consider joining the relevant program. The program will provide a reference point for the integrity of your own work.
Dig Deeper on Software Development Methodology
Related Q&A from Michael Cobb
Is cookie encryption enough to protect sensitive information? Expert Michael Cobb explains how salted hashes can prevent attacks, and the secure way ...continue reading
A vulnerability was found in the Blackphone's Icera modem. Expert Michael Cobb explains how attackers could hijack the device, and if this would ...continue reading
Oracle is killing off the Java browser plug-in due to security risks. Expert Michael Cobb explains the next steps for enterprises with Java-based ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.