Bonum Certa Men Certa

The ISO Delusion: How Sirius Picked Collaboration/Communication Tools That Harm Staff, Harm the Company, and Harm Its Clients

International Organization for Standardization (ISO) brag



Summary: Sirius 'Open Source' has long misused "ISO" to do all sorts of dubious things, including cover-up and frustration of staff; the time has come to explain what happened and maybe eventually report the matter to ISO itself

THOSE who have followed this series carefully enough know that pretty much all the communication tools of Sirius 'Open Source' had been outsourced to proprietary vendors (voice, text etc.) without bothering to ask staff, which complained only after the fact. Too late. It's a decree, not a proposal. Instead of self-hosting Asterisk and relying on Jabber (among other things) the company was sending its workflow to Google, Zoom, Slack (Salesforce) and even Skype (Microsoft) while publicly floating ISO logos.



Over the coming week or so we'll show this ugly façade of a company that still uses the term "Open Source" -- a thing that it is rejecting internally. It's not about doing what clients require; this is about what the company chooses for itself, as it's headed by managers who neither use nor support Open Source. It's a façade.

"It's not about doing what clients require; this is about what the company chooses for itself, as it's headed by managers who neither use nor support Open Source."The Office Manager will be a recurring theme here, as she was part of this façade. What is an Office Manager anyway when the company does not have an actual office? David Graeber's thesis would classify it as a 'bullshit job' [1, 2], probably the "box tickers" kind. To quote Wikipedia, we deal here with "box tickers, who create the appearance that something useful is being done when it is not, e.g., survey administrators, in-house magazine journalists, corporate compliance officers, quality service managers..."

As noted here right from the start (a day after resignation), the company was hardly compliant with anything sensible, including security and ethics. Last year I was asked to study logs for some anti-abortion group (without telling me where those logs had come from). What next? Would I be getting assigned jobs like checking logs for Oath Keepers or Proud Boys, seeing that anti-abortion groups were starting paying for "services" last year? (Off the record)

Anyway, yesterday this good article mentioned LastPass, another company that the stubborn new management decided to hand over to not only our own passwords but clients' too (even private keys!!!), insisting that according to LastPass the LastPass breach wasn't a big deal. Sirius did not even bother resetting passwords after I had repeatedly urged for this to be done (and, as a possible bonus, to dump LastPass altogether). In yesterday's article the author says: "I’d like to talk about some of my experiences with this topic, as well as recent events in the security community."

"Before I describe my experience," he says, "I need to set the stage. My LastPass fun took place around the same time as the infamous Bugcrowd incident with JSBN."

Watch how LastPass handled things: "My first step in esclating was security.txt. No dice. There was no clear security officer or contact information that I could discern from my social network either, so I chose the path of last resort: I contacted their support team."

"Hiring friends and relatives instead of qualified people leads to disaster."So it's more or less like Sirius. No wonder a client said the company was "incompetent". The client said this to a highly incompetent 'manager' who was never supposed to be there in the first place: No clue about technology or about management, just some associate from a former organisation in which a Sirius 'founder' had spent a few years. Hiring friends and relatives instead of qualified people leads to disaster.

Very basic security practices were often disregarded and staff was ignored in spite of technical background. It was like talking to the wall.

At first we had Asterisk internally; then someone decided it would be better to use some outside firm as a supplier and pay the fees. That was still a lot better than a move to a defective "service" and then purchase "phones" that are a security threat, in the hope (likely false hope) that it would 'fix' the issue. We'll come to that another day.

The management kept covering up for repeated failure/s, blaming the staff (victims) instead, never the decision-makers who introduced a faulty/defective alternative but are too vain to admit it, take the blame, and finally undo.

"The management kept covering up for repeated failure/s, blaming the staff (victims) instead, never the decision-makers who introduced a faulty/defective alternative but are too vain to admit it, take the blame, and finally undo."The company's obscene disregard for security would not end there. We've already covered cognition reports being stored on personal machines, then uploaded to AWS (not the client's servers). There was no longer any security protocol in place; no file server for them or for us (GDPR would be screaming!), set aside the fact that the company is no longer "open source" and is basically lying about it. It's more like bragging about ISO while gaslighting people who actually value security.

Not only did the company ignore the warnings from me, it didn't even change passwords, alter providers, or self-host an actual "Open Source" alternative. It kept saying it would (or merely consider this), but those were lies. As we mentioned here before, this wasn't a matter of practicality of cost-savings either; Sirius was getting huge bills for "clown computing" (idle almost all the time but the bills kept growing and growing). Any suggestion of self-hosting, i.e. like before, was dismissed as "hobbyist" by the CEO. So what is to be sold as a service by Sirius? Outsourcing? Well, the company's latest incarnation in LinkedIn does say that.

Tomorrow we'll show some examples of misuse of the company's pretences (ISO, GDPR etc.) for cover-up, censorship etc.

In the meantime, however, consider this E-mail from July 2019 (when the company was setting up a shell in the US, covertly, when signing an NDA with the Gates Foundation):

xxxx wrote on 17/07/2019 17:20: > Hello Roy, > > As you are aware we’re currently going through the process of > implementing ISO 27001 (information security management system). It's > been brought to our attention that you using xxxxx Slack is > unacceptable due to the security of password sharing amongst yourselves. > > During your meeting at the training workshop - I had asked for you to > reconsider as this is a company requirement. > > Moving forward and with the advice from the ISO company this is now > something which needs to be completed by the end of your shift this > evening. Slack is an essential communication tool used by everyone > within the company. > > Would you please confirm the receipt of this email and a reply to this > request.

Hi,

Currently, all our sensitive communications end up on the server of a large corporation in another country, where this data can get sold. It included NHS stuff. This too is a problem as we need to be Open Source not only in name and I've been waiting for xxxxx to set up Matrix or similar for me to join. It has been months and I think it's essential for our company to demonstrate it takes security seriously. I can set up an Open Source alternative myself if that helps.

Regards,


Of course I only received more threats for this, rather than be listened to. Of course "information security" and Slack are incompatible concepts. As we shall revisit shortly, let's just say Slack suffered yet another data breach shortly thereafter, vindicating me. Did the management listen? Did it react? Of course not.

After some more threats I was compelled to give up, at least temporarily:

xxxx wrote: > Hello Roy, > > As I have expressed in my previous email and in all communication that > Slack is an essential communication tool used by everyone within the > company at the moment. We all should be there. > > This is a direct management requirement and instruction and it needs to > be implemented immediately.

I have just created the Slack account.

It would still be useful to know the timeline for moving to an Open Source alternatives. Slack has no business model other than spying at the moment, as media repeatedly points out.

Regards,


Regarding "I've been waiting for xxxxx to set up Matrix or similar for me to join," I was receiving false promises from the CEO, naming two people who would set up a Free software alternative like Riot/Mattermost. One of them left the company (as I had previously warned the manager) and another never implemented the change. Sirius management was just lying all along.

"Now, after so many years, Sirius is another disgrace or a black eye to ISO."We'll revisit Slack another day and we shall deal with each of these blunders in turn. ISO is a joke if it grants certification to companies which behave in this way, set aside how superficial the requirements are. 15 years ago Microsoft bribed a lot of firms and organisations to rig ISO; and ISO, in turn, was OK with it. Now, after so many years, Sirius is another disgrace or a black eye to ISO. No wonder clients suffered security breaches. They weren't even informed of how poorly Sirius had handled/managed security.

Recent Techrights' Posts

Even Microsoft (MSN) Covers Richard Stallman's Public Talk in Milan 2 Days Ago
He spoke in Spanish earlier this month (Alicante)
Very High Attendance Level at Richard Stallman's Talk Shows People Can Relate to His Message
Smear campaigns have their limits
 
Links 28/05/2025: 'Emulation Layers' (Measurements and Linguistics), Libraries, and Discomfort
Links for the day
Links 28/05/2025: More Arrests for Bitcoin-Connected Torture and Prosecutions for Dieselgate-Linked Executives
Links for the day
Gemini Links 28/05/2025: Techo-authoritarianism With Slop Plagiarism and "No Online June" (Going Offline)
Links for the day
Links 28/05/2025: GitHub MCP Exploited and MathWorks Discovers Huge Windows TCO
Links for the day
Microsofters Were Scheming to Take Over This Entire Web Site (in Their Own Words!)
Money gets spent censoring/deplatforming people who speak about real issues; no money gets spent actually tackling those underlying issues
Gemini Links 28/05/2025: Celsius-Fahrenheit, Endless Scrolling/Infinite Scrolling, and Trapping LLM Slop Bots
Links for the day
Bicycles for the Minds and the Story Harrison Bergeron
"The goal of having people in charge of the tools they use and that the tools should amplify ability" has long been abandoned
Prison gate backdrop to baptism by Fr Sean O'Connell, St Paul's, Coburg
Reprinted with permission from Daniel Pocock
More Photos From This Week's Milan Talk by Richard Stallman
The posts are in Italian, not English
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, May 27, 2025
IRC logs for Tuesday, May 27, 2025
Links 27/05/2025: Science Defunded, India Arrests an Academic
Links for the day
Gemini Links 27/05/2025: From Celsius to Fahrenheit and Deleting Social Control Media
Links for the day
Microsofters Have, in Effect, Attempted Extrajudicial Action Against Us
Courts and Judges (or Masters) don't exist to facilitate this kind of "bro" culture
UK High Court Masters Are Not Your Jesters, Microsoft
Judges aren't there for "funny" spectacles, they're there to act as arbiters in critical cases, not SLAPPs
Links 27/05/2025: Mass Layoffs at Volvo and More Evidence of 'AI' (Slop) Being a Passing Fad
Links for the day
The Code of Conduct (CoC) Gaslighting Phenomenon
There are still many people and projects foolish enough to outsource their labour to Microsoft via GitHub
They're Very Jealous of Richard Stallman and His Freedom (or Simple Lifestyle)
Jealousy is toxic because it can cause rational people to act irrationally and even severely harm themselves
Akira Urushibata on GNU coreutils
new message
Anouk Rozestraten (Deputy Director) Appears to Have Left the Free Software Foundation
Let's hope Rozestraten is still using and promoting Free software
There's Nothing Funny About Lawbreaking
There's plenty of room in society for humour, but "hacking" the state by breaking laws isn't cool or hip
More Mass Layoffs Coming Soon to Microsoft, Just a Question of When and How Many
Numbers from Washington were close to 5% and judging by prior rumours, it would be 5% + 5% (total 10%) at a later month
Links 27/05/2025: Bikes, Ideal Computers, and BYO
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, May 26, 2025
IRC logs for Monday, May 26, 2025
Richard Stallman's Milan Talk (Public Presentation) Was Packed, Video Available Soon
Looks like they even ran out of seats
Gemini Links 26/05/2025: Intangible Stuff and Slop Issues
Links for the day
The Openwashing Shills Initiative (OSI) - Part I: Complaints to IRS or USDOJ Needed
If enough people do it, this will be more effective, more so if people who are based in the US do it
Open Source Initiative (OSI) Lobbying and the OSI's Status at Stake
At the end we plan to summarise all the issues in one very long article
Breaking Into Other People's Devices Without Authorisation Isn't "Funny" or "Research"
“Chaos was the law of nature; order was the dream of man.”
The Issue Isn't the Internet, the Issue is How People Are Taught to Use or Misuse It
The Web is circling down the drain. The Internet is not.
A Healed Reputation of a Movement's Leader and His Robust Message
The more aggressively you push against resistors, the more credibility they will gain
Links 26/05/2025: Deletions from Microsoft's GitHub, Telegram Blocked in Vietnam
Links for the day
Linux Released Last Night and There's Already LLM Slop With Slop Images
BetaNoise does not seem to mind this anymore
Links 26/05/2025: Walmart Layoffs and DRM Dumpster Fire ('Old' Fire TV Devices Lose Netflix Access)
Links for the day
Gemini Links 26/05/2025: USB Camera Viewer and Fantasy Life
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, May 25, 2025
IRC logs for Sunday, May 25, 2025