Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#101

Post by dusted »

illud_tempus wrote: post #27
MarkSweep wrote: post #15

Earlier quoted context omitted.

I second this. Create a VM for work or a VM per client. It makes it much easier to say “I don’t have any of your intellectual property” at the end of your contract when you can delete the whole VM.

That's what I do today. One VM per customer, on a pretty decent workstation. My host file system is encrypted. If I install the agent, it will complain about the VM's file system not being encrypted. If I double encrypt, compilation times will go up quite a bit. Besides, running the agent in a VM will just be theater. If the host machine is compromised, no security in the VM will mean anything. I could just as well r…

Add an unecrypted disk on which you can store VMs that require VM-level encryption.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#102

Post by sofixa »

mschuster91 wrote: post #81
psnosignaluk wrote: post #74

At a company like the one I work for, it's a hill noone can afford to die on. PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met. That entails dropping command and control agents on machines. Say what you will about PCI and credit card cartels, but no accreditation, no business. That said, as I work from home, my work laptop lid remains closed for…

> PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met. How does PCI-DSS compliance work in European countries, with GDPR and actual employee rights with teeth and serious fines at play?

Quite easily actually.

PCI-DSS certified companies ( mostly based on my experience at the one I'm currently employed at in France and things I've heard) have agents on employee laptops, but there's an upfront disclaimer what it does and what data it collects ( close to none - it checks for encryption, password policy, antivirus and stuff like this, but no actual activity data is collected). In some cases work has to be done on a terminal server, so no actual PCI-DSS covered data hits the employee laptops.

And note, there was backlash against the agent being deployed, which was handled with full transparency - the scripts run by the agent are (internally) open source, there were assurances about privacy, etc. Considering the fines possible, and employee representation, employees are generally inclined to trust those assurances.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#103

Post by detaro »

mschuster91 wrote: post #81
psnosignaluk wrote: post #74

At a company like the one I work for, it's a hill noone can afford to die on. PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met. That entails dropping command and control agents on machines. Say what you will about PCI and credit card cartels, but no accreditation, no business. That said, as I work from home, my work laptop lid remains closed for…

> PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met. How does PCI-DSS compliance work in European countries, with GDPR and actual employee rights with teeth and serious fines at play?

by not making overly privacy-invasive demands. Lots of security controls don't collect any sensitive information (i.e. verifying the usual security checklist of "fully patched/encrypted/...", 2FA, ...), and the laws generally leave room for those that absolutely need to, if done correctly.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#104

Post by hankchinaski »

This is legitimate when working with sensitive data even as a contractor. I have seen it a lot with fintech clients. In that case though they should provide a company laptop. I would never ever install something like this on my personal laptop.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#105

Post by illud_tempus »

lordnacho wrote: post #60

We need an online list of firms that request this. People who use the list should be asked to turn down new firms that do this and inform the firm they are about to be listed.

> We need an online list of firms that request this

May be we need a general rating list for software vendors.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#106

Post by saati »

illud_tempus wrote: post #51
eksapsy wrote: post #46

I know people who work for Fortune 500 companies who don't have such crap installed in their company laptops, and they mainly work remotely. I also work remotely and I dont have such thing installed either. Installing agents is a sign that the company doesn't value trust with their employees and treats them as liabilities. Companies that made me an offer who had asked me if I would have an issue installing an agent j…

Have you been met with such expectations often? I have been a developer for more than 3 decades, and I have never even heard about it before.

It almost happened to me once, some dude appeared at my desk and said he will install it now, I said ok, but this isn't MacOS like he assumed as I replaced it with linux (I got CTO approval first). He said he will be back in five and I never saw him again.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#107

Post by cprecioso »

qwerty456127 wrote: post #49
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

If this is really the kind of things this company would do… why are you working for them?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#108

Post by ciphol »

hericium wrote: post #31

The concept of "working from home" forced by the pandemic is harming the "remote working" community by extensive invigilation and moving harmful office behaviors to private space. I talked to an Intel HR person (informal chat, I never applied there nor planned to) 2-3 months ago and after I stated that after a decade of remote work, I see pandemic-driven introduction of harmful concepts like spying on previously trus…

This reminds me of how adblocking software worked great when only a handful of nerds used it. Then when adblocking became more mainstream, sites bothered to develop workarounds to make ads show up anyway. Adblockers now try to develop workarounds to the workarounds, but it's a constant battle.

Was it great when I was the only one with adblocking software? Yeah, for me. But it was worse for society as a whole, most of whose members had no adblocking whatsoever.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#110

Post by illud_tempus »

haspok wrote: post #94
lordwarnut wrote: post #83

Earlier quoted context omitted.

Why does that sound bad?

Trade unions can easily be run as maffia organizations, as it happened in the US in the 20th century.

They worked pretty well in Scandinavia, and is one of the reasons people there are well payed, have good protections and world class health care.
Post reply on HN