Bonum Certa Men Certa

Sirius ‘Open Source’ Misleading the International Organization for Standardization (ISO) on Security

What if ISO knew the truth?

International Organization for Standardization (ISO) brag



Summary: There are no proper and truly compliance-driven procedures that are being followed, actively used, or even vaguely specified by poor leadership at Sirius ‘Open Source’; it's all improvised, hugely deficient, not even remotely compliant, and changes are sometimes made retroactively due to lapses and mistakes (compliance or merely appearance thereof, albeit only "after the act"); eventually there are attempts to shoot the messengers -- those who have actually cautioned about those concerning things for several years already

THE "Conclusion" part of the report (a document we'll publish tomorrow as PDF) is included at the bottom of this post. Worry not, it's not the end of the series, only the end of this report; we have plenty left to show and to explain after that. We're eager to show to the world what Sirius ‘Open Source’ Inc./Limited/Corporation truly is.



"We're eager to show to the world what Sirius ‘Open Source’ Inc./Limited/Corporation truly is."As a teaser of sorts, consider how poorly the company was handling data and information. It was getting worse over time because skilled people were leaving the company, making way for the "Google is your friend" mantra. This aforementioned mantra was something along the lines of, "trust big companies", you can give them any data we have. Trust them, they're big! Sure, they also spy for a government.

Data of high-profile clients, both past and present, was naturally left scattered all over the place, sometimes even outside the country. And to give just one example (there are so many; some will be covered later this month and next month), colleagues have cognition reports and incremental/full load reports on local -- as in personal and offsite -- machines (this is indirectly related to patients' data) with no protocol or guidelines for removing these. There's potentially sensitive data on people's machines at home and we've already witnessed mistakes made by the clients themselves (like patients' names or similar data showing up by mistake/accident).

THIS SHOULD NEVER HAPPEN!

"There are serious ramifications for data protection and adherence to law..."In a saner world, everything would be uploaded to a firewalled file server located on the client's own network, accessible in some secure fashion, without the data ever leaving the network, not even metadata. But when a company like Sirius handles its E-mail via AWS and AWS is also the host of OTRS (ticketing), one is expected to just upload files to AWS and transmit the stuff over E-mail (i.e. open relays). No encryption. I was repeatedly told off for using PGP in my E-mails.

There are serious ramifications for data protection and adherence to law, as there are unpatched old machines and perhaps backups that contain such files -- a ticking time bomb. And even way after they're no longer a client (years later), the example above serves to show that the problem does not go away. Not even when the contract ends (or gets terminated).

"Clients simply come to assume the reputation earned in past decades persists to date."The sad reality is that the company, Sirius (so-called 'open source'), is terrified about clients finding out how reckless and incompetent the company gradually became. Clients simply come to assume the reputation earned in past decades persists to date. They're trusting a company run by a person divorced twice, whose kids refuse to even speak to him. How can deep trust be established with people who (if they get caught) simply pretend nothing bad happened and instead of apologising would rather get aggressive, even combative, to cover up the abuse?

The text below mentions ISO, security incidents, and then the company's attempts to shoot the messenger (who cautioned about those issues along with many other issues). The in-depth analysis of the witch-hunt will follow after this report is published in full (some time tomorrow).




Conclusion



To summarise, Sirius should simply admit out in the open: "we've deviated away from our mission," and moreover Sirius ignores warnings about security (ISO deserves to know about phonies and posers at security).

Roy internally cautioned about this several times over the years. Later, when some providers suffers security breaches (as Roy predicted) Sirius neither reset the passwords nor left the compromised providers.

To reiterate what was stated at the start, what's alleged here is factually correct and evidence-backed. No URLs are provided, but URLs can be provided shall they be requested. Brevity still matters and much remains to be told.

In regards to the weak accusations leveraged to avoid paying compensation to Roy and Rianne, here again is the gist of the underlying issue/s:

1. no due process 2. no evidence presented (or claims merely alluded to without context/link) 3. gross accusation inflation 4. guilt by association (identical letter, too) 5. the company has a history doing this to couples, e.g. one blind colleague based in Germany; it was very serious and it went to court (cost the company or its Directors -- the founder and his wife -- a lot of money, went on for a long time, settled at the end)

The document is far from complete. Roy and Rianne have documents, have screenshots, links to official documents from Companies House etc.

Recent Techrights' Posts

Unlike GAFAM, Free Software Serves You, It Does Not Serve Governments and MElons (Overlapping Forces)
Tired of oligarchy controlling your life through gadgets and "apps"?
When It Comes to Social Control Media, Linus Torvalds is Channeling Techrights
GAFAM workers know exactly who to aim at
New EPO Paper: Promoting (Rewarding) People Who Grant Many Illegal European Patents to Make More Money (at Europeans' Expense) While Patent Courts in the EU Are Themselves Illegal
now the coup is sort of complete and even the "courts" are part of the corruption
Slopwatch: Carnival of LLM Slop and FUD Spewed by Bots, Pasted in by MaKenna Hensley and Day
Welcome to the Web in 2025. Articles about "Linux", "Security", and the Web (e.g. "Firefox") are fake.
Links 07/02/2025: Amazon’s Stock Collapses and US Government Being Dismantled (Still)
Links for the day
 
Links 08/02/2025: MElon Coup, Mass Layoffs at Facebook, and PlayStation Network Down
Links for the day
On Wars Against Founders
We need to insist that founders remain
Links 08/02/2025: News Corp Admits Traffic Declines, Wildlife Trafficking Tackled
Links for the day
Gemini Links 08/02/2025: Lamp and Notions
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, February 07, 2025
IRC logs for Friday, February 07, 2025
Gemini Links 07/02/2025: Mid-level Details and Simple Code
Links for the day
Links 07/02/2025: US 'Demolition Crew', e-ID Loopholes, and Sanctions
Links for the day
Professor Eben Moglen on How Social Control Media Metabolises Humans and Constrains Freedom of Thought
Nothing of value would be lost if all these data-harvesting giants (profiling people) vanished overnight
Social Control Media is Narcissism
Nowadays there's a lot more literature and even press coverage explaining the harms of Social Control Media
Debian Left Twitter (MElon "X"), We Think the Free Software Foundation (FSF) Should Do the Same
What would the FSF really lose if it stopped posting there?
statCounter Sees GNU/Linux Share Doubling in China Over the Past Year
It'll be interesting to see what data in the coming months shows
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, February 06, 2025
IRC logs for Thursday, February 06, 2025
Richard Stallman (RMS) Confirms Next Week's Talk in Europe
He gave at least 2 talks in Europe last month
Nationalism As A Service (NaaS) by Microsoft Azure, Gutting the US Government for Profit
Will Microsoft be receiving bailouts as a reward for all this?
Rumours of IBM Layoffs Apparently Confirmed Yesterday, IBM Canada Consulting Impacted (as Rumoured)
when IBM has layoffs we must also read it as Red Hat layoffs
Tons of Anti-Linux 'Articles' Published by Bots (LLMs), Maybe Microsoft's
Upon closer inspection, all this FUD turned out to be LLM garbage
Gemini Links 06/02/2025: Voicemail Sucks and Night of Lights
Links for the day
Ubuntu Desktop Director of Engineering Has Only One Blog Post. It Promotes Microsoft Windows.
Remember that even 15 years ago (more or less, maybe 16 years ago) Canonical appointed a a 'former' Microsoft manager (Spencer) to lead Ubuntu on the desktop
Links 06/02/2025: YouTube Takedowns Out of Control, 'DOGE' Breaking Laws
Links for the day
IBM Red Hat on "era of cloud computing", pushing "hey hi" (AI) hype in Microsoft Azure
LLM slop might actually be more benign than Microsoft promotion
Corruption and Rule-Breaking Prevail at the European Patent Office (EPO), Europe's Second-Largest Institution
The law does not really exist at the EPO; it can be perceived as merely a "recommendation"
statCounter: More Countries Where Windows is Around 1% "Market Share" (People Have Moved to Android/Linux)
in some nations Windows is already 1% or less
404 Media Says "Workers at NASA Told to Drop Everything to Scrub Mentions of Indigenous People, Women from Its Websites" But There's Also Accessibility in the Firing Line
In the case of abandoning accessibility, everyone stands to be hurt and proprietary software can be brought in to replace standards
When BetaNews Writes Real Articles About "Linux" They Promote Windows
The Web is in a bad state. We need to at least try to correct this.
Gemini Links 06/02/2025: Cynicism and "Real Magic on the C64"
Links for the day
Links 06/02/2025: New Sanctions, Layoffs, and Executive Orders
Links for the day
Distros and Desktop Environments, Devices
GNU/Linux focused
New Rumours of IBM Layoffs in 2025, IBM Consulting Still Struggles, Based on Management
"Hey hi" (AI) has been a common excuse for business failure
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, February 05, 2025
IRC logs for Wednesday, February 05, 2025