Tuesday, December 20th, 2022, 4:35 pm
In Sirius Open Source You Get Told Off — and Even Threatened! — for Minding Security and Privacy
Filed under: 
Summary: The Sirius ‘Open Source’ management made the decision (without any consultation with the staff affected) to outsource key operations to foreign, third-party entities that are subjected to the US government’s prying eyes and several of the National Security Agency’s programs; this affected clients as well (usually without their awareness, let alone consent)
THIS is the last part of the third section of a report I left with the company before leaving at the start of this month. There will be a lot more information about this scandal next month. Recent E-mails are appended below (with certain stuff redacted for privacy’s sake).
I cautioned about this repeatedly (for about 4 years) and suffered retribution, threats, and more. Nothing has improved since then.
As just a little sample, please see the E-mails at the bottom (recent); shared in the future will be some longer E-mails about this issue.
But first… the report.
The morale around that time was low, set aside COVID-19 becoming a growing problem, along with lock-downs. Roy noted that in order to comply with the law he cannot post clients’ details on the Slack network. So he chose to obey the regulations and the law, in line with security standards. Stuff like “hi” is probably considered OK and safe enough for Slack, but not addresses, passwords etc. Things have not improved since, as the final section notes again (with examples).
This long section, along with written messages as evidence, is very important. Bad leadership worsened the corporate climate and changed how people viewed the company from within, if not from the outside as well.
This document now proceeds to a discussion about the latest and maybe the final blow. The company already had capacity issues (not enough staff to cover shifts) and now it’s even worse.
Roy and Rianne hoped to prevent a ‘death spiral’ and ironically enough it seems like the company wants to accelerate its own ‘death spiral’, due to tactless, insensitive remarks.
One of many messages to that effect — messages which I was sending for years to highlight the problem. Of course nothing was done about this; usually there was not even as much as a reply. Hush hush as a company-wide policy…
This one is from August of this year:
Date: Tue, 30 Aug 2022 09:00:50 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050317 Thunderbird/1.0.2 Mnenhy/0.7.4.0 From: Roy Schestowitz Subject: Handover to Shift 2 (30/08/22) To: [whole team] [...] https://www.darkreading.com/cloud/lastpass-data-breach-source-code-stolen users need to change all the passwords they have there and not keep them there if they value real security not paper mills.
Another one from August of this year:
Date: Thu, 11 Aug 2022 03:10:53 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050317 Thunderbird/1.0.2 Mnenhy/0.7.4.0 Content-Language: en-US From: Roy Schestowitz Subject: Slack admits to leaking hashed passwords for five years To: [whole team] Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit https://nakedsecurity.sophos.com/2022/08/08/slack-admits-to-leaking-hashed-passwords-for-three-months/ Does not surprise me at all. They only admit this because they got caught, hence they need to spin this somehow, belittling the severity, just as LastPass did after several blunders (it had suffered a breach). The way forward is self-hosting and encrypting things (on server one controls, not leasing).
