- [Instructor] Software developers
often depend upon code created by someone else
to help improve their own efficiency.
In addition to reusing code within an organization,
developers also often draw upon code from third parties.
Third-party software libraries are a very common way
to share code among developers.
Libraries consist of shared code objects
that perform related functions.
For example, a software library might contain
a series of functions related to biology research,
financial analysis, or social media.
Instead of having to write the code
to perform every detailed function that they need,
developers can simply locate libraries
that contain relevant functions
and then call those functions.
Let's take a look at an example
using the programing language R
that is commonly used for data science applications.
This code is a simple analysis of data
from the Social Security Disability applications
over the previous 10 years.
The code is designed to determine
whether efforts to drive applicants
to submit their applications online have been successful.
The details of most of this code here
aren't relevant for our purposes,
but I do want you to notice a few lines here at the top.
These lines are calling different libraries.
You can see there's a library related
to string manipulation, one for working with dates,
and then, in particular, this one calls the ggplot2 library.
This is a library that contains a number of functions
related to creating graphic output of data visualizations.
Then we have all this code here that performs a wide variety
of transformations on the data.
Down at the bottom, you see I've called the qplot function.
I'm going to go ahead and take a look at the help file
for the qplot function, that just appeared over here.
It's called quick plot, and it's a function designed
to help developers quickly plot data.
We have instructions here on how to call the qplot function.
And if I just take a quick look at the actual code,
here's the source code for qplot.
All of this code is code that I would've had to write myself
if I wasn't able to use the ggplot2 library
to create my code.
I'm going to go ahead and call the qplot function here,
with some of the data that I've created in this code.
And, when I run it,
you can see it quickly creates a scatter plot
that allows me to take a look at the data.
I'm looking at, over time, the percentage of applications
that have been submitted online,
and it looks like my efforts have been successful.
In 2008, the rate was somewhere around 10%,
and that rose steadily until current day where we're
up over 50% of these applications being submitted online.
Organizations trying to make code libraries
more accessible to developers
often publish software development kits, or SDKs.
SDKs are collections of software libraries
combined with documentation, examples,
and other resources designed to help programmers
get up and running quickly in a development environment.
SDKs also often include specialized utilities
designed to help developers design and test code.
For example, here's a software development kit
that Facebook makes available for iOS developers.
It includes a guide, getting started instructions,
documentation, and then, as you can see,
there are a wide variety of functions
to help developers use Facebook Login,
let people log in to applications
using only their phone number,
help people share things and send messages on Facebook,
access the Facebook social graph, run ads,
and many other functions with Facebook.
It's all bundled together here in a software development kit
to help people develop iPhone and iPad applications
that work with Facebook.
Application programming interfaces, or APIs,
are another way that organizations
make services available to developers.
Instead of providing code the developers can run themselves,
APIs make services that run elsewhere
available to developers.
For example, Twitter offers an API
that allows developers to interact with the Twitter service,
reading and posting Tweets
and performing other Twitter actions.
Security professionals should be familiar
with the various ways that third-party code
is used in their organizations,
as well as ways that their organization
makes services available to others.
It's fairly common for security flaws
to arise in shared code,
making it extremely important to know these dependencies
and remain vigilant about security updates.
Third-party code plays an increasingly important role
in the modern software development shop
and should be carefully watched by cyber security teams.