Bonum Certa Men Certa

The ISO Train Wreck at Sirius 'Open Source'

International Organization for Standardization (ISO) brag



Summary: Before we proceed to showing how Sirius 'Open Source' blatantly ignored security and privacy we wish to show how ISO (see ISO wiki) basically 'sold' a certificate to Sirius -- this is like a "diploma mill" but something that's for businesses, not individuals

THIS is today's second article on this topic. We've found some spare time for faster progression and in-depth coverage. As I noted yesterday, my wife had more direct and indirect experience (decades ago) with ISO being a bunch of meaningless hooey. So did I (having stumbled upon classical 'box tickers' or worse). Sirius is just another reminder of that. Hence this series and its relevance. It seems like a lot of people in technical fields separately and independently reached the conclusion that ISO is overhyped, overvalued, and mostly a waste of time and money (unless you have a 'bullshit job' to justify).



"This isn't science. It's like calling "economics" a science. It is not. It's more like religion.""My dad complained about the ISO in the 90s," Ryan said in IRC an hour or so ago. "He constantly made fun of all of their "standards" for management of a company that didn't mean anything but go on and on. It's a sort of code so that managers sound smarter than they are. "We're ISO-Whatever compliant with our handling of the TPS reports." And the ISO standards can be wrong and never revised. Microsoft implemented the standard for MP3 and so did LAME, and then the result was they were both correct and Windows XP crashed. Part of the standard about what constituted the maximum size for a frame could be calculated one of two ways.Microsoft chose the more constrained way and it resulted in a buffer overflow with some files that crashed Windows Media Player. LAME had chosen the method that resulted in a slightly larger permissible frame size. The outcome was LAME had to be changed to use the Microsoft calculation to avoid crashing Windows, and that meant a reduction in audio quality under some circumstances, with padded bytes instead of data. Later, they changed to use the VBR bit allocator, even in a CBR file, and it mostly avoids the situation by its method of action. It can cleverly use the bit reservoir in ways that the former bit allocator that was only for CBR files couldn't. Naturally, they never delete anything, so you can still demand the old model. It's just an absolute nightmare of options switches. It's the worst thing I've ever seen in a utility its size. ISO is kind of the stuff of Pointy Haired Bosses when it comes to Management Theory being standardized."

Well, this whole "Management Theory" is what we're dealing with here.

This isn't science. It's like calling "economics" a science. It is not. It's more like religion.

Here's what happened in Sirius (in mostly logical/chronological order):

Subject: ISO Date: Mon, 29 Jul 2019 15:47:43 +0100 From: xxxx To: xxxx

Hey All,

As you know we are going through the ISO processes - I have been asked to gather some information from everyone at Sirius to create a list of all assets used by employees of Sirius whether it belong to the company or the employee so if I can have the item name and serial number that would be great. They have also asked which anti virus you all use.

Are you all able to send me the required information ASAP please?

Thanks,

xxxx


Yes, because a bunch of serial numbers would mean so much! Of people devices at home... for the most part.

"They would nag us to do the same 'course' every year, even though it is dumb and we 'passed' it already."A month later came "You have been registered for a Training course - Information Security" (no, not really security but this hoax instead). We'll deal with that another day...

They would nag us to do the same 'course' every year, even though it is dumb and we 'passed' it already. This is compliance???



"This is something that will be done annually for our ISO process," I was told, "so please complete this on your next shift."



Way to waste people's time, doing and passing a total hoax over and over again (details on why it's a hoax were covered here before).



Notice the threats being sent to ALL staff:



Hi All,

As you will all be aware we have been implementing new policies and procedures in order to become ISO 9001 and ISO 27001 compliant. Part of this entailed changing our HR company to xxxx who use the online portal Atlas to provide an easier method to roll out training. I have checked and there is still a substantial amount that has still not been completed.

ALL training sent out by myself needs to be passed and completed by the _*25th November 2019*_. This is to ensure we meet our deadline for the final stage of ISO audits.

Failure to comply with this request may result in disciplinary action. For those of you that have completed the training, please ignore this message and thank you.

Kind Regards,

xxxx


"Failure to comply with this request may result in disciplinary action," it says. They kept making veiled and explicit threats. Sometimes this culminated in actual bullying, false accusations, and blame-shifting witch-hunts.

Of course the portals failed to even work properly. For instance:

> ALL training sent out by myself needs to be passed and completed by the > _*25th November 2019*_. This is to ensure we meet our deadline for the > final stage of ISO audits.

I was able to open all the documents and read them. The animated things, or training sessions, get stuck. I tried each one of them about 5 times (>each<) and they get stuck somewhere along the way. I tried this on multiple machines. Rianne told she too had some difficulties.

I will try again on my next shift, but these technical issues do merit a mention. They also rely on plugins Adobe no longer supports, posing security risk (an issue aside from the bugs).

Kind regards,

[Roy]


Her answer was: "Have you tried using a different web browser?"

Of course she wasn't using GNU/Linux or anything "Open Source". This does not constitute an actual solution.

In 2020 the following was sent:

-------- Forwarded Message -------- Subject: xxxx - Things to do Date: Thu, 26 Nov 2020 11:38:01 +0000 From: xxxx To: xxxx CC: xxxx

Hi All,

In October I issued Linux Training via xxxx. Can you all please ‘acknowledge’ this on your portal to show that you have opened and read it.

I also need you to ensure ALL training modules issued on xxxx i.e information security and documents issued i.e IMS Awareness presentation have been completed by the end of your next shift.

It is essential these tasks are carried out prior to our ISO Audit next week.

Kind Regards,


Well, those training modules and ISO guidelines weren't even followed by Sirius. We gave examples of this before. In some cases, there were efforts to meet standards only after a certificate had been granted.

Sheesh. I'm not supposed to say this in public, am I?

What did those audits mean anyway? What did the above "ISO Audit" actually check? That the cookie drawer is properly locked when Office staff goes to retrieve some hot chocolate milk from the machine?

"In the next few parts we'll show what Sirius did in practice, not in theory, and what it told staff, not ISO auditors."Some other messages were banal. They indicated a certificate had been granted (in other words, Sirius basically bought one) after minimal so-called 'audits' and staff sending a bunch of numbers from the back of computers (as if that means anything at all).

ISO is a joke. When it comes to this administrivia, ISO created just another 'cash cow' for itself.

In the next few parts we'll show what Sirius did in practice, not in theory, and what it told staff, not ISO auditors. It's one heck of a clusterf**k with the company's data scattered all over the place. That includes clients' data, even private keys and passwords.

Recent Techrights' Posts

Parties and Milestones Again
we've begun putting up about 40 balloons
 
Links 28/10/2025: Mass Layoffs at Amazon and Charter to Cut 1,200 Jobs
Links for the day
The Cocaine Patent Office - Part II: The Person Who Planted Paid-for Fake News for the European Patent Office (EPO) is a Cocaine User, Friend of António Campinos, Now on Record as Having Been Arrested
Background: High-level manager at the European Patent Office caught in public with cocaine, arrested
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, October 27, 2025
IRC logs for Monday, October 27, 2025
Google News Drowning in Slop (and Slopfarms That Hijack About Half the Results)
Google News seems to be drowning in this stuff
Gemini Links 28/10/2025: "How to Maximize Your Positive Impact" and ASCII Art and Artist Attribution
Links for the day
PETA and Activism
Being staff or volunteer in PETA isn't easy
Big Blue, Huge Debt
debt will soar again
Links 27/10/2025: Mass Surveillance Sold as "AI", People Reluctant to Lose Physical Media
Links for the day
Techrights' 19th Anniversary: Bronze
Time to go back to preparing for this anniversary
Our Latest European Patent Office (EPO) Series Will Last Several Weeks, Will Ask the EPO Management and the European Union (EU) Very Difficult Questions
If nobody loses a job (or jobs) over this, then the EU basically became no better than Colombia or Nicaragua
Slopwatch: LinuxSecurity, UbuntuPIT, Brian Fagioli, and Google News
We focus on stories that are fake or LLM slop that disguises itself as "news" about Linux
Links 27/10/2025: Wikipedia Vandalism, Bruce Perens Opens up on Childhood
Links for the day
This Site Could Not be Done by LLMs Even If It Wanted to (Because It's Not a Parrot of What Other Sites Say)
LLMs have no knowledge or deep understanding
Microsoft is Disloyal Towards Its Most Loyal Employees
Against its most faithful enablers
19 Years, No Censorship
No factual information is ever going to be removed, more so if it is in the public interest
We Are Not a Conventional Site, That's Why They Hate (or Love) Us
Throughout the week this week we'll be focusing on the EPO
Following the Line of Cocaine All the Way to the Top
Even a million denials and spin-doctoring won't distract from the core issue
The Cocaine Patent Office - Part I: António Campinos Brought Corruption and Nepotism to the EPO, Then Came the Cocaine
High-level manager at the European Patent Office (EPO) caught in public with cocaine, the Office has some answering to do
Purchasing/Possessing Computers Isn't the Same as Controlling Computers
Let's strive to put computers back under the control of their users, no matter who purchased these (usually the users)
Gemini Links 27/10/2025: Alhena 5.4.3 and Fixing Bash
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, October 26, 2025
IRC logs for Sunday, October 26, 2025
Thankfully We've Made Copies of More Interesting Data From statCounter
If statCounter (the Web site or the 'webapp') vanished overnight, we'd still have something left of it
More Silent Layoffs at IBM/Red Hat
when the media counts such layoffs or presents tallies the numbers are very incomplete
Links 26/10/2025: Microsoft Spies on Gamers, Open Transport Community Conference
Links for the day
Links 26/10/2025: LLM Slop / Plagiarism Programs Continue to Disappoint, CISA Layoffs Threaten Systems
Links for the day
Gemini Links 26/10/2025: Gemsync and Joining the Small Web
Links for the day
India.com a Click-baiting, SEO-Spamming, Slopfarming Heap
They do this almost every day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, October 25, 2025
IRC logs for Saturday, October 25, 2025
Without XBox Consoles, XBox is No More, It's Just a Brand (More Rumours of Microsoft Ending XBox, Then Laying Off Lots of Staff)
All signs indicate that Microsoft wants to "exit" the XBox business (not brand), but it does not want to publicly admit this as it would alarm staff and shareholders