Is it considered bad practice to call for example tshark or ffmpeg in my code, assuming I couldn't find a good enough library to use?
2 Answers
No, this can be a normal and sensible thing to do. But:
The program you are using needs to have a stable, machine-readable interface. Many programs have a human-readable output that is difficult to parse.
These external programs are a dependency. The normal strategies of your programming language to deal with dependencies don't work here, and you will need some kind of configuration management when deploying your application.
Be aware that creating a new process may have significant overhead, especially on Windows.
Calling external programs has security implications. If an attacker can modify the program being called or even just the command line arguments, that can be used for privilege escalation and remote code execution.
As an example of when not to use external programs: For some time, Apple's libc used to shell out to Perl to implement a standard library function. That's not a good idea.
-
1You could bundle a specific version of the program you depend on. Of course a better solution is to use the API, but the dependency may not make one available, especially if it was written with a UNIX ethos. Feb 11, 2018 at 4:23
-
In some cases, you don’t have a choice, often because the external tool is GPL licensed and your program is proprietary.– DemiFeb 23, 2018 at 4:57
Yes and No. It depends on where your software is running. If its in some closed environment with high security regulations, you might get problems with your software loading external applications (and Librarys).
On the other hand, if your application is running in some environment without this kind of regulations, there should not be anything negative to use external applications.
-
Yes ! And it depends also on performance constraints (i.e how often the programme has to be called in a given time interval) Feb 11, 2018 at 11:07
ffmpegis a very thin front end on two libraries,libavformatandlibavcodec. Mostly it just provides command line parsing and file handling. Anything it can do can be implemented easily within your program, at least if your language has a good interface to C, do is possibly not the best example here .... That said, I've written Java programs that call it as an external process in the past.