Bonum Certa Men Certa

Sirius Open SORES: There's a Lot More to Security and Privacy Than Namedropping (e.g. 'ISO' and 'GDPR')

Sirius certificate

Summary: In Sirius ‘Open Source’, neither Open Source nor security got taken seriously enough. Siriusly! And one cannot point this out to managers as this infuriates them (it harms a false perception they've long cultivated).

TODAY we turn our attention to bad security practices, including poor privacy and unbridled outsourcing of Sirius. There will be numerous parts about these aspects and we'll provide some examples in the future when dealing with proprietary software, introduced by the company itself while tearing down its very own Free software-based infrastructure (which had been put there when the company still had geeks in the office; heck, the company used to have an actual office!).



Suffice to say, patching is part of the work, including patching one's own machine. Anything else would be irrational (like blasting people over "commuting" time) because security starts in one's own domain. And yet, I was being told off by the company's founder for patching my PCs while I was on shift despite the fact that there are several such machines (if one encounters an error, then one can rely on another machine) and this is about actual security.

It took me a while to find E-mail regarding this, as it dates back nearly 4 years. My redacted response below:

I have just caught up with E-mail (resting and other things since 9am). Sorry for the delay in responding.

Roy,

I have read your shift’s handover notes where I find this from you:

"Quiet shift, so I took the time to update my whole system. Something broke nagstamon for me, briefly, but I managed to fix it. In the meantime I used the Nagios/Icinga Web interface.”


I use 3 laptops in parallel to do my job, so this was one in three and Nagios remains accessible regardless. nagstamon is an alternative to it (sound alerts) and I wanted to bring it up to date for security reasons. As I do often, to avoid breaches.

This is *absolutely unacceptable*.


If I cannot observe systems that are monitored and supported, it's not "unacceptable". It's still very much necessary. But still, looking back, there are many serious (Sirius) issues that were shared in the report below (more to come in the next parts).




Acronyms Lingo



Speaking of "GDPR" or "ISO" without even grasping the meaning behind laws and regulations is "cheap talk". Without comprehension of the issues, this boils down to 'name-dropping' (like "GDPR" or "ISO"). Currently, the company would gladly take technical advice from people who openly admit they don't care about privacy. So instead Sirius falls back onto formalities and processes rather than any real grasp of the underlying issues. Sirius track record will be demonstrable based on recommendations from past clients; with or from at least two clients we might only get an alarming reminder that their systems suffered a security breach while we supported them. The clients' names are, as usual, omitted here, but this is very well documented. There may have been more security incidents that were hidden or concealed both from clients and from Sirius staff. Considering the atmosphere of secrecy and hostility towards inquisitive staff, it seems likely more incidents occurred but weren't reported at all (or reported very selectively).

Speaking of formalities and processes rather than actual substance, the company Sirius was pursing ISO certification only amid some issues with NHS and its highly sensitive medical data -- including several incidents staff witnessed where people's (patients') privacy was accidentally compromised, either by Sirius or by the client (personally identifiable data divulged). To make matters worse, many times data was not being shredded like it was supposed to and the client complained. If better leadership was in place, this would not have happened, jeopardising the credibility of staff.

Account Management Practices and Data Sovereignty



With quite a lot of clients, and several can be vividly recalled, Sirius failed to remove access credentials (or accounts) for staff that had already left Sirius. 'Low level' staff cannot access systems at a level of user management, so this was demonstrably a 'high level' failure. Sometimes clients complained about such gross incompetence (if clients could even figure out who still works for Sirius; remember that Sirius misled them, as shall be noted again later) and potential security breach by former and possibly disgruntled Sirius staff, but nobody (as far as we know) was being held accountable. The aforementioned sections noted that accountability only ever works in this hypocritical and vertically-inconsistent fashion. Double standards became the new company standard, enshrined covertly but not formally. Managers never offered the courtesy of taking full responsibility. Too much pride to acknowledge mistake and lapses.

As the above shows, there are endemic problems caused by mismanagement or a lack of charismatic-yet-humble leadership (maladministration), maybe even a lack of staff that possesses ample experience managing a team of more than one person. These are very essential skills which mandate suitable recruitment. It may not be cheap, but it is vital.

Sirius has user credentials scattered all over the place, not all in OpenLDAP as done in the past (when more competent people managed the company's infrastructure). This will, inevitably, result in epic blunders. That keeps happening. Again and again. In fact, user credentials management at Sirius has been partly outsourced to third parties -- a taboo subject. No more GOsa, go USA (most data and authentication sent across the Atlantic).

The motivations seem petty, e.g. sharing accounts to save money despite clear security requirements that exist to explicitly not do this. Is ISO being treated as merely a box-ticking exercise, not followed up by any potent audits? If so, are we entitled to brag about some ISO compliance? Any time Roy attempted to bring up the subject the management became paranoid and threatening. This sort of resistance to ethical and moral objection would be strongly discouraged in companies capable of self-appraisal.

A colleague once mentioned in an E-mail that some colleagues may have needed to share an account with another person, all in the name of saving money. This kept happening for years despite such ISO requirements supposedly being fully in force. Account sharing was sometimes imperative, as individual accounts did not exist. In other words, all colleagues use the same username for some tasks; sometimes this was only belatedly addressed, partially and virtually post hoc.

Password management in the company has long been a painful affair. From non-secure connections to a lack of VPN for access to passwords the company moved to outsourcing. This was a case of "bad optics", pragmatic issues aside. Sirius could self-host similar software that was Free and Open Source software, but the company had a mindset of outsourcing almost everything to proprietary offerings from another country. As noted separately, Roy raised alarm over this several times, noting or pointing out actual data breaches of a very large scale, but no action was subsequently taken. The assurances were empty and arguably arrogant -- a refusal to listen to vigilant security experts who extensively covered those issues for decades. Asking a company itself whether it suffered a security breach and what the severity truly is like asking an American president what happened in the Oval Room.

Recent Techrights' Posts

Google 'Search' is Fast Becoming No Better Than Social Control Media Infested With Bots
Google emerged almost 30 years ago as a company looking to organise the Web and direct people towards informative pages. That Google is dead.
Before the OSI Was Bribed and Hijacked by Microsoft via GitHub and Compromised Management...
The OSI isn't even remotely "woke"
The OSI Has Been Silent for Over 3 Weeks, It Has a Severe Trust Issue After Promoting Microsoft and Proprietary GitHub
OSI took a lot of money from Microsoft to become a Microsoft lobbyist
Bribery is OK If You Work for Microsoft (No Punishment Expected)
It's very troubling and a symptom of a broken society/system when particular laws or rules are applied and enforced against some people but not against others
Someone Should Remind Microsoft Lunduke That Microsoft Hires Many Sexual Criminals and Pedophiles as Well
Microsoft Lunduke on an "expedition" to find one or more perverts, then generalise to everyone in the "community"
Cash Machines (ATMs) Make Mistakes and They're Proprietary Software
Correcting mistakes is a colossal challenge
 
Some People See What Others See... But Only 40 Years Later
When people deviate from "the norm" they typically get ridiculed and dismissed as "crazy"
Links 30/07/2025: Tea Class Action and Google Killing the Web With Slop
Links for the day
Last Month Our IRC Community Turned 17
Funnily enough we never missed a single day when it comes to logging
"The Unix Kernel"
Linux was inspired by MINIX
The Register Relays Microsoft Marketing, Dubs That Marketing "Research"
Hours ago they did a "Microsoft sez" piece
Dealing With Sociopaths, Liars, and Cranks
A dysfunctional society such as this would never develop
Not Owning Mobile Phones
It's not about resistance; it's common sense
PCLinuxOS Had Functional Backups Before the House Fire, the Site Will be Restored in New Webhost
This is the direction we want for GNU/Linux, not some IBM sales strategy
Gemini Links 30/07/2025: Two Sides of Me and "Hooked on Cosmic Voyage"
Links for the day
Microsoft Will Continue Resorting to Crimes in Order to Keep GNU/Linux Usage Down
It is a real problem and we'll revisit it later this week
GAFAM 'Revolving Doors' at The Register and a "Bribe Price List"
"an analyst at Microsoft"
Microsoft Rapidly Shrinking (No, It's Not About Efficiency, It's About Unbearable Debt)
We'll soon see how much debt grew in the past quarter
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 29, 2025
IRC logs for Tuesday, July 29, 2025
Corruption is the Standard Operating Procedure at the European Patent Office (EPO)
The EPO is a dictatorship that stains Europe
Local Staff Committee Munich (LSCMN) at the European Patent Office (EPO) Requests an Urgent Meeting to Avoid Abolishing the Office
This is dictatorship led by the most corrupt
Slopwatch: Fake 'Linux' 'Articles' and Spamfarms/Slopfarms
at least 5 fake articles in one day
Gemini Links 29/07/2025: Wayland Unfit for Use and LLM Slop Faking One's Language Skills With Robot Communications
Links for the day
Nailing the "Hey Hi" (AI) Hype Bubble
So-called "hey hi" as they define it now is all about large companies or regimes remotely controlling the processes running on your machine and even your very own behaviour on your machine, which is in effect no longer your machine but some remotely controlled apparatus
"Four decades; Four freedoms; For all users" Now as a T-shirt
That's shown along the sidebar
Links 29/07/2025: Bad Climate and "Fair Software Licensing" Blasts Microsoft
Links for the day
Links 29/07/2025: Data Brokers Gone Wrong/Rogue and "Copyright Thicket"
Links for the day
Slopwatch: Linuxconfig.org, Linuxsecurity.com, Fagioli, The Register
Today's "Slopwatch" isn't the first article about LLM slop
We Cover Topics Other Sites Are Too Afraid to Cover (Even When They Know the Facts)
It's not that they doubt the truth, they just realise there may be consequences for talking about it
They Try to Tell Us the Free Software Foundation Inc is Dying, But Its Revenue Doubled Since the Dot-Com Bubble Burst
Being in "Activism" is never easy; but it does positive things for society
Yes, Microsoft is the Problem
"I am no MS shill."
It's About the Cost of Workers, Not the Fictional Skills Shortage (That Does Not Exist, the Media Spreads False and Sometimes Self-Fulfilling Narratives)
This issue isn't limited to computing, some dub it "globalism"
Another Failed Use Case for Chatbots (LLM): Legal Advice and Analysis
They're just some self-discrediting toy that costs way too much to operate
Links 29/07/2025: More Pushbacks Against Slop and More Praises of Tom Lehrer
Links for the day
Gemini Links 29/07/2025: Purple Yarrow and Understanding Op Amps
Links for the day
This Monday WebProNews Absolutely Flooded the Web With Fake (LLM Slop) 'Articles' About "Linux", Google News Promoted Them as Legitimate
All of the following are fake articles attributed to pseudonyms or authors that don't exist; the images are also slop. Why does Google promote these?
Linuxiac is Not a Slopfarm, But at Least Some of Its Articles Are Machine-Generated Fakes
what we said about it was correct
Expect More Microsoft Layoffs
"Are more job cuts coming?"
Microsoft Behaving Like It's Running Out of Money to Pay Salaries
Does that seem like the behaviour expected from a company which claims it is "worth" trillions?
LWN Downtime Due to Linode, Not LLM Bots
"I’ve received an email letting me know that there is a potential for data loss."
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 28, 2025
IRC logs for Monday, July 28, 2025
Nonfree Software in My Bank, by Richard Stallman
Updated 8 hours ago
Links 28/07/2025: Science, Health, and Conflicts
Links for the day
Gemini Links 28/07/2025: Healthy Self-Image With Autism and a "New Life"
Links for the day
Links 28/07/2025: COVID-19 Sped up Brain Aging, "Circumvention is More Popular Than Compliance"
Links for the day
Richard Stallman is Usually Right Because He Thinks "Outside the Box"
he is able to observe society (mores and norms) as somewhat of an outsider
LWN Has Been Down for a Long Time, Another Casualty of LLM Bots?
Time will tell. How much time though?
Slopfarms Versus 'Linux' (and Against People Who Write Real Articles About GNU/Linux)
LLM slop in slopfarms by Brian Fagioli and Redazione RHC
Gemini Links 28/07/2025: Bila Yarrudhanggalangdhuray and Running pkgsrc in a FreeBSD Jail
Links for the day
Microsoft Turns News Sites Into Spamfarms
Is the site The Register MS the next IDG?
The Register MS/The Register US
On Saturday I contacted them for a comment (before issuing criticism)
Hacking revelations at Vatican Jubilee of Digital Missionaries
Reprinted with permission from Daniel Pocock
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, July 27, 2025
IRC logs for Sunday, July 27, 2025