But as you point out, how do you know that the components, particularly those downloaded from the Internet, do...
not contain malicious code that could destroy the integrity of your application? Many popular packages, such as Sendmail and OpenSSH, have been infected with malicious Trojans, and software distributions sites at the Free Software Foundation and SourceForge, for example, have also been successfully compromised in the past.
Firstly, I would be very cautious about using a component for which the source code was not available. Without the source code, you can never be sure of how the component works and what it does and doesn't do. If the source code can't be purchased as part of the component package, which can be the case with more complex components made by more established companies, I would strongly favor those that have been digitally signed. Software digital signatures show which publisher has provided the software package. They also verify that the package has not been tampered with since it was signed.
Code signing does not necessarily guarantee the quality or functionality of the software. Because software vendors' reputations are based on the quality of their code, however, there is an incentive for them to fix any problems. Before installing third-party packages, always check for a vendor's known vulnerabilities and then keep up with any patches and advisories. This will mean subscribing to its mailing list so that you are notified about any problems or issues. Also consider how to update and maintain your own product if one of its components needs urgent patching.
Many software products provide interfaces that enable third-party developers like you to integrate their software. Some vendors of such products, such as German software giant SAP, have set up integration certification programs to ensure the quality of products that interact with their own. If you are looking to develop such a product, I would recommend that you consider joining the relevant program. The program will provide a reference point for the integrity of your own work.
Dig Deeper on Secure software development
Related Q&A from Michael Cobb
Researchers developed a tool to help prevent improper certificate pinning that causes security issues. Expert Michael Cobb reviews the issue and the ...continue reading
Google Project Zero discovered a WPAD attack that could target systems running Windows 10. Expert Michael Cobb explains how the attack works and how ...continue reading
App trackers were found in hundreds of Google Play apps. Expert Michael Cobb explains the threat they pose and how GDPR has the potential to reduce ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.