But as you point out, how do you know that the components, particularly those downloaded from the Internet, do not contain malicious code that could destroy the integrity of your application? Many popular packages, such as Sendmail and OpenSSH, have been infected with malicious Trojans, and software distributions sites at the Free Software Foundation and SourceForge, for example, have also been successfully compromised in the past.
Firstly, I would be very cautious about using a component for which the source code was not available. Without the source code, you can never be sure of how the component works and what it does and doesn't do. If the source code can't be purchased as part of the component package, which can be the case with more complex components made by more established companies, I would strongly favor those that have been digitally signed. Software digital signatures show which publisher has provided the software package. They also verify that the package has not been tampered with since it was signed.
Code signing does not necessarily guarantee the quality or functionality of the software. Because software vendors' reputations are based on the quality of their code, however, there is an incentive for them to fix any problems. Before installing third-party packages, always check for a vendor's known vulnerabilities and then keep up with any patches and advisories. This will mean subscribing to its mailing list so that you are notified about any problems or issues. Also consider how to update and maintain your own product if one of its components needs urgent patching.
Many software products provide interfaces that enable third-party developers like you to integrate their software. Some vendors of such products, such as German software giant SAP, have set up integration certification programs to ensure the quality of products that interact with their own. If you are looking to develop such a product, I would recommend that you consider joining the relevant program. The program will provide a reference point for the integrity of your own work.
Dig deeper on Software Development Methodology
Related Q&A from Michael Cobb
Do you know some of the best third-party patch deployment tools? See expert Michael Cobb's recommendations on which tools would work best for your ...continue reading
Users in the enterprise may unknowingly be exposed to 'Gchat' security risks. Expert Michael Cobb discusses Internet application security best ...continue reading
Today's powerful smartphones can sometimes spread viruses to the corporate network. Learn how it can happen and how to prevent it.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.