Gemini version available ♊︎

The ISO Delusion: How Sirius Picked Collaboration/Communication Tools That Harm Staff, Harm the Company, and Harm Its Clients

Posted in Deception, Free/Libre Software, ISO at 9:13 pm by Dr. Roy Schestowitz

International Organization for Standardization (ISO) brag

Summary: Sirius ‘Open Source’ has long misused "ISO" to do all sorts of dubious things, including cover-up and frustration of staff; the time has come to explain what happened and maybe eventually report the matter to ISO itself

THOSE who have followed this series carefully enough know that pretty much all the communication tools of Sirius ‘Open Source’ had been outsourced to proprietary vendors (voice, text etc.) without bothering to ask staff, which complained only after the fact. Too late. It’s a decree, not a proposal. Instead of self-hosting Asterisk and relying on Jabber (among other things) the company was sending its workflow to Google, Zoom, Slack (Salesforce) and even Skype (Microsoft) while publicly floating ISO logos.

Over the coming week or so we’ll show this ugly façade of a company that still uses the term “Open Source” — a thing that it is rejecting internally. It’s not about doing what clients require; this is about what the company chooses for itself, as it’s headed by managers who neither use nor support Open Source. It’s a façade.

“It’s not about doing what clients require; this is about what the company chooses for itself, as it’s headed by managers who neither use nor support Open Source.”The Office Manager will be a recurring theme here, as she was part of this façade. What is an Office Manager anyway when the company does not have an actual office? David Graeber’s thesis would classify it as a ‘bullshit job’ [1, 2], probably the “box tickers” kind. To quote Wikipedia, we deal here with “box tickers, who create the appearance that something useful is being done when it is not, e.g., survey administrators, in-house magazine journalists, corporate compliance officers, quality service managers…”

As noted here right from the start (a day after resignation), the company was hardly compliant with anything sensible, including security and ethics. Last year I was asked to study logs for some anti-abortion group (without telling me where those logs had come from). What next? Would I be getting assigned jobs like checking logs for Oath Keepers or Proud Boys, seeing that anti-abortion groups were starting paying for “services” last year? (Off the record)

Anyway, yesterday this good article mentioned LastPass, another company that the stubborn new management decided to hand over to not only our own passwords but clients’ too (even private keys!!!), insisting that according to LastPass the LastPass breach wasn’t a big deal. Sirius did not even bother resetting passwords after I had repeatedly urged for this to be done (and, as a possible bonus, to dump LastPass altogether). In yesterday’s article the author says: “I’d like to talk about some of my experiences with this topic, as well as recent events in the security community.”

“Before I describe my experience,” he says, “I need to set the stage. My LastPass fun took place around the same time as the infamous Bugcrowd incident with JSBN.”

Watch how LastPass handled things: “My first step in esclating was security.txt. No dice. There was no clear security officer or contact information that I could discern from my social network either, so I chose the path of last resort: I contacted their support team.”

“Hiring friends and relatives instead of qualified people leads to disaster.”So it’s more or less like Sirius. No wonder a client said the company was “incompetent”. The client said this to a highly incompetent ‘manager’ who was never supposed to be there in the first place: No clue about technology or about management, just some associate from a former organisation in which a Sirius ‘founder’ had spent a few years. Hiring friends and relatives instead of qualified people leads to disaster.

Very basic security practices were often disregarded and staff was ignored in spite of technical background. It was like talking to the wall.

At first we had Asterisk internally; then someone decided it would be better to use some outside firm as a supplier and pay the fees. That was still a lot better than a move to a defective “service” and then purchase “phones” that are a security threat, in the hope (likely false hope) that it would ‘fix’ the issue. We’ll come to that another day.

The management kept covering up for repeated failure/s, blaming the staff (victims) instead, never the decision-makers who introduced a faulty/defective alternative but are too vain to admit it, take the blame, and finally undo.

“The management kept covering up for repeated failure/s, blaming the staff (victims) instead, never the decision-makers who introduced a faulty/defective alternative but are too vain to admit it, take the blame, and finally undo.”The company’s obscene disregard for security would not end there. We’ve already covered cognition reports being stored on personal machines, then uploaded to AWS (not the client’s servers). There was no longer any security protocol in place; no file server for them or for us (GDPR would be screaming!), set aside the fact that the company is no longer “open source” and is basically lying about it. It’s more like bragging about ISO while gaslighting people who actually value security.

Not only did the company ignore the warnings from me, it didn’t even change passwords, alter providers, or self-host an actual “Open Source” alternative. It kept saying it would (or merely consider this), but those were lies. As we mentioned here before, this wasn’t a matter of practicality of cost-savings either; Sirius was getting huge bills for “clown computing” (idle almost all the time but the bills kept growing and growing). Any suggestion of self-hosting, i.e. like before, was dismissed as “hobbyist” by the CEO. So what is to be sold as a service by Sirius? Outsourcing? Well, the company’s latest incarnation in LinkedIn does say that.

Tomorrow we’ll show some examples of misuse of the company’s pretences (ISO, GDPR etc.) for cover-up, censorship etc.

In the meantime, however, consider this E-mail from July 2019 (when the company was setting up a shell in the US, covertly, when signing an NDA with the Gates Foundation):

xxxx wrote on 17/07/2019 17:20:
> Hello Roy,
> As you are aware we’re currently going through the process of
> implementing ISO 27001 (information security management system). It’s
> been brought to our attention that you using xxxxx Slack is
> unacceptable due to the security of password sharing amongst yourselves.
> During your meeting at the training workshop – I had asked for you to
> reconsider as this is a company requirement.
> Moving forward and with the advice from the ISO company this is now
> something which needs to be completed by the end of your shift this
> evening. Slack is an essential communication tool used by everyone
> within the company.
> Would you please confirm the receipt of this email and a reply to this
> request.


Currently, all our sensitive communications end up on the server of a large corporation in another country, where this data can get sold. It included NHS stuff. This too is a problem as we need to be Open Source not only in name and I’ve been waiting for xxxxx to set up Matrix or similar for me to join. It has been months and I think it’s essential for our company to demonstrate it takes security seriously. I can set up an Open Source alternative myself if that helps.


Of course I only received more threats for this, rather than be listened to. Of course “information security” and Slack are incompatible concepts. As we shall revisit shortly, let’s just say Slack suffered yet another data breach shortly thereafter, vindicating me. Did the management listen? Did it react? Of course not.

After some more threats I was compelled to give up, at least temporarily:

xxxx wrote:
> Hello Roy,
> As I have expressed in my previous email and in all communication that
> Slack is an essential communication tool used by everyone within the
> company at the moment. We all should be there.
> This is a direct management requirement and instruction and it needs to
> be implemented immediately.

I have just created the Slack account.

It would still be useful to know the timeline for moving to an Open Source alternatives. Slack has no business model other than spying at the moment, as media repeatedly points out.


Regarding “I’ve been waiting for xxxxx to set up Matrix or similar for me to join,” I was receiving false promises from the CEO, naming two people who would set up a Free software alternative like Riot/Mattermost. One of them left the company (as I had previously warned the manager) and another never implemented the change. Sirius management was just lying all along.

“Now, after so many years, Sirius is another disgrace or a black eye to ISO.”We’ll revisit Slack another day and we shall deal with each of these blunders in turn. ISO is a joke if it grants certification to companies which behave in this way, set aside how superficial the requirements are. 15 years ago Microsoft bribed a lot of firms and organisations to rig ISO; and ISO, in turn, was OK with it. Now, after so many years, Sirius is another disgrace or a black eye to ISO. No wonder clients suffered security breaches. They weren’t even informed of how poorly Sirius had handled/managed security.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New

  1. Links 31/03/2023: Ruby 3.2.2 and Linux Lite 6.4

    Links for the day

  2. Links 31/03/2023: Devices and Games, Mostly Leftovers

    Links for the day

  3. IRC Proceedings: Thursday, March 30, 2023

    IRC logs for Thursday, March 30, 2023

  4. Links 31/03/2023: Ubuntu 23.04 Beta, Donald Trump Indicted, and Finland’s NATO Bid Progresses

    Links for the day

  5. Translating the Lies of António Campinos (EPO)

    António Campinos has read a lousy script full of holes and some of the more notorious EPO talking points; we respond below

  6. [Meme] Too Many Fake European Patents? So Start Fake European Courts for Patents.

    António Campinos, who sent EPO money to Belarus, insists that the EPO is doing well; nothing could be further from the truth and EPO corruption is actively threatening the EU (or its legitimacy)

  7. Thomas Magenheim-Hörmann in RedaktionsNetzwerk Deutschland About Declining Quality and Declining Validity of European Patents (for EPO and Illegal Kangaroo Courts)

    Companies are not celebrating the “production line” culture fostered by EPO management, which is neither qualified for the job nor wants to adhere to the law (it's intentionally inflating a bubble)

  8. Links 30/03/2023: HowTos and Political News

    Links for the day

  9. Links 30/03/2023: LibreOffice 7.5.2 and Linux 6.2.9

    Links for the day

  10. Links 30/03/2023: WordPress 6.2 “Dolphy” and OpenMandriva ROME 23.03

    Links for the day

  11. Sirius is Britain’s Most Respected and Best Established Open Source Business, According to Sirius Itself, So Why Defraud the Staff?

    Following today's part about the crimes of Sirius ‘Open Source’ another video seemed to be well overdue (those installments used to be daily); the video above explains to relevance to Techrights and how workers feel about being cheated by a company that presents itself as “Open Source” even to some of the highest and most prestigious public institutions in the UK

  12. IRC Proceedings: Wednesday, March 29, 2023

    IRC logs for Wednesday, March 29, 2023

  13. [Meme] Waiting for Standard Life to Deal With Pension Fraud

    The crimes of Sirius ‘Open Source’ were concealed with the authoritative name of Standard Life, combined with official papers from Standard Life itself; why does Standard Life drag its heels when questioned about this matter since the start of this year?

  14. Former Staff of Sirius Open Source Responds to Revelations About the Company's Crimes

    Crimes committed by the company that I left months ago are coming to light; today we share some reactions from other former staff (without naming anybody)

  15. Among Users in the World's Largest Population, Microsoft is the 1%

    A sobering look at India shows that Microsoft lost control of the country (Windows slipped to 16% market share while GNU/Linux grew a lot; Bing is minuscule; Edge fell to 1.01% and now approaches “decimal point” territories)

  16. In One City Alone Microsoft Fired Almost 3,000 Workers This Year (We're Still in March)

    You can tell a company isn’t doing well when amid mass layoffs it pays endless money to the media — not to actual workers — in order for this media to go crazy over buzzwords, chaffbots, and other vapourware (as if the company is a market leader and has a future for shareholders to look forward to, even if claims are exaggerated and there’s no business model)

  17. Links 29/03/2023: InfluxDB FDW 2.0.0 and Erosion of Human Rights

    Links for the day

  18. Links 29/03/2023: Parted 3.5.28 and Blender 3.5

    Links for the day

  19. Links 29/03/2023: New Finnix and EasyOS Kirkstone 5.2

    Links for the day

  20. IRC Proceedings: Tuesday, March 28, 2023

    IRC logs for Tuesday, March 28, 2023

  21. [Meme] Fraud Seems Standard to Standard Life

    Sirius ‘Open Source’ has embezzled and defrauded staff; now it is being protected (delaying and stonewalling tactics) by those who helped facilitate the robbery

  22. 3 Months to Progress Pension Fraud Investigations in the United Kingdom

    Based on our experiences and findings, one simply cannot rely on pension providers to take fraud seriously (we’ve been working as a group on this); all they want is the money and risk does not seem to bother them, even when there’s an actual crime associated with pension-related activities

  23. 36,000 Soon

    Techrights is still growing; in WordPress alone (not the entire site) we’re fast approaching 36,000 posts; in Gemini it’s almost 45,500 pages and our IRC community turns 15 soon

  24. Contrary to What Bribed (by Microsoft) Media Keeps Saying, Bing is in a Freefall and Bing Staff is Being Laid Off (No, Chatbots Are Not Search and Do Not Substitute Web Pages!)

    Chatbots/chaffbot media noise (chaff) needs to be disregarded; Microsoft has no solid search strategy, just lots and lots of layoffs that never end this year (Microsoft distracts shareholders with chaffbot hype/vapourware each time a wave of layoffs starts, giving financial incentives for publishers to not even mention these; right now it’s GitHub again, with NDAs signed to hide that it is happening)

  25. Full RMS Talk ('A Tour of Malicious Software') Uploaded 10 Hours Ago

    The talk is entitled "A tour of malicious software, with a typical cell phone as example." Richard Stallman is speaking about the free software movement and your freedom. His speech is nontechnical. The talk was given on March 17, 2023 in Somerville, MA.

  26. Links 28/03/2023: KPhotoAlbum 5.10.0 and QSoas 3.2

    Links for the day

  27. The Rumours Were Right: Many More Microsoft Layoffs This Week, Another Round of GitHub Layoffs

    Another round of GitHub layoffs (not the first [1, 2]; won’t be the last) and many more Microsoft layoffs; this isn’t related to the numbers disclosed by Microsoft back in January, but Microsoft uses or misuses NDAs to hide what’s truly going on

  28. All of Microsoft's Strategic Areas Have Layoffs This Year

    Microsoft’s supposedly strategic/future areas — gaming (trying to debt-load or offload debt to other companies), so-called ‘security’, “clown computing” (Azure), and “Hey Hi” (chaffbots etc.) — have all had layoffs this year; it’s clear that the company is having a serious existential crisis in spite of Trump’s and Biden’s bailouts (a wave of layoffs every month this year) and is just bluffing/stuffing the media with chaffbots cruft (puff pieces/misinformation) to keep shareholders distracted, asking them for patience and faking demand for the chaffbots (whilst laying off Bing staff, too)

  29. Links 28/03/2023: Pitivi 2023.03 is Out, Yet More Microsoft Layoffs (Now in Israel)

    Links for the day

  30. IRC Proceedings: Monday, March 27, 2023

    IRC logs for Monday, March 27, 2023

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts