Phase 4 of 5  ·  Modern Engineering
Week 14 / 20   ·   Ch 15

Software
Reuse

"How npm changed software engineering — and the risks nobody told you about"

📚 Ch 15 — Software Reuse📦 npm / PyPI / Maven⚠️ Dependency Risks⏱ ~20 min read

🔍Concept Deep Dives

Click each concept to expand — real examples, diagrams, pros & cons.

📦

Benefits of Reuse

Faster delivery, lower cost, battle-tested code, reduced risk.

When to Use

Almost always — ask 'does this already exist?' before building.

Real-World Example

Building auth? Use Passport.js. Need payments? Stripe SDK. Need ML? scikit-learn. Time saved: weeks.

✓ Advantages

  • Faster time to market
  • Lower development cost
  • Proven, tested functionality

⚠ Watch Out

  • Must evaluate before trusting
  • License considerations
  • Version management overhead
Build vs. reuse — the speed trade-off
8 wksBuild from scratch
2 daysOpen-source library
4 hrsSaaS (Auth0, Stripe)
Choose based on the control-vs-speed trade-off.
⚠️

Reuse Risks

Dependency hell, supply chain attacks, license conflicts, obsolescence.

When to Use

Before adding any dependency — evaluate the risk.

Real-World Example

Log4Shell (2021): one vulnerability in a logging library (log4j) affected millions of systems worldwide.

✓ Advantages

  • Understanding risks lets you mitigate them

⚠ Watch Out

  • Transitive dependencies: npm install adds thousands of packages
  • Abandonware risk
Supply-chain risk — real incidents
1left-pad (2016) — 11 lines, 2.5M npm downloads/day; its removal broke builds worldwide
2Log4Shell (2021) — one log4j flaw, CVSS 10, exposed millions of systems
Always audit and pin your dependencies.
🏗️

Application Frameworks

Frameworks provide reusable architecture + infrastructure for a class of applications.

When to Use

Starting any new application in a well-known domain (web, mobile, ML).

Real-World Example

Django provides: ORM, auth, admin, migrations, templating — you provide the business logic.

✓ Advantages

  • Architectural guidance built in
  • Convention over configuration
  • Large community

⚠ Watch Out

  • Framework lock-in
  • Framework updates can break your code
  • Opinionated = less flexibility
Framework vs. your code — who provides what
Framework provides
  • Skeleton structure
  • Common utilities
  • Extension points
You provide
  • Business logic
  • Custom components
🔄

Software Product Lines

A family of related software products sharing a common architecture and components.

When to Use

When building multiple variants of the same product for different customers/markets.

Real-World Example

Android: core OS + customized by Samsung, Xiaomi, OnePlus with different features per market.

✓ Advantages

  • Systematic reuse across products
  • Economies of scale
  • Consistent quality

⚠ Watch Out

  • Upfront investment in platform
  • Governance overhead
Software product line — one core, many products
Core Platform (shared)
Product AConfig A
Product BConfig B
Product CConfig C
Same core, different configurations — like Android customized by each manufacturer.

📋Quick Reference

θ Ch 15 Cheat Sheet — Software Reuse
Reuse Benefits
Faster, cheaper, proven code. Always ask: does this already exist?
Dependency Hell
Conflicting transitive dependencies. Use lockfiles (package-lock.json) and audit regularly.
Supply Chain Attack
Malicious code injected via dependencies. log4shell, event-stream, ua-parser-js.
Framework
Provides architecture + utilities. You fill in business logic. Convention over configuration.
COTS
Commercial off-the-shelf software. Configurable, not customizable. ERP, CRM systems.
Product Line
Family of related products sharing common architecture. Systematic reuse at scale.
License
Check before using: MIT (permissive), GPL (copyleft), Apache 2.0 (permissive + patent).
θ
Sommerville's Key Points — Ch 15
Author's own summary from the end of the chapter.
  • 1Software reuse: using existing software components rather than building from scratch.
  • 2Benefits: lower costs, faster delivery, proven reliability.
  • 3Risks: dependency hell, supply chain attacks, license issues, obsolescence.
  • 4Generators of reuse: libraries, frameworks, COTS, services (SaaS/APIs).
  • 5Application frameworks: reusable software infrastructure defining system architecture.
  • 6Software product lines: family of related systems sharing common architecture.

🌍From the Book & Beyond

📖

Case Study — One Product Line, Three Emergency Services

Sommerville's flagship product-line example is a vehicle dispatching system for emergency services: one generic resource-management core, marketed to police, fire, and ambulance services. The four-layer architecture — interaction, I/O management, resource management, database — stays fixed while components get specialized per customer. And the differences are real: police forces have a large number of vehicles but relatively few vehicle types, while fire services have many specialized vehicle types but fewer vehicles — so even the vehicle database structure has to change. New instances start from the closest family member, not from scratch, and requirements get renegotiated to minimize changes to the base application.

2026 Perspective — Reuse at Planetary Scale

Sommerville notes that systematic reuse was uncommon "until around 2000." In 2026, reuse is the default: npm hosts millions of JavaScript packages, PyPI hundreds of thousands for Python, and a typical web app contains far more third-party code than code its own team wrote. That flips the chapter's cost table — "finding, understanding, and adapting components" is nearly free now — but dependency risk exploded: one compromised or abandoned package can break or backdoor thousands of products. Hence SBOMs (software bills of materials), increasingly demanded by regulators and enterprise buyers, plus automated dependency scanners in every CI pipeline. The reuse benefits were real; so were the problems.

🧠Quiz — Test Yourself

Think through your answer first, then reveal.

Q1
Recall
What is a supply chain attack? Give a real example.
A supply chain attack compromises a software dependency to attack the systems that use it. Example: Log4Shell (2021) — a vulnerability in the log4j Java logging library (CVSS 9.3) allowed remote code execution. Used by millions of systems. One open-source library, global impact.
Q2
Apply
What is the difference between a library and a framework?
Library: you call it (inversion of control is yours). You use the library's functions when you need them. Example: requests library in Python. Framework: it calls you (Hollywood Principle: 'Don't call us, we'll call you'). You fill in the extension points. Example: Django — it handles the HTTP request cycle, you write the view functions.
Q3
Analyze
Why might you choose to build something from scratch instead of reusing an existing library?
When: library doesn't exist. Existing libraries have prohibitive licenses (GPL when you need commercial). Security-critical component where you need full control. Library has too many transitive dependencies. Your requirements are so specific that adapting a library costs more than building. Performance requirements the library can't meet.
Up Next → Week 15
Component-Based Engineering
Lego-style software — what component-based engineering really means
Continue → Week 15