Bonum Certa Men Certa

The ISO Train Wreck at Sirius 'Open Source'

International Organization for Standardization (ISO) brag



Summary: Before we proceed to showing how Sirius 'Open Source' blatantly ignored security and privacy we wish to show how ISO (see ISO wiki) basically 'sold' a certificate to Sirius -- this is like a "diploma mill" but something that's for businesses, not individuals

THIS is today's second article on this topic. We've found some spare time for faster progression and in-depth coverage. As I noted yesterday, my wife had more direct and indirect experience (decades ago) with ISO being a bunch of meaningless hooey. So did I (having stumbled upon classical 'box tickers' or worse). Sirius is just another reminder of that. Hence this series and its relevance. It seems like a lot of people in technical fields separately and independently reached the conclusion that ISO is overhyped, overvalued, and mostly a waste of time and money (unless you have a 'bullshit job' to justify).



"This isn't science. It's like calling "economics" a science. It is not. It's more like religion.""My dad complained about the ISO in the 90s," Ryan said in IRC an hour or so ago. "He constantly made fun of all of their "standards" for management of a company that didn't mean anything but go on and on. It's a sort of code so that managers sound smarter than they are. "We're ISO-Whatever compliant with our handling of the TPS reports." And the ISO standards can be wrong and never revised. Microsoft implemented the standard for MP3 and so did LAME, and then the result was they were both correct and Windows XP crashed. Part of the standard about what constituted the maximum size for a frame could be calculated one of two ways.Microsoft chose the more constrained way and it resulted in a buffer overflow with some files that crashed Windows Media Player. LAME had chosen the method that resulted in a slightly larger permissible frame size. The outcome was LAME had to be changed to use the Microsoft calculation to avoid crashing Windows, and that meant a reduction in audio quality under some circumstances, with padded bytes instead of data. Later, they changed to use the VBR bit allocator, even in a CBR file, and it mostly avoids the situation by its method of action. It can cleverly use the bit reservoir in ways that the former bit allocator that was only for CBR files couldn't. Naturally, they never delete anything, so you can still demand the old model. It's just an absolute nightmare of options switches. It's the worst thing I've ever seen in a utility its size. ISO is kind of the stuff of Pointy Haired Bosses when it comes to Management Theory being standardized."

Well, this whole "Management Theory" is what we're dealing with here.

This isn't science. It's like calling "economics" a science. It is not. It's more like religion.

Here's what happened in Sirius (in mostly logical/chronological order):

Subject: ISO Date: Mon, 29 Jul 2019 15:47:43 +0100 From: xxxx To: xxxx

Hey All,

As you know we are going through the ISO processes - I have been asked to gather some information from everyone at Sirius to create a list of all assets used by employees of Sirius whether it belong to the company or the employee so if I can have the item name and serial number that would be great. They have also asked which anti virus you all use.

Are you all able to send me the required information ASAP please?

Thanks,

xxxx


Yes, because a bunch of serial numbers would mean so much! Of people devices at home... for the most part.

"They would nag us to do the same 'course' every year, even though it is dumb and we 'passed' it already."A month later came "You have been registered for a Training course - Information Security" (no, not really security but this hoax instead). We'll deal with that another day...

They would nag us to do the same 'course' every year, even though it is dumb and we 'passed' it already. This is compliance???



"This is something that will be done annually for our ISO process," I was told, "so please complete this on your next shift."



Way to waste people's time, doing and passing a total hoax over and over again (details on why it's a hoax were covered here before).



Notice the threats being sent to ALL staff:



Hi All,

As you will all be aware we have been implementing new policies and procedures in order to become ISO 9001 and ISO 27001 compliant. Part of this entailed changing our HR company to xxxx who use the online portal Atlas to provide an easier method to roll out training. I have checked and there is still a substantial amount that has still not been completed.

ALL training sent out by myself needs to be passed and completed by the _*25th November 2019*_. This is to ensure we meet our deadline for the final stage of ISO audits.

Failure to comply with this request may result in disciplinary action. For those of you that have completed the training, please ignore this message and thank you.

Kind Regards,

xxxx


"Failure to comply with this request may result in disciplinary action," it says. They kept making veiled and explicit threats. Sometimes this culminated in actual bullying, false accusations, and blame-shifting witch-hunts.

Of course the portals failed to even work properly. For instance:

> ALL training sent out by myself needs to be passed and completed by the > _*25th November 2019*_. This is to ensure we meet our deadline for the > final stage of ISO audits.

I was able to open all the documents and read them. The animated things, or training sessions, get stuck. I tried each one of them about 5 times (>each<) and they get stuck somewhere along the way. I tried this on multiple machines. Rianne told she too had some difficulties.

I will try again on my next shift, but these technical issues do merit a mention. They also rely on plugins Adobe no longer supports, posing security risk (an issue aside from the bugs).

Kind regards,

[Roy]


Her answer was: "Have you tried using a different web browser?"

Of course she wasn't using GNU/Linux or anything "Open Source". This does not constitute an actual solution.

In 2020 the following was sent:

-------- Forwarded Message -------- Subject: xxxx - Things to do Date: Thu, 26 Nov 2020 11:38:01 +0000 From: xxxx To: xxxx CC: xxxx

Hi All,

In October I issued Linux Training via xxxx. Can you all please ‘acknowledge’ this on your portal to show that you have opened and read it.

I also need you to ensure ALL training modules issued on xxxx i.e information security and documents issued i.e IMS Awareness presentation have been completed by the end of your next shift.

It is essential these tasks are carried out prior to our ISO Audit next week.

Kind Regards,


Well, those training modules and ISO guidelines weren't even followed by Sirius. We gave examples of this before. In some cases, there were efforts to meet standards only after a certificate had been granted.

Sheesh. I'm not supposed to say this in public, am I?

What did those audits mean anyway? What did the above "ISO Audit" actually check? That the cookie drawer is properly locked when Office staff goes to retrieve some hot chocolate milk from the machine?

"In the next few parts we'll show what Sirius did in practice, not in theory, and what it told staff, not ISO auditors."Some other messages were banal. They indicated a certificate had been granted (in other words, Sirius basically bought one) after minimal so-called 'audits' and staff sending a bunch of numbers from the back of computers (as if that means anything at all).

ISO is a joke. When it comes to this administrivia, ISO created just another 'cash cow' for itself.

In the next few parts we'll show what Sirius did in practice, not in theory, and what it told staff, not ISO auditors. It's one heck of a clusterf**k with the company's data scattered all over the place. That includes clients' data, even private keys and passwords.

Recent Techrights' Posts

Links 01/06/2025: "Vibe Coding" Turns Out to be a Fraud and Amazon Merits Boycott, Argue Bloggers
Links for the day
Gemini Links 01/06/2025: "Stardust" and Ideal PC Setup
Links for the day
Links 01/06/2025: Windows TCO, Openwashing, "It's FOSS" Still Promoting Microsoft
Links for the day
Gemini Links 01/06/2025: Simplification and Networks Everywhere
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, May 31, 2025
IRC logs for Saturday, May 31, 2025
Google Bribes EFF. EFF Promotes LLM Slop as 'Fair Use'. To GAFAM It's a Low-Cost Lobby Hedge.
So the bribes pay off ("slush fund") and the word spreads
Slopwatch: Fake Text and Images, Financial Bubbles, and Scams in "Intelligent" Clothing
Sometimes what they mean by "AI" is just cheap labour somewhere else, as we discussed in IRC a few hours ago
Why Microsoft is Collapsing (Similar to What's Happening at IBM), As Insiders See It
IBM seems like one heck of a mess
Reliable Computing Means Free (Libre) Computing
Sites that want to promote security ought to deal with the biggest issues
Links 31/05/2025: US Court Orders Sides With RFE/RL, War Updates From Ukraine
Links for the day
Gemini Links 31/05/2025: ARM Server and power_supply Subsystem
Links for the day
Links 31/05/2025: Slop Stigmatised as Disinformation, Catalyst/Driver of "Death of Communication"
Links for the day
Common Sense 101: Do Not Write Blog Posts Saying You Want to Murder Colleagues (or Yourself)
Only crazy people would think stabbings are a joke
Microsoft Bankruptcy
"Microsoft unit in Russia to file for bankruptcy, database shows"
Techrights Does Not Compete With LLM Slop, It Exposes the Bastards, Plagiarists and Scammers Who Do That
People like Scam Altman, still facing a lawsuit from his own sister for sexual abuse against her
Links 31/05/2025: Microsoft-Connected Builder.ai is a Fraud and US is Purging Students Based on Race/Nationality
Links for the day
Gemini Links 30/05/2025: Limmat, Doomscrollers, and Arguments Parsing
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, May 30, 2025
IRC logs for Friday, May 30, 2025
The "AI" (Slop) Bubble Already Popped, But It's Not an Overnight Collapse
where Microsoft put its money
No More Steven Astorino at IBM, Chatter About Weekly/Nonstop Layoffs at IBM
What happened? Good luck guessing.
Looking at Corruption in Europe, Going Beyond the EPO
Expect a new series to kick off very soon
Slopwatch: Security SPAM and LLM Slop for SEO and FUD Purposes, Perpetually Tarnishing the Perception of Linux and (Open)SSH Security
A lot of this Fear, Uncertainty, Doubt (FUD) comes from Microsoft and its LLMs
Links 30/05/2025: Google's LLM Slop Pushers Are Killing Journalism and Shira Perlmutter Fails to Stop Bribed Regime From Legalising Plagiarism (in "AI" Clothing)
Links for the day
Links 30/05/2025: Offline Arts and "Threshold of Patience"
Links for the day
Signing Off Serious Lies With a Statement of Truth is No Joking Matter
It's not hard to see what's happening here
Links 30/05/2025: LLM Slop Already Ingests and Vomits Its Own Garbage, Facebook Exec Admits Copyrights a Concern Too
Links for the day
Mass Layoffs at Microsoft Result in More Whistleblowers From Microsoft
Microsoft's predatory pricing is further
Slopwatch: Planet Ubuntu Became LLM Slop and Some People Fail to See the Immorality of Plagiarism
it lessens the incentive for people to publish real articles
EPO Poll: 68% Dissatisfied With Quality of Slop (Wrongly Framed as "AI") for Patent Classification
Slop does not work, it's just falsely advertised with extra hype (funded by slop pushers that sponsor the major media)
Big Crowds Gather to Learn About Software Freedom From the Man Who Started GNU/Linux in 1983
"It was a great success"
Microsoft Layoffs Again in Bay Area
Microsoft relies on people's false belief that being "in LinkedIn" will get you a job; well, seems like even working inside LinkedIn really sucks and you lose the job
Gemini Links 30/05/2025: Fighting Against the Bad News, and Slop is Dehumanisation Disguised as "Intelligence"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, May 29, 2025
IRC logs for Thursday, May 29, 2025