But as you point out, how do you know that the components, particularly those downloaded from the Internet, do...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
not contain malicious code that could destroy the integrity of your application? Many popular packages, such as Sendmail and OpenSSH, have been infected with malicious Trojans, and software distributions sites at the Free Software Foundation and SourceForge, for example, have also been successfully compromised in the past.
Firstly, I would be very cautious about using a component for which the source code was not available. Without the source code, you can never be sure of how the component works and what it does and doesn't do. If the source code can't be purchased as part of the component package, which can be the case with more complex components made by more established companies, I would strongly favor those that have been digitally signed. Software digital signatures show which publisher has provided the software package. They also verify that the package has not been tampered with since it was signed.
Code signing does not necessarily guarantee the quality or functionality of the software. Because software vendors' reputations are based on the quality of their code, however, there is an incentive for them to fix any problems. Before installing third-party packages, always check for a vendor's known vulnerabilities and then keep up with any patches and advisories. This will mean subscribing to its mailing list so that you are notified about any problems or issues. Also consider how to update and maintain your own product if one of its components needs urgent patching.
Many software products provide interfaces that enable third-party developers like you to integrate their software. Some vendors of such products, such as German software giant SAP, have set up integration certification programs to ensure the quality of products that interact with their own. If you are looking to develop such a product, I would recommend that you consider joining the relevant program. The program will provide a reference point for the integrity of your own work.
Dig Deeper on Software Development Methodology
Related Q&A from Michael Cobb
Attackers using crafted TIFF images can exploit flaws in the LibTIFF library to carry out remote code execution. Expert Michael Cobb explains how ...continue reading
Companies and government agencies handling criminal justice information need to comply with CJIS Security Policy. Expert Michael Cobb explains the ...continue reading
An Intel chip flaw lets attackers bypass ASLR protection on most operating systems. Expert Michael Cobb explains the vulnerability and how to prevent...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.