Latest / DevQuestions with Tim Corey / 028 When Should I Not Use a Third-Party Library In My Project?

Transcript

028 When Should I Not Use a Third-Party Library In My Project? · DevQuestions with Tim Corey

• 0:00
  SPEAKER_00: Welcome to the Dev Questions Podcast with Tim Corey.
• 0:03
  SPEAKER_00: Join us each episode as we tackle the questions you are asking about a career in software development, understanding the industry, and new technology.
• 0:12
  SPEAKER_00: If you're just starting out or you want to grow stronger as a developer, this is the place to get your questions answered.
• 0:19
  SPEAKER_00: Now, here's your host, expert developer and online educator, Tim Corey.
• 0:24
  SPEAKER_01: When should I not use a third-party library in my project?
• 0:29
  SPEAKER_01: This is a question Kokorky asked me on YouTube.
• 0:33
  SPEAKER_01: I thought it was a great one to cover because I hear a lot about well, you should never use third-party projects, or we're not allowed to use third-party projects, or I use nothing but third-party projects.
• 0:45
  SPEAKER_01: So let's talk through in this episode of Dev Questions where do you land on third-party projects or third-party libraries in your projects and when do you use them?
• 0:57
  SPEAKER_01: So let's start off the very beginning by saying balance is important.
• 1:03
  SPEAKER_01: And whenever you hear someone say always or never when it comes to software development, that's a red flag.
• 1:12
  SPEAKER_01: It doesn't mean it's it's wrong.
• 1:14
  SPEAKER_01: It means you need to really evaluate that from the perspective of it's probably wrong, but there may be it may be right.
• 1:25
  SPEAKER_01: Come from that perspective.
• 1:27
  SPEAKER_01: So always having tons of third-party libraries, probably not.
• 1:34
  SPEAKER_01: Never having third-party libraries, probably not.
• 1:39
  SPEAKER_01: You always want to think about, always, you want to think about balance in your application.
• 1:45
  SPEAKER_01: You want to think about what the the benefits are versus the drawbacks.
• 1:52
  SPEAKER_01: Every action you take has both positives and negatives.
• 1:56
  SPEAKER_01: And figuring out which negatives you're okay with is important.
• 2:02
  SPEAKER_01: So when there's a course on my my site on Iamtimcorey.com that is upgrading to.NET Core.
• 2:10
  SPEAKER_01: And it's a course where we we upgrade four different projects.
• 2:13
  SPEAKER_01: They're in.NET Framework, we upgrade them to.NET Core 3.0.
• 2:18
  SPEAKER_01: And the reason we have that course is because this is a thing that you're gonna go through as a developer, especially in in this current era, because of the fact there's a lot of.NET framework code out there, and we have to go to.NET Core because that's where you know a ton of speed improvements are.
• 2:37
  SPEAKER_01: That's where the newest stuff is being done, that's that's where security stuff is being updated the most, and that's where we're we are moving forward on.
• 2:46
  SPEAKER_01: So that's gonna happen.
• 2:48
  SPEAKER_01: Well, even in my example projects, and I have four of them, uh, WinForms, WPF, Class Library, and uh, I think MVC.
• 2:58
  SPEAKER_01: That's what it is.
• 3:00
  SPEAKER_01: So of those four projects, they're smaller projects, but yet, even so, I had dependency, a third-party library that almost prevented me from upgrading one of my projects to.NET Core.
• 3:16
  SPEAKER_01: So that balance almost hurt me.
• 3:19
  SPEAKER_01: Even though it's just one library, I only used, I think, two or three libraries total in that project.
• 3:25
  SPEAKER_01: One of them almost cost me the ability to upgrade a.NET Core.
• 3:30
  SPEAKER_01: Now, there's ways around that, there's ways that things I could have done.
• 3:34
  SPEAKER_01: But that's the kind of thing you have to think through is I'm depending on, I'm taking a dependency on a third-party library.
• 3:44
  SPEAKER_01: Is that a good thing for my application?
• 3:46
  SPEAKER_01: Is it good that I'm kind of putting a little bit of my fate in another person's hands, another company's hands, or a just a person?
• 3:56
  SPEAKER_01: So I think there's three criteria to think through when you're thinking about adding a dependency on a third-party library to your application.
• 4:06
  SPEAKER_01: Now, before we do, let's talk first what do I mean by third-party library, just in case we're not clear here.
• 4:12
  SPEAKER_01: So I use the data access tool Dapper a lot.
• 4:16
  SPEAKER_01: It's called a micro ORM.
• 4:19
  SPEAKER_01: And Dapper, I think, is a really powerful tool, does some great things, but that's from the company that does Stack Overflow.
• 4:29
  SPEAKER_01: That's they make that tool.
• 4:31
  SPEAKER_01: It's open source, but they make that tool.
• 4:33
  SPEAKER_01: So that's a third-party dependency that I take whenever I have SQL or MySQL or most of the other relational databases that I use.
• 4:43
  SPEAKER_01: I use Dapper to access that data.
• 4:46
  SPEAKER_01: So that's a dependency as a third-party library.
• 4:49
  SPEAKER_01: That's the kind of thing we're talking about.
• 4:51
  SPEAKER_01: It doesn't have to be as big, you know, um, company like Teleric or DevExpress or something like that, where there's, you know, a big package that you bring in.
• 5:01
  SPEAKER_01: It doesn't have to be.
• 5:01
  SPEAKER_01: It can be something small as just Dapper.
• 5:04
  SPEAKER_01: So the three criteria that I think through when I ask the question, should I bring this into my app?
• 5:13
  SPEAKER_01: Is number one, can I easily do it myself?
• 5:19
  SPEAKER_01: This is one that's often I often hear from people, they say, Oh, I could do it myself.
• 5:26
  SPEAKER_01: Um Dapper is one.
• 5:28
  SPEAKER_01: So Dapper, what it does is it connects to SQL, it gets the data from SQL.
• 5:35
  SPEAKER_01: Let's just say read for now.
• 5:37
  SPEAKER_01: It gets the data from SQL and it maps it over to a list of model.
• 5:42
  SPEAKER_01: So it takes, let's say a person model with first name, last name, and email address.
• 5:47
  SPEAKER_01: And I have a table that has first name, last name, and email address.
• 5:50
  SPEAKER_01: Dapper would take that table, it would download it to my C sharp code, and it would convert each row over to a person model and have create a list of those or an I enumerable of those.
• 6:04
  SPEAKER_01: That's what Dapper does.
• 6:06
  SPEAKER_01: And so I hear people say, well, I could do that with ado.net myself.
• 6:11
  SPEAKER_01: Yeah, you could kind of.
• 6:13
  SPEAKER_01: Um, you can make that ado.net call.
• 6:16
  SPEAKER_01: It won't be as as simple as the Dapper call, but you could do it.
• 6:20
  SPEAKER_01: But then you get back a data table.
• 6:24
  SPEAKER_01: And then you have to do the mapping to the objects yourself and make sure the typing is correct.
• 6:30
  SPEAKER_01: And make sure that you handle what if I don't have that property in my object, and or you have to create the mapping for each individual query you do.
• 6:42
  SPEAKER_01: That's a lot more work.
• 6:45
  SPEAKER_01: So it's not just can I do it myself, but can I easily do it myself?
• 6:52
  SPEAKER_01: I do a lot of data access in projects.
• 6:55
  SPEAKER_01: I'm sure you do too, because projects, our software is usually based upon, in some way, data.
• 7:05
  SPEAKER_01: So if I'm gonna be writing 50 or 100 queries against my database, do I want to write the ADO code for 50 or 100 queries and map those tables over to objects?
• 7:20
  SPEAKER_01: Or do I want to write what turns out to be one line of Dapper for each of those calls?
• 7:27
  SPEAKER_01: It seems to me it it often becomes, yeah, it's it's a whole lot easier for me to use Dapper for that.
• 7:35
  SPEAKER_01: So that's one.
• 7:36
  SPEAKER_01: But then number two, is this the main focus of my application?
• 7:42
  SPEAKER_01: Is this why my application exists?
• 7:45
  SPEAKER_01: Does the reason your application exist to uh get data from SQL?
• 7:50
  SPEAKER_01: You may say, well, you know, sure, that's what it's there for.
• 7:53
  SPEAKER_01: Probably not.
• 7:55
  SPEAKER_01: Because there's tools you can buy like SQL Server Management Studio.
• 7:59
  SPEAKER_01: You can do a query against the database right now using a GUI.
• 8:03
  SPEAKER_01: That's not what your application does.
• 8:06
  SPEAKER_01: What your application most often does is it either reports on that data, meaning it formats that data in a nice viewable fashion, or it allows you to easily add new data securely and ensuring the data is valid data beforehand.
• 8:28
  SPEAKER_01: Or maybe it combines the data and allows you to interact with data in a way that you wouldn't otherwise be able to do.
• 8:37
  SPEAKER_01: That's what your application does.
• 8:39
  SPEAKER_01: It doesn't, it's not just about accessing data, it's about how you display it or how you uh allow new data to come in.
• 8:48
  SPEAKER_01: And so if the focus of your application isn't on that thing, so we're talking about data access.
• 8:55
  SPEAKER_01: What about dependency injection?
• 8:56
  SPEAKER_01: Should you roll your own?
• 8:58
  SPEAKER_01: I say no.
• 9:00
  SPEAKER_01: Use a tool for that because again, it's not easy to do yourself, and it's not the main focus of your application.
• 9:07
  SPEAKER_01: Your application's focus is not about managing its dependencies, it's about doing the job.
• 9:14
  SPEAKER_01: So, number one, can I easily do it myself?
• 9:18
  SPEAKER_01: Number two, is this the main focus of my application?
• 9:22
  SPEAKER_01: And number three, are there security concerns?
• 9:26
  SPEAKER_01: This is one that that makes me twitch a lot.
• 9:30
  SPEAKER_01: People ask me the question, hey Tim, how do I write my own authentication software?
• 9:37
  SPEAKER_01: And my answer is, you don't.
• 9:41
  SPEAKER_01: There's companies out there that have done that for you.
• 9:45
  SPEAKER_01: Use them because they that's their main focus.
• 9:50
  SPEAKER_01: That's what they do, that's that's what they're working on, that's what they're patching and upgrading and and uh testing and making sure is secure.
• 10:03
  SPEAKER_01: Your application isn't about identity, it's not about authorization and authentication.
• 10:10
  SPEAKER_01: That's just a side piece of your application.
• 10:13
  SPEAKER_01: So don't make that a main focus of your application.
• 10:16
  SPEAKER_01: Don't roll your own.
• 10:18
  SPEAKER_01: Because if there's security concerns, you really want the safety of a tried and true, tested, verified, and validated library that will help you do it right.
• 10:34
  SPEAKER_01: Rolling your own security is an easy way to have a data breach.
• 10:39
  SPEAKER_01: Just don't do it.
• 10:41
  SPEAKER_01: So those are the things that I think through when I am evaluating if I should add something to my application.
• 10:50
  SPEAKER_01: Now, if you look through those three criteria, think through those three, you may realize it means that I'll add a lot of dependencies.
• 10:59
  SPEAKER_01: I'll add a lot of things.
• 11:01
  SPEAKER_01: And yes, I will.
• 11:02
  SPEAKER_01: I will bring a lot of things in.
• 11:04
  SPEAKER_01: For example, givens for me.
• 11:07
  SPEAKER_01: Uh logging, dependency injection, and identity or security, authentication, authentic authorization, uh data access with Dapper.
• 11:18
  SPEAKER_01: Those things are just always going to be third party for me.
• 11:23
  SPEAKER_01: And the reason why is because they are complex topics.
• 11:28
  SPEAKER_01: They're not easy.
• 11:30
  SPEAKER_01: And it may seem easy.
• 11:32
  SPEAKER_01: It may seem like, oh, I could just do that.
• 11:34
  SPEAKER_01: Remember, every time you estimate software, it's it's more expensive than that.
• 11:41
  SPEAKER_01: But even if you could do it easily, once you've done it, you still have to think through and evaluate did I do I need to do this better?
• 11:52
  SPEAKER_01: Is there a way I need to uh secure this better?
• 11:56
  SPEAKER_01: If you look at any software product, any third-party product, whether it's uh Dapper or whether it's AutoFact for dependency injection, or you know, uh Log4Net or Sarolog for logging, any of these, if you look at them, none of them are on version one.
• 12:16
  SPEAKER_01: None of them have put out their their library and said, Yep, we're done.
• 12:22
  SPEAKER_01: No more necessary.
• 12:25
  SPEAKER_01: No, they they've they're constantly adding things, changing things, fixing code.
• 12:30
  SPEAKER_01: If you go look at, and I haven't done it recently, but if you go to the GitHub page for for Dapper and go to the issues list, are there zero unopened or unanswered issues?
• 12:45
  SPEAKER_01: No, there's always going to be issues in there that have not yet been resolved because there's always edge cases or there's always things that pop up or changes in the.NET way.NET works or whatever it is.
• 13:00
  SPEAKER_01: And those are the things that if you do it yourself, you have to maintain.
• 13:07
  SPEAKER_01: So people may say, well, you know, I don't want to have third-party dependencies because when I upgrade from.NET Core 2.2 to 3.1, I don't have a problem.
• 13:18
  SPEAKER_01: I understand that, but your code has to be fixed.
• 13:23
  SPEAKER_01: If there's a problem, it's in your code, and that means that you're on the hook to fix it.
• 13:30
  SPEAKER_01: You haven't been preparing for this.
• 13:32
  SPEAKER_01: Third-party libraries usually have been, especially the ones that are actively maintained.
• 13:38
  SPEAKER_01: So there's that to think through.
• 13:40
  SPEAKER_01: Also, um with a now with open source, it's a whole lot easier to say, you know what?
• 13:47
  SPEAKER_01: Even if I have to later maintain this myself, I can.
• 13:52
  SPEAKER_01: So we talked about this with uh caliber and micro.
• 13:56
  SPEAKER_01: Uh, we had an episode on dev questions about caliber and micro.
• 13:59
  SPEAKER_01: The fact that the the uh library author was saying, you know what, this is not my focus anymore, and so I'm not gonna continue to maintain this.
• 14:08
  SPEAKER_01: And there's not been as of yet a person or group that stepped forward and said we want to maintain this.
• 14:14
  SPEAKER_01: And so there's not necessarily new updates coming to that after a certain point.
• 14:20
  SPEAKER_01: There's still some that he's working on, but we talked the idea that yes, that's a that's a bummer.
• 14:29
  SPEAKER_01: And yes, we wish that we could get more free stuff out of them.
• 14:33
  SPEAKER_01: But at the same time, we have access to all the source code.
• 14:37
  SPEAKER_01: So that if we had written it ourselves, we would have done a ton of work to get MVVM to work at the level we needed it to.
• 14:48
  SPEAKER_01: And we would have developed a lot of what caliber micro already has.
• 14:52
  SPEAKER_01: Well, now we instead have been able to use caliber micro for years, and now if we need to continue to upgrade it, we have the code and we can start from here and go forward.
• 15:04
  SPEAKER_01: That's not the same thing as not being able to maintain it at all.
• 15:08
  SPEAKER_01: Now, do you want to be a maintainer of Caliber Micro?
• 15:11
  SPEAKER_01: Probably not, but you would have been equivalent of that if you had decided that you're gonna take on an MVVM by yourself.
• 15:20
  SPEAKER_01: So there's a balance to be hit here.
• 15:23
  SPEAKER_01: It's if you are adamant about something in on one extreme or the other, I disagree with you.
• 15:30
  SPEAKER_01: There's a balance.
• 15:32
  SPEAKER_01: So can you easily do it yourself?
• 15:35
  SPEAKER_01: Is it the main focus of your application?
• 15:38
  SPEAKER_01: And are there security concerns?
• 15:40
  SPEAKER_01: Those are the three things that I recommend you think through while evaluating if you want to add something to your application.
• 15:49
  SPEAKER_01: You may pass all of those and still say, you know, I don't want to add this.
• 15:54
  SPEAKER_01: And that's okay.
• 15:55
  SPEAKER_01: But I want you to think those things through and say, okay, you know, it's not what we mainly focus on.
• 16:04
  SPEAKER_01: So maybe we should bring a library in to help us.
• 16:07
  SPEAKER_01: Or we don't want to deal with all the work it's gonna take to maintain this, or this deals with some cure security stuff.
• 16:15
  SPEAKER_01: It's encryption or it's you know, hashing or something like that.
• 16:19
  SPEAKER_01: I don't want to touch that, and that's where we're gonna go third party.
• 16:23
  SPEAKER_01: So those are the things I think through.
• 16:25
  SPEAKER_01: I encourage you to think though those things through yourself.
• 16:28
  SPEAKER_01: And again, maintain that balance.
• 16:30
  SPEAKER_01: Don't skew too far one way or the other.
• 16:33
  SPEAKER_01: So thanks for asking the question, Korky.
• 16:36
  SPEAKER_01: If you would like your question answered, either leave a comment below the YouTube video for this episode or go to I Am Tim Corey, go to the podcast page and leave the comment there.
• 16:48
  SPEAKER_01: Now, I would love for you to share this episode.
• 16:52
  SPEAKER_01: If you found it valuable, I'm sure others will as well.
• 16:55
  SPEAKER_01: I'd love for you to share us out with your social network and let them know they can get their dev questions answered as well here.
• 17:04
  SPEAKER_01: Thanks for listening.
• 17:05
  SPEAKER_01: As always, I am Tim Corey.
• 17:07
  SPEAKER_00: Thank you for joining us for this episode of Dev Questions.
• 17:10
  SPEAKER_00: Tim is committed to making it easier for you to become a developer.
• 17:14
  SPEAKER_00: If you would like to help make more content like this possible, please like, subscribe, rate, and share Dev Questions.
• 17:21
  SPEAKER_00: You can also send your questions to questions at IamTimcore.com.
• 17:26
  SPEAKER_00: Until next time, remember, you are too smart and your time too valuable to waste it making all the mistakes Tim did.
• 17:33
  SPEAKER_00: When you're ready to learn to think and code like a professional developer, head over to IamtimCore.com and enroll in a course.