131–140 of 506 posts
AFAIK it only checks a few items. We had to install it, too for SOC2 compliance. I installed it, let it send in a report (because I'm on Linux, I manually had to make a few screenshots as proof), then uninstalled it.
I'm happy to do the above process next time they complain, if ever.
Earlier quoted context omitted.
My client is quite reasonable, and is willing to compensate a new laptop. It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country. However, I still don't like th…
But then you have to install an authenticator app on your phone for 2FA and they won't run on a SIM-less burner.
Earlier quoted context omitted.
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.
If this is really the kind of things this company would do… why are you working for them?
Because, until last week they didn't.
Now I have to figure out if I'm just an unreasonable, stubborn old guy, or if this requirement is out of band.
Earlier quoted context omitted.
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.
Just compartmentalize your passwords and private keys. That said, private keys are generated on the dedicated hardware and always stay there - that's all you need to manage them.
If a company sends me decidated hardware, including an LTE or 5G modem to connect to the internet, they can install on that whatever they want.
Their hardware, their rules.
My hardware, my rules.
Earlier quoted context omitted.
This. If "work [...] as a freelancer" means that you are not their employee, and they need the legal fiction that you normally have other 'clients' who you freelance for... If they do not provide the laptop, do they mind if your other clients also have agents & such on your machine? If they are honest about this, then providing you with a nice laptop would be far cheaper than dealing with multiple-agent issues. Let a…
They have an exclusive clause, so at the moment I work only for them (and on a few open source projects). Legally I work for a company in the EU which I own. They are willing to pay for a decent laptop. That is not the issue. The issue is that I feel quite upset about this requirement. My motivation to discuss it here is to get an idea if I am out of touch with current reality (like some old guys some times are) - or…
One of our clients at $Day_Job is a laboratory - subject to arbitrary (from their viewpoint) rules for certifications, etc. If the certifying agency says "round this value to 3 decimal places" - it doesn't much matter if $Client hates that idea, or if it is (science-wise) wrong. One can argue with them...if done wisely, that occasionally works.
I'd be tempted to look into the SOC 2 stuff. Especially real-world accounts of how the AICPA interprets and applies the rules. There can be wide gulfs between what the written rules (plus "reasonable professional" logic) say, and the standards which the auditors (with their own mindsets and habits) actually apply.
Hmm...does the US startup you're working for have someone really familiar with SOC 2 certification working for them? Or just some energetic manager-type, who's zealously trying to apply his own interpretation of the written rules?
Best wishes.
Earlier quoted context omitted.
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.
You keep your work laptop in your home network? Tut tut.
Do you object outright to spyware, or to the client wanting to run their spyware on your equipment? It sounds like the spyware is non negotiable and I personally wouldn’t have issue with it if the client also provides a laptop on which to run it . The client is free to do whatever the hell they like with their own hardware . What’s objectionable about situations like this is the client wanting to have their spyware c…
I don't know for a fact that it is spyware. For now I just think of it as an "hostile agent".
I object because a) I don't want frustrations at work. I want to focus on the problems I am there to solve (which are quite interesting), b) I don't want a hostile agent from a company selling data to "targeted marketing" in my network, c) I don't want such companies even to know my real name, d) I take security seriously - I hate security theater.
That's what I object to.
If your employee doesn't fulfill some other criteria, like providing all hardware containing such a agent, not requiring you to use our have the hardware powered on outside of you work time etc. it's unlikely to be legal.
They might also need to provide you with a way to separate internet access, e.g. an LTE modem, a this agent the to scan the network which they are in, which is also in beach of law in case of home office.