I'd love a specific counter-example. I've never in my life encountered a sysadmin who read all or even part of the source code of any major package before deploying it. I mean, do you read the source code of the Linux kernel, PostgreSQL, nginx, OpenSSL, ... before installing it?

If Basel requires that level of auditing, I'd love to see a cite. There are some pretty heavy-handed regulations out there, but this would be clearly unworkable.

Given the context, it's probably a bad idea to name employers, but I've literally never seen this happen at any company I worked for, and I did consulting, so that's quite a few.

I wonder what laws you're referring to that requires companies to have read the innards of products they deploy.

Even the "getting a support contract from someone who does". Do you think for example Red Hat has read every single line of code shipped in RHEL?

I've worked in the USA, UK and Australia.

I've never seen what you describe. And one of the companies is a huge multinational.

Which laws are you referring to? Is this a strange interpretation of Sarbanes-Oxley or HIPAA?

I'd be interested to hear if you have an example of a company that did read the source code of apps. used?

Also which law do you think they would be breaking by not reading the source code of products used?