4

How do you guys go about entrusting third party packages, libraries, etc. into your projects? In other words, what steps, if any, do you take before incorporating an outside component into your project? Does the sheer number of downloads satisfy your assurance that it is safe? Is it considered safe if you downloaded it from github simply because it was github? What about updates? How can you be assured that the component will be kept up to date when you go back years from now to update your application?
**If this is not the right forum to post this - please tell me which one would be appropriate.

  • 1
    "Does the sheer number of downloads satisfy your assurance that it is safe?" - no, but if many projects are using a particular third-party component, you may be able to learn from their experiences to help guide your decision. – Brandin Oct 20 '16 at 13:33
3

Doing your due diligence is part of the job when selecting third party components, hiring consultants or assigning internal project members for that matter.

Every project will have its balance between security (paranoia), cost and development speed.

When building critical bank applications Ive been in projects that always pair program and never include any external dependencies.

Most projects I work in suffice with checking component popularity and check we dont see obvious external connectivity during development and testing.

But end of the day this is a business decision, not a technical one.

  • 2
    In addition to the popularity check a good indicator is GitHub issues and pull requests, where you can see how the project handles feedback and quality. And sometimes you just see there is a security issue pending. An example: github.com/splendido/meteor-accounts-meld/issues/30 – Luc Franken Oct 20 '16 at 13:28
1

what steps, if any, do you take before incorporating an outside component into your project?

Some companies and language workflows are very reluctant to incorporate any components that don't come from the OS or platform vendor. Usually the first consideration is not so much reliability as licensing. Obviously you can't use GPL'd software in proprietary software, but many firms are wary of the non-viral open licenses too.

Does the sheer number of downloads satisfy your assurance that it is safe? Is it considered safe if you downloaded it from github simply because it was github?

Lots of people in the Open Source and Javascript communities regard those as reasonable assumptions. Others are more wary. Signed (GPG etc) commits are one way of tracing back source changes to specific developers.

What about updates? How can you be assured that the component will be kept up to date when you go back years from now to update your application?

Well, you can't really, unless you have a guarantee from the vendor. And that will usually come with an intended or implied end-of-life. You may be forced to rewrite a chunk of your application because a component has become obsolete.

That leads to the choice between copying the source into your application (stable, but not automatically updated) or downloading it as part of the build process (automatically updated but not stable).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.