Bonum Certa Men Certa

The ISO Train Wreck at Sirius 'Open Source'

International Organization for Standardization (ISO) brag



Summary: Before we proceed to showing how Sirius 'Open Source' blatantly ignored security and privacy we wish to show how ISO (see ISO wiki) basically 'sold' a certificate to Sirius -- this is like a "diploma mill" but something that's for businesses, not individuals

THIS is today's second article on this topic. We've found some spare time for faster progression and in-depth coverage. As I noted yesterday, my wife had more direct and indirect experience (decades ago) with ISO being a bunch of meaningless hooey. So did I (having stumbled upon classical 'box tickers' or worse). Sirius is just another reminder of that. Hence this series and its relevance. It seems like a lot of people in technical fields separately and independently reached the conclusion that ISO is overhyped, overvalued, and mostly a waste of time and money (unless you have a 'bullshit job' to justify).



"This isn't science. It's like calling "economics" a science. It is not. It's more like religion.""My dad complained about the ISO in the 90s," Ryan said in IRC an hour or so ago. "He constantly made fun of all of their "standards" for management of a company that didn't mean anything but go on and on. It's a sort of code so that managers sound smarter than they are. "We're ISO-Whatever compliant with our handling of the TPS reports." And the ISO standards can be wrong and never revised. Microsoft implemented the standard for MP3 and so did LAME, and then the result was they were both correct and Windows XP crashed. Part of the standard about what constituted the maximum size for a frame could be calculated one of two ways.Microsoft chose the more constrained way and it resulted in a buffer overflow with some files that crashed Windows Media Player. LAME had chosen the method that resulted in a slightly larger permissible frame size. The outcome was LAME had to be changed to use the Microsoft calculation to avoid crashing Windows, and that meant a reduction in audio quality under some circumstances, with padded bytes instead of data. Later, they changed to use the VBR bit allocator, even in a CBR file, and it mostly avoids the situation by its method of action. It can cleverly use the bit reservoir in ways that the former bit allocator that was only for CBR files couldn't. Naturally, they never delete anything, so you can still demand the old model. It's just an absolute nightmare of options switches. It's the worst thing I've ever seen in a utility its size. ISO is kind of the stuff of Pointy Haired Bosses when it comes to Management Theory being standardized."

Well, this whole "Management Theory" is what we're dealing with here.

This isn't science. It's like calling "economics" a science. It is not. It's more like religion.

Here's what happened in Sirius (in mostly logical/chronological order):

Subject: ISO Date: Mon, 29 Jul 2019 15:47:43 +0100 From: xxxx To: xxxx

Hey All,

As you know we are going through the ISO processes - I have been asked to gather some information from everyone at Sirius to create a list of all assets used by employees of Sirius whether it belong to the company or the employee so if I can have the item name and serial number that would be great. They have also asked which anti virus you all use.

Are you all able to send me the required information ASAP please?

Thanks,

xxxx


Yes, because a bunch of serial numbers would mean so much! Of people devices at home... for the most part.

"They would nag us to do the same 'course' every year, even though it is dumb and we 'passed' it already."A month later came "You have been registered for a Training course - Information Security" (no, not really security but this hoax instead). We'll deal with that another day...

They would nag us to do the same 'course' every year, even though it is dumb and we 'passed' it already. This is compliance???



"This is something that will be done annually for our ISO process," I was told, "so please complete this on your next shift."



Way to waste people's time, doing and passing a total hoax over and over again (details on why it's a hoax were covered here before).



Notice the threats being sent to ALL staff:



Hi All,

As you will all be aware we have been implementing new policies and procedures in order to become ISO 9001 and ISO 27001 compliant. Part of this entailed changing our HR company to xxxx who use the online portal Atlas to provide an easier method to roll out training. I have checked and there is still a substantial amount that has still not been completed.

ALL training sent out by myself needs to be passed and completed by the _*25th November 2019*_. This is to ensure we meet our deadline for the final stage of ISO audits.

Failure to comply with this request may result in disciplinary action. For those of you that have completed the training, please ignore this message and thank you.

Kind Regards,

xxxx


"Failure to comply with this request may result in disciplinary action," it says. They kept making veiled and explicit threats. Sometimes this culminated in actual bullying, false accusations, and blame-shifting witch-hunts.

Of course the portals failed to even work properly. For instance:

> ALL training sent out by myself needs to be passed and completed by the > _*25th November 2019*_. This is to ensure we meet our deadline for the > final stage of ISO audits.

I was able to open all the documents and read them. The animated things, or training sessions, get stuck. I tried each one of them about 5 times (>each<) and they get stuck somewhere along the way. I tried this on multiple machines. Rianne told she too had some difficulties.

I will try again on my next shift, but these technical issues do merit a mention. They also rely on plugins Adobe no longer supports, posing security risk (an issue aside from the bugs).

Kind regards,

[Roy]


Her answer was: "Have you tried using a different web browser?"

Of course she wasn't using GNU/Linux or anything "Open Source". This does not constitute an actual solution.

In 2020 the following was sent:

-------- Forwarded Message -------- Subject: xxxx - Things to do Date: Thu, 26 Nov 2020 11:38:01 +0000 From: xxxx To: xxxx CC: xxxx

Hi All,

In October I issued Linux Training via xxxx. Can you all please ‘acknowledge’ this on your portal to show that you have opened and read it.

I also need you to ensure ALL training modules issued on xxxx i.e information security and documents issued i.e IMS Awareness presentation have been completed by the end of your next shift.

It is essential these tasks are carried out prior to our ISO Audit next week.

Kind Regards,


Well, those training modules and ISO guidelines weren't even followed by Sirius. We gave examples of this before. In some cases, there were efforts to meet standards only after a certificate had been granted.

Sheesh. I'm not supposed to say this in public, am I?

What did those audits mean anyway? What did the above "ISO Audit" actually check? That the cookie drawer is properly locked when Office staff goes to retrieve some hot chocolate milk from the machine?

"In the next few parts we'll show what Sirius did in practice, not in theory, and what it told staff, not ISO auditors."Some other messages were banal. They indicated a certificate had been granted (in other words, Sirius basically bought one) after minimal so-called 'audits' and staff sending a bunch of numbers from the back of computers (as if that means anything at all).

ISO is a joke. When it comes to this administrivia, ISO created just another 'cash cow' for itself.

In the next few parts we'll show what Sirius did in practice, not in theory, and what it told staff, not ISO auditors. It's one heck of a clusterf**k with the company's data scattered all over the place. That includes clients' data, even private keys and passwords.

Recent Techrights' Posts

Richard Stallman About to Give More Talks in Europe, Some Confirmed Already
In Göteborg
 
Links 01/10/2025: Long Covid Risk Reiterated, "Bitcoin Queen" Caught
Links for the day
Links 01/10/2025: EA $55 Billion Deal is Debt and Slop "Raises Vishing Risks"
Links for the day
Bluewashing at Red Hat Means Redundancies
The man who sold Red Hat to IBM meanwhile became a Microsoft Mono booster
After Killing OpenSource.com, IBM ('Red Hat') and OSI Told Us OpenSource.net Would Replace It (But That Didn't Happen)
Now it's time to move on, perhaps tarnishing the "Open Source" label some more (for whatever sponsor wants this)
Linux is Not a Community Project, It's a Wall Street Product
The core goal should be freedom
Bad Actors Abusing the Free Software Community, Vandalising It Using Rogue Politics and Old Tactics
Oil giants have long attempted to do this; now, the digital equivalent of Big Oil does this in technology
Social Control Media Isn't the Future, The Federation or Fediverse Isn't Growing, People's Accounts Vanish for Good
users' accounts will get deleted, not just become inactive
IBM is Failing, This Helps Show Wall Street is Entirely Detached From Actual Commercial Performance
IBM is unable to grow, it's just constantly shrinking
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, September 30, 2025
IRC logs for Tuesday, September 30, 2025
Clerical Aspects of Publishing and Development
In Free software, the management aspects are considerably reduced
Slopwatch: Fake Articles and Google News Promoting "Linux" Spam or Bot-Generated Fear, Uncertainty, Doubt (FUD)
These slopfarms help misplace blame
Third Wave of Microsoft Layoffs in September, This Time Many in Liverpool Affected
Be ready for more waves of layoffs ahead of the so-called "results" in late October
Gemini Links 30/09/2025: Motorcycling in Central Oregon, Protocol Styles and the Flag of Sark
Links for the day
Links 30/09/2025: Death Sentences, Internet Censorship, and Internet Shutdowns
Links for the day
Gemini Links 30/09/2025: Social Control Media and ROOPHLOCH
Links for the day
Links 30/09/2025: CERN in "Have I Been Pwned" and More Windows TCO Blunders
Links for the day
Microsoft Canonical is Selling Mass Surveillance and Back Doors as "Security for Ubuntu"
If you are looking for a GNU/Linux distro to use, just remember that Microsoft has Ubuntu in the bag
Justice for Wildlife
animals cannot speak to humans who hate animals
Cowboys Gonna Be Cowboys (on the Internet, They're Not a New Problem)
Boys will be boys
Cowboys of the "Left" and Cowboys of the "Right"
Don't believe the lie that this is some "leftist" thing
When Codes of Conduct Serve to Protect Criminals From Much-Deserved Scrutiny
CoCs are typically unfit for purpose because enforcement lacks context and suitable understanding of the full background (the "full story")
It Took the Open Source Initiative (OSI) 4+ Years to Address the 'Data Breach' or Data Protection Violation Reported to the California Privacy Protection Agency (CPPA) in March 2025
We may never know the dialogue or its nature
Even Microsoft's Biggest Boosters (and Media Operatives) Are Turning Against Microsoft
Expect many more layoffs before the fake "results" next month
GNU Was Right 42+ Years Ago
Since then the abusive, user-hostile technology has spread like mushrooms
Old Isn't Always Inadequate
How many gadgets manufactured today (in 2025) will still work in 2075?
The Monkey Business of Rust People
Compatibility won't matter
Almost Half of the FSFE's Money (the Fake 'FSF', Misusing the Brand) Comes From Vodafone
That money always comes with strings, even if they're invisible to most of us
Microsoft Lunduke Spreads Deliberate Lies to Incite Online Mobs
Has he lost his reading comprehension skills?
Our 19th Birthday (in Just Over 5 Weeks From Now)
We meanwhile have ongoing, solid plans to cover patent-related issues when the FSF turns 40
British GNU/Linux Distro FydeOS Tops DistroWatch
That seems like a decent site and decent effort to keep an eye on
We'll Soon Have 75,000 GemText Pages
avoid many perils of today's Web
Google Used Free Software to Build a Monopoly. Now Google Kicks Free Software to the Curb
The "G" in "Google" does not stand for GNU. It never did. It's just another greedy company.
Gemini Links 30/09/2025: Retro Hardware, Federated Fragmentation, and Nex Server Written in C
Links for the day
4 More Days Till "4 decades, 4 freedoms, 4 all users"
We are now just 4 days away from the rare anniversary
Two Months After Merging to Hide GitHub Losses Microsoft is Doing It Again (This Time Windows)
Merging those two together is not a sign of strength but a tightening of budget
Speculations About the Next Large Wave of IBM/Red Hat Layoffs
the mass layoffs are likely to happen on week 3 or 4 in October
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, September 29, 2025
IRC logs for Monday, September 29, 2025
Links 29/09/2025: Opposition to Surveillance Giant Google and Conflicts Worldwide (Moldova Sides With EU)
Links for the day
Why the EPO Never Managed to Silence Us (After Over a Decade of Trying)
Firms like Mishcon de Reya and Brett Wilson LLP contribute to a bad stigma, staining the entire occupation
Links 29/09/2025: Datacenter Fires and "Too Much Internet Use Is Changing Teenage Brains"
Links for the day
Almost a Couple of Years After Microsoft Hijacked the Name 'Sudo' (to Describe Unrelated Windows Stuff) Microsoft Canonical Breaks Sudo in Ubuntu
These are vandals in "goodwill" or "security" clothing
Does the Good Law Project (GLP) Know the Director of Brett Wilson LLP Deems It OK to Endorse Violent Actions Against Trans People?
We were miffed to see this morning's report
Names Are Not Unique IDs and the UK Government's "Digital ID System" Would be a Nightmare
Digital surveillance, "apps", and worse (all the time)
What is Roy and Rianne's Righteously Royalty-free RSS Reader?
A news reader that uses OPML files and parses RSS feeds
The Free Software Foundation (FSF) Turns 40 in 5 Days
We should be talking about software freedom, not "Open Source"
It Feels Like Brett Wilson LLP Has Just Tacitly Admitted That It Defamed Me
It arguably admitted many other things by refusing to deny or address them (altogether)
Stefano Maffulli's Front Page Mentions "AI" 11 Times
They're more focused on slop (plagiarism) than sharing or Software Freedom
CMS Rot
With "modern" (bloated) content management systems (CMSs) there is a long chain of dependencies
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, September 28, 2025
IRC logs for Sunday, September 28, 2025
Slopwatch: Fake Articles About Linux 6.17 and Microsoft Meddling in Linux Development
today's Slopwatch is short because the picks are from Sunday
Gemini Links 29/09/2025: The Labor Wars and Retro
Links for the day