Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#121

Post by zoomablemind »

illud_tempus wrote: post #7
vanusa wrote: post #4

You have two options: (1) quit or (2) "renegotiate the relationship", as the saying goes. Specifically, it's perfectly reasonable for you to say "OK -- if you're willing to provide me with a dedicated laptop". They can say no of course, but so can you. Or you can request a rate increase (which they would probably say no to, if they won't provide you with a laptop). Either way, those are you choices. Yes it sucks to a…

My client is quite reasonable, and is willing to compensate a new laptop. It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country. However, I still don't like th…

> ...My client is quite reasonable, and is willing to compensate a new laptop.

I wonder, if "in the spirit and for the strength of mutual trust" would they be willing to provide you with the reports on the agent-collected data about you. Basically, the copy of how you are being shown in those dashboards.

It's fairly reasonable, as you're not an employee by definition, yet such policy or a requirement to operate on client-controlled work means is an employee's realm, not an independent contractor's one.

Here's IRS independent contractor test:

https://www.irs.gov/businesses/small-businesses-self-employe...

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#122

Post by blitzar »

illud_tempus wrote: post #73
bell-cot wrote: post #63

Earlier quoted context omitted.

This. If "work [...] as a freelancer" means that you are not their employee, and they need the legal fiction that you normally have other 'clients' who you freelance for... If they do not provide the laptop, do they mind if your other clients also have agents & such on your machine? If they are honest about this, then providing you with a nice laptop would be far cheaper than dealing with multiple-agent issues. Let a…

They have an exclusive clause, so at the moment I work only for them (and on a few open source projects). Legally I work for a company in the EU which I own. They are willing to pay for a decent laptop. That is not the issue. The issue is that I feel quite upset about this requirement. My motivation to discuss it here is to get an idea if I am out of touch with current reality (like some old guys some times are) - or…

Are you able to, as Your Company LLC, (self) certify yourself as a SOC2 complaint entity? Maintain your own records and be able to provide them for audits from the parent company?

I agree with much of what has been said, security theatre etc etc; but at the highest level, should companies take IT security seriously, absolutely. Is the implementation correct? Probably / certainly not. The real cancer is the total disregard for security and data privacy that has metastasized to the point where a leak containing everything from a company doesnt even register as an incident anymore.

If your contract was with the CIA and they had requirements, you would probably be on board with them. We have all been around the block and seen the state of some peoples computers; even technically gifted people with malware and spyware riddled computers, with the CashFollowerDataScrape Browser Toolbar installed and Password123 securing everything. Do these tools stop this sort of stuff, not really.

Work / Personal device seperation is always the answer, the red flags are the companies that demand compliance, but refuse to provide equipment. If the contract wants you to do something you are free to accept or decline. If the contract wants code written using their style guide it would be a similar cosideration, even if it meant spaces instead of tabs. if the contract wants you to code only using your index fingers only, are comfortable with it taking 10x longer and will pay 10x your normal hourly rate, you are free to accept or decline.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#124

Post by ozim »

SkyMarshal wrote: post #70
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

I would strongly advise to not use personal accounts for customer.

Yeah like sending invoices arranging contracts I use my main mail account. For doing customer things I rather setup new email account or get one from the customer.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#125

Post by Ekaros »

fhars wrote: post #68

Since you are in the EU, have you asked them if they have confirmed with their DPO that the suggested data collection and processing is GDPR compliant?

Not to forget any local legislations. Like secrecy of correspondence which would make it illegal for them to read stuff like emails that aren't shared with them.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#126

Post by Radim »

cprecioso wrote: post #107
qwerty456127 wrote: post #49

Earlier quoted context omitted.

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

If this is really the kind of things this company would do… why are you working for them?

Because people need money to pay bills. And it's a sad fact that companies who do shady shit tend to have more money. Simply because they outcompete companies who don't, all else being equal.

Tugging against this evolutionary pressure is really hard, not only for individuals but also on the society level.

"Just quit LOL!" is a commendable act of grassroots activism, but not everyone is able (or willing) to afford such luxury.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#127

Post by Netcob »

dusted wrote: post #12

You have a third option: Install a VM for working with your client and let their agent run in that.

There are no easy technical solutions to social/political issues. They'll simply make the software detect that it's running in a VM and ban that use. Then you'll work a few hours cheating the software, make your VM look extra realistic. Then the software will get upgraded and your contract gets a clause where you'll pay a fine if they catch you using a VM.

Then managers will get the idea they might get complete control over an employee's life, scan their network, track what websites they visit, keep tabs on their social media. If they don't have social media where they should be posting how amazing their company is, they're fired.

Many of these things are already happening. We have to fight it, unless you want to spend 90% of your time finding technical solutions to avoid it.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#128

Post by illud_tempus »

TruthWillHurt wrote: post #109

If you freelance via upwork this is a normal thing. Odd for contracting though.

> If you freelance via upwork this is a normal thing

I don't. My clients usually find me via reputation or via open source projects I work on.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#129

Post by GoblinSlayer »

illud_tempus wrote: post #7
vanusa wrote: post #4

You have two options: (1) quit or (2) "renegotiate the relationship", as the saying goes. Specifically, it's perfectly reasonable for you to say "OK -- if you're willing to provide me with a dedicated laptop". They can say no of course, but so can you. Or you can request a rate increase (which they would probably say no to, if they won't provide you with a laptop). Either way, those are you choices. Yes it sucks to a…

My client is quite reasonable, and is willing to compensate a new laptop. It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country. However, I still don't like th…

You can be spied with a microphone: https://github.com/ggerganov/kbd-audio

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#130

Post by Fradow »

illud_tempus wrote: post #120
Fradow wrote: post #97

You mention you are in the EU. That's important because the GDPR applies. Even if you are working for a US company. The details come down to what exactly the software is spying on (I won't look at their website): if it's too invasive, even on a company-provided computer (as many other commenter suggested), it can run afoul of the GDPR (i.e. illegal). There have been some cases already on that [1], and looking up some…

> You mention you are in the EU. That's important because the GDPR applies. They have some lawyer speak in their "Data Processing Addendum" that is unclear to me. I suspect it is designed to enable a loop-hole in GDPR. I'm not an expert. It would cost me a fortune to get a law firm specializing in GDPR to dissect it. Drata declined to comment on my concerns about this.

The "Data Processing Addendum" is a legal document that's meant to ensure a legal basis to get GDPR-covered data out of the EU (in my opinion it's a load of bullshit because it's fundamentally incompatible with the Patriot Act, but that's off-topic and beside the point, as far as you or me are concerned it's lawyer-approved). It's a common document that's meant to replace the Privacy Shield (that has been ruled not GDPR compliant a while ago).

The Data Processing Addendum isn't a loophole to collect data that they don't have a legal basis to collect.

Post reply on HN