Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 506 posts

Ask HN: My client want an agent on my laptop. Is this the new normal?

#1

Post by illud_tempus »

I work from home in the EU as a freelancer for a US startup.

A few days ago, an email came out of the blue, demanding that I install an "agent" from a company named "Drata"* on my laptop. The motivation is that my client badly want a SOC 2 certification.

I have worked as a developer for more than 30 years. Tiny shops. Startups. Major league. I have never even heard about someone putting agents on developers laptops.

I'm pretty pissed off. So are the teams I work with.

Is this the new normal now?

Just for the record: I don't have credentials to production systems, and I don't work with production data. I just figure out how to transform dreams into code, I write parts of that code, and then I fix it as needed.

* Drata (https://drata.com/about) is on a "Mission to Help Build Trust Across the Internet". Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". When I confronted them about this, they replied: "Feel free to reach out to your Drata administrator internally with concerns. Do note, that when your company contracted with Drata, any edits or redlines they provided will prevail for all employees of your company." - basically to just bend over and smile.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#3

Post by illud_tempus »

mixmastamyk wrote: post #2

I would decline. There are other jobs out there. Another alternative might be to install it into a VM or old but freshly-paved computer.

So far my strategy is to just ignore it and pray that the problem goes away by itself. If I have to deal with it eventually - quitting is the most appealing option.

However, the reason I asked here is to get a feeling about how common this thing is. Is this normal? Am I the rat in the lab, or am I just late to the party?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#4

Post by vanusa »

You have two options: (1) quit or (2) "renegotiate the relationship", as the saying goes.

Specifically, it's perfectly reasonable for you to say "OK -- if you're willing to provide me with a dedicated laptop". They can say no of course, but so can you. Or you can request a rate increase (which they would probably say no to, if they won't provide you with a laptop).

Either way, those are you choices. Yes it sucks to a degree, but that's what work does generally and which is why it pays money. All we can do is moderate the suckiness-to-money ratio as best we can.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#5

Post by vanusa »

illud_tempus wrote: post #3
mixmastamyk wrote: post #2

I would decline. There are other jobs out there. Another alternative might be to install it into a VM or old but freshly-paved computer.

So far my strategy is to just ignore it and pray that the problem goes away by itself. If I have to deal with it eventually - quitting is the most appealing option. However, the reason I asked here is to get a feeling about how common this thing is. Is this normal? Am I the rat in the lab, or am I just late to the party?

I don't know first hand, but I would suspect it's more common in financial services and/or with government contractors.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#6

Post by fdye »

illud_tempus wrote: post #3
mixmastamyk wrote: post #2

I would decline. There are other jobs out there. Another alternative might be to install it into a VM or old but freshly-paved computer.

So far my strategy is to just ignore it and pray that the problem goes away by itself. If I have to deal with it eventually - quitting is the most appealing option. However, the reason I asked here is to get a feeling about how common this thing is. Is this normal? Am I the rat in the lab, or am I just late to the party?

I do not know Drata, but an endpoint agent on a company machine is not that odd. Generally, they come from the big EDR companies, such as Carbon Black, CrowdStrike, etc. They would mostly run in the background and scan for malware, push out Group Policy changes, and yes, provide a backdoor to run scripts on your machine. Drata sounds a bit more like spyware though. Technically, EDR agents can do session captures (recording the screen, showing what was run on the computer over history, processes, network traffic). Generally, though its only utilized for incident response and not tracking a contractors time, making sure they are working, etc. Although I must admit, theoretically there is nothing preventing that, although its at a more technical level then most management would know how to decipher. I second the recommendations above. Only agree to install it on a company machine, same for any agent or company AV, etc. If they wont provide it then its a no go on any personal hardware of yours.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#7

Post by illud_tempus »

vanusa wrote: post #4

You have two options: (1) quit or (2) "renegotiate the relationship", as the saying goes. Specifically, it's perfectly reasonable for you to say "OK -- if you're willing to provide me with a dedicated laptop". They can say no of course, but so can you. Or you can request a rate increase (which they would probably say no to, if they won't provide you with a laptop). Either way, those are you choices. Yes it sucks to a…

My client is quite reasonable, and is willing to compensate a new laptop.

It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country.

However, I still don't like the idea of running an agent on my/a machine. It's a road I feel strongly against going down. But then, I came from a different time, when people still trusted each other and acted in good faith.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#8

Post by MrFoof »

>Is this the new normal now?

In my last four engagements, every single laptop provided by the employer had something. Usually Tanium or Carbon Black. Network interfaces being disabled entirely if you're not connected to their VPN. One client requiring the use of a Meraki hardware VPN appliance.

This was an investment bank, a university, a software company and a health insurance company.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#10

Post by eps »

Soc compliance is not ensured by spying on employees activities. That excuse alone is a complete bullshit. If this were happening to me, I'd tell them exactly that and refuse to work under surveillance. This is completely unacceptable even if it is getting somewhat common.
Post reply on HN