Closed source software can still be audited using reverse engineering techniques such as static analysis (reading the disassembly) or dynamic analysis (using a debugger to walk through the assembly at runtime) or both.

How are you going to do that if it's software-as-a-service?

[–] DrJenkem@lemmy.blugatch.tube 13 points 1 year ago (2 children)

See the first bullet point. I was referring to any code that is distributed.

Yeah, there's no way to really audit code running on a remote server with the exception of fuzzing. Hell, even FOSS can't be properly audited on a remote server because you kind of have to trust that they're running the version of the source code they say they are.

[–] EuphoricPenguin22@normalcity.life 1 points 1 year ago (1 children)

You can always brute force the SSH login and take a look around yourself. If you leave an apology.txt file in /home, I'm sure the admin won't mind.

[–] DrJenkem@lemmy.blugatch.tube 1 points 1 year ago (1 children)

Lol, unlikely SSH is exposed to the net. You'll probably need an RCE in the service to pop a shell.

[–] EuphoricPenguin22@normalcity.life 1 points 1 year ago* (last edited 1 year ago)

That's not universally true, at least if you're not on the same LAN. For example, most small-scale apps hosted on VPSs are typically configured with a public-facing SSH login.

[–] theblueredditrefugee@lemmy.dbzer0.com 1 points 1 year ago

Ohhh, code that is distributed. The implication of that word flew over my head lmao, thanks for the clarification.