Auditing Open Source Security Apps

Hi HN, there's been a few posts about auditing OSS security/encryption apps.

I'm wondering though - how do we verify that the code we see on Github is the same code running live on a webserver?

Sure, you could ask for a "hash" but the webserver could fake it.

How do you prove what code is running on a remote machine?

I'm sure there's a proper name for this kind of problem..