Bonum Certa Men Certa

The ISO Delusion: How Sirius Picked Collaboration/Communication Tools That Harm Staff, Harm the Company, and Harm Its Clients

International Organization for Standardization (ISO) brag



Summary: Sirius 'Open Source' has long misused "ISO" to do all sorts of dubious things, including cover-up and frustration of staff; the time has come to explain what happened and maybe eventually report the matter to ISO itself

THOSE who have followed this series carefully enough know that pretty much all the communication tools of Sirius 'Open Source' had been outsourced to proprietary vendors (voice, text etc.) without bothering to ask staff, which complained only after the fact. Too late. It's a decree, not a proposal. Instead of self-hosting Asterisk and relying on Jabber (among other things) the company was sending its workflow to Google, Zoom, Slack (Salesforce) and even Skype (Microsoft) while publicly floating ISO logos.



Over the coming week or so we'll show this ugly façade of a company that still uses the term "Open Source" -- a thing that it is rejecting internally. It's not about doing what clients require; this is about what the company chooses for itself, as it's headed by managers who neither use nor support Open Source. It's a façade.

"It's not about doing what clients require; this is about what the company chooses for itself, as it's headed by managers who neither use nor support Open Source."The Office Manager will be a recurring theme here, as she was part of this façade. What is an Office Manager anyway when the company does not have an actual office? David Graeber's thesis would classify it as a 'bullshit job' [1, 2], probably the "box tickers" kind. To quote Wikipedia, we deal here with "box tickers, who create the appearance that something useful is being done when it is not, e.g., survey administrators, in-house magazine journalists, corporate compliance officers, quality service managers..."

As noted here right from the start (a day after resignation), the company was hardly compliant with anything sensible, including security and ethics. Last year I was asked to study logs for some anti-abortion group (without telling me where those logs had come from). What next? Would I be getting assigned jobs like checking logs for Oath Keepers or Proud Boys, seeing that anti-abortion groups were starting paying for "services" last year? (Off the record)

Anyway, yesterday this good article mentioned LastPass, another company that the stubborn new management decided to hand over to not only our own passwords but clients' too (even private keys!!!), insisting that according to LastPass the LastPass breach wasn't a big deal. Sirius did not even bother resetting passwords after I had repeatedly urged for this to be done (and, as a possible bonus, to dump LastPass altogether). In yesterday's article the author says: "I’d like to talk about some of my experiences with this topic, as well as recent events in the security community."

"Before I describe my experience," he says, "I need to set the stage. My LastPass fun took place around the same time as the infamous Bugcrowd incident with JSBN."

Watch how LastPass handled things: "My first step in esclating was security.txt. No dice. There was no clear security officer or contact information that I could discern from my social network either, so I chose the path of last resort: I contacted their support team."

"Hiring friends and relatives instead of qualified people leads to disaster."So it's more or less like Sirius. No wonder a client said the company was "incompetent". The client said this to a highly incompetent 'manager' who was never supposed to be there in the first place: No clue about technology or about management, just some associate from a former organisation in which a Sirius 'founder' had spent a few years. Hiring friends and relatives instead of qualified people leads to disaster.

Very basic security practices were often disregarded and staff was ignored in spite of technical background. It was like talking to the wall.

At first we had Asterisk internally; then someone decided it would be better to use some outside firm as a supplier and pay the fees. That was still a lot better than a move to a defective "service" and then purchase "phones" that are a security threat, in the hope (likely false hope) that it would 'fix' the issue. We'll come to that another day.

The management kept covering up for repeated failure/s, blaming the staff (victims) instead, never the decision-makers who introduced a faulty/defective alternative but are too vain to admit it, take the blame, and finally undo.

"The management kept covering up for repeated failure/s, blaming the staff (victims) instead, never the decision-makers who introduced a faulty/defective alternative but are too vain to admit it, take the blame, and finally undo."The company's obscene disregard for security would not end there. We've already covered cognition reports being stored on personal machines, then uploaded to AWS (not the client's servers). There was no longer any security protocol in place; no file server for them or for us (GDPR would be screaming!), set aside the fact that the company is no longer "open source" and is basically lying about it. It's more like bragging about ISO while gaslighting people who actually value security.

Not only did the company ignore the warnings from me, it didn't even change passwords, alter providers, or self-host an actual "Open Source" alternative. It kept saying it would (or merely consider this), but those were lies. As we mentioned here before, this wasn't a matter of practicality of cost-savings either; Sirius was getting huge bills for "clown computing" (idle almost all the time but the bills kept growing and growing). Any suggestion of self-hosting, i.e. like before, was dismissed as "hobbyist" by the CEO. So what is to be sold as a service by Sirius? Outsourcing? Well, the company's latest incarnation in LinkedIn does say that.

Tomorrow we'll show some examples of misuse of the company's pretences (ISO, GDPR etc.) for cover-up, censorship etc.

In the meantime, however, consider this E-mail from July 2019 (when the company was setting up a shell in the US, covertly, when signing an NDA with the Gates Foundation):

xxxx wrote on 17/07/2019 17:20: > Hello Roy, > > As you are aware we’re currently going through the process of > implementing ISO 27001 (information security management system). It's > been brought to our attention that you using xxxxx Slack is > unacceptable due to the security of password sharing amongst yourselves. > > During your meeting at the training workshop - I had asked for you to > reconsider as this is a company requirement. > > Moving forward and with the advice from the ISO company this is now > something which needs to be completed by the end of your shift this > evening. Slack is an essential communication tool used by everyone > within the company. > > Would you please confirm the receipt of this email and a reply to this > request.

Hi,

Currently, all our sensitive communications end up on the server of a large corporation in another country, where this data can get sold. It included NHS stuff. This too is a problem as we need to be Open Source not only in name and I've been waiting for xxxxx to set up Matrix or similar for me to join. It has been months and I think it's essential for our company to demonstrate it takes security seriously. I can set up an Open Source alternative myself if that helps.

Regards,


Of course I only received more threats for this, rather than be listened to. Of course "information security" and Slack are incompatible concepts. As we shall revisit shortly, let's just say Slack suffered yet another data breach shortly thereafter, vindicating me. Did the management listen? Did it react? Of course not.

After some more threats I was compelled to give up, at least temporarily:

xxxx wrote: > Hello Roy, > > As I have expressed in my previous email and in all communication that > Slack is an essential communication tool used by everyone within the > company at the moment. We all should be there. > > This is a direct management requirement and instruction and it needs to > be implemented immediately.

I have just created the Slack account.

It would still be useful to know the timeline for moving to an Open Source alternatives. Slack has no business model other than spying at the moment, as media repeatedly points out.

Regards,


Regarding "I've been waiting for xxxxx to set up Matrix or similar for me to join," I was receiving false promises from the CEO, naming two people who would set up a Free software alternative like Riot/Mattermost. One of them left the company (as I had previously warned the manager) and another never implemented the change. Sirius management was just lying all along.

"Now, after so many years, Sirius is another disgrace or a black eye to ISO."We'll revisit Slack another day and we shall deal with each of these blunders in turn. ISO is a joke if it grants certification to companies which behave in this way, set aside how superficial the requirements are. 15 years ago Microsoft bribed a lot of firms and organisations to rig ISO; and ISO, in turn, was OK with it. Now, after so many years, Sirius is another disgrace or a black eye to ISO. No wonder clients suffered security breaches. They weren't even informed of how poorly Sirius had handled/managed security.

Recent Techrights' Posts

[Video] Microsoft's Attack on Education
Microsoft's cult-like activities and overt entryism
Microsoft Windows Used to Have Nearly 100% in China and Now Google Has 50% (With Android)
Will China bring about a faster "fall" for Microsoft?
GNU/Linux Growing Worldwide (the Story So Far!)
Microsoft is unable to stop GNU/Linux
Red Hat Loves Microsoft Monopoly (and Proprietary Surveillance With Back Doors)
full posting history in RedHat.com
 
Nigeria: Windows Down to 6%, Android at All-Time High of 77%
Google is becoming the "new monopoly" in some places
[Meme] Money In, No Money Out (Granting Loads of Invalid European Patents)
EPO production?
Staff Representation at the EPO Has Just Explained to Heads of Delegations (National Delegates) Why the EPO's Financial Study is Another Hoax
Here we are again 5 years later
Canonical and Red Hat Are Not Competing With Microsoft Anymore
What a shame they hired so many people from Microsoft...
Links 21/05/2024: "Hating Apple Goes Mainstream", Lots of Coverage About Julian Assange Ruling
Links for the day
Gemini Links 21/05/2024: Losing Fats and Modern XMPP
Links for the day
Pursuing a Case With No Prospects (Because It's "Funny")
the perpetrators are taking a firm that's considered notorious
GNU/Linux in Honduras: From 0.28% to 6%
Honduras remains somewhat of a hotspot
Good News From Manchester and London, Plus High Productivity in Techrights
what has happened and what's coming
[Video] The 'Linux' Foundation Cannot be Repaired Anymore (It Sold Out)
We might need to accept that the Linux Foundation lost its way
Links 21/05/2024: Tesla Layoffs and Further Free Speech Perils Online
Links for the day
Gemini Links 21/05/2024: New Gemini Reader and Gemini Games
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, May 20, 2024
IRC logs for Monday, May 20, 2024
[Video] Just Let Julian Assange Go Back to Australia
Assange needs to be freed
Microsoft-Connected Sites Trying to Shift Attention Away From Microsoft's Megabreach Only Days Before Important If Not Unprecedented Grilling by the US Government?
Why does the mainstream media not entertain the possibility a lot of these talking points are directed out of Redmond?
The WWW declares the end of Google
Reprinted with permission from Cyber|Show
Gemini Links 20/05/2024: CMSs and Lua "Post to midnight.pub" Script Alternative
Links for the day
Windows Has Fallen Below 5% in Iraq, GNU/Linux Surged Beyond 7% Based on statCounter's Stats
Must be something going on!
Brodie Robertson - Never Criticise The Linux Foundation Expenses (With Transcript)
Transcript included
Links 20/05/2024: Protests and Aggression by Beijing
Links for the day
Can an election campaign succeed without social media accounts?
Reprinted with permission from Daniel Pocock
Read "Google Is Not What It Seems" by Julian Assange
In this extract from his new book When Google Met Wikileaks, WikiLeaks' publisher Julian Assange describes the special relationship between Google, Hillary Clinton and the State Department -- and what that means for the future of the internet
Fact check: relation to Julian Assange, founded Wikileaks at University of Melbourne and Arjen Kamphuis
Reprinted with permission from Daniel Pocock
Julian Assange: Factual Timeline From an Online Friend
a friend's account
Breaking News: Assange Wins Right to Challenge Extradition to the US
This is great news, but maybe the full legal text will reveal some caveat
Gambia: Windows Down to 5% Overall, 50% on Desktops/Laptops
Windows was measured at 94% in 2015
Links 20/05/2024: Microsoft Layoffs and Shutdowns, RTO as Silent Layoffs
Links for the day
The Issue With Junk Traffic in Geminispace (Gemini Protocol)
Some people have openly complained that their capsule was getting hammered by bot
Peter Eckersley, Laura Smyth & the rushed closure of dial-up Internet in Australian universities
Reprinted with permission from Daniel Pocock
Brittany Day, Plagiarist in Chief (Chatbot Slinger)
3 articles in the front page of LXer.com right now are chatbot spew
Guardian Digital, Inc (linuxsecurity.com) Has Resorted to Plagiarism by Chatbots, Flooding the World Wide Web With Fake 'Articles' Wrongly Attributed to Brittany Day
busted
[Meme] Bullying the Victims
IBM: crybully of the year 2024
Ian.Community Should be Safer From Trademark Censorship
We wish to discuss this matter very quickly
Microsoft and Its Vicious Attack Dogs (Attacking Women or Wives in Particular)
Sad, pathetic, destructive people
Upcoming Series About the Campaign to 'Disappear' the Father of GNU/Linux
Today we have Julian Assange's fate to focus on
A Month From Now Gemini Protocol Turns 5
June 20
Colombia: From Less Than 0.5% to Nearly 4% for GNU/Linux
it's not limited to this one country
Rumour: Well Overdue Red Hat Layoffs to be Announced in About 3 Days
we know they've planned the layoffs for a while
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, May 19, 2024
IRC logs for Sunday, May 19, 2024
Gemini Links 20/05/2024: Updated Noto Fontpacks and gemfeed2atom
Links for the day
GNU/Linux in Georgia: Looking Good
Windows down from 99% to less than 33%
Tomorrow is a Historic Day for Press Freedom in the UK
Take note of the Julian Assange case
Hiding in a Forest Without a Phone and Hiding Behind the First Amendment in the United States (US)
some serial defamer is trying to invert the narrative
Links 19/05/2024: Iran's President Lost in Helicopter Crash, WikiLeaks’ Julian Assange Awaits Decisions in Less Than a Day
Links for the day
Links 19/05/2024: Microsoft Investigated in Europe
Links for the day
4 Old Articles About Microsoft/IBM SystemD
old but still relevant
Firefox Has Fallen to 2% in New Zealand
At around 2%, at least in the US (2% or below this threshold), there's no longer an obligation to test sites for any Gecko-based browser
Winning Streak
Free software prevalence
Links 19/05/2024: Conflicts, The Press, and Spotify Lawsuit
Links for the day
GNU/Linux+ChromeOS at Over 7% in New Zealand
It's also the home of several prominent GNU/Linux advocates
libera.chat (Libera Chat) Turns 3 Today
Freenode in the meantime continues to disintegrate
[Teaser] Freenode NDA Expires in a Few Weeks (What Really Happened 3 Years Ago)
get ready
GNU/Linux is Already Mainstream, But Microsoft is Still Trying to Sabotage That With Illegal Activities and Malicious Campaigns of Lies
To help GNU/Linux grow we'll need to tackle tough issues and recognise Microsoft is a vicious obstacle
Slovenia's Adoption of GNU/Linux in 2024
Whatever the factor/s may be, if these figures are true, then it's something to keep an eye on in the future
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, May 18, 2024
IRC logs for Saturday, May 18, 2024
Links 19/05/2024: Profectus Beta 1.2
Links for the day