Talk to your union. This is nonsense. We are SOC2 compliant at my employer without any surveillance tools. There are plenty of other controls that are perfectly reasonable though.
Ask HN: My client want an agent on my laptop. Is this the new normal?
21–30 of 506 posts
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#22The agent isn’t mandatory for SOC2, there is an option to just upload screenshots of settings periodically. I had the same situation and I opted to upload the screenshots.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#23Soc compliance is not ensured by spying on employees activities. That excuse alone is a complete bullshit. If this were happening to me, I'd tell them exactly that and refuse to work under surveillance. This is completely unacceptable even if it is getting somewhat common.
> Soc compliance is not ensured by spying on employees activities That part is clearly Security Theater. Having worked with real security for decades (consulting, training, building server monitoring and alerting tools, building commercial firewalls) I get quite provoked by fake security. For example, this "agent" checks for disk encryption. It does not check for password strength, or even if there is a password (you…
Had a quick look at drata.com. Looks like vendorware. Some manager got hoodwinked into buying the product to justify their existence. Now they have to force everybody to use it to justify the exorbitant price.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#24Sounds like you'll be purchasing a new laptop for that client and bill them for the price of the laptop, and several additional hours on maintaining said laptop.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#25I haven't been in this case yet as most companies I've contracted for were/are small companies There was one company which required devices to be up to date on the latest security updates from the OS and every wednesday an employee was chasing everyone to get confirmation that our systems were updated.
If a client would require an agent to be installed I would ask for a company laptop to do the work on.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#26You have two options: (1) quit or (2) "renegotiate the relationship", as the saying goes. Specifically, it's perfectly reasonable for you to say "OK -- if you're willing to provide me with a dedicated laptop". They can say no of course, but so can you. Or you can request a rate increase (which they would probably say no to, if they won't provide you with a laptop). Either way, those are you choices. Yes it sucks to a…
My client is quite reasonable, and is willing to compensate a new laptop. It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country. However, I still don't like th…
It's trivial for software inside to VM to detect that. So, I'd expect any competent agent software to report that back to base.
Whether or not the people monitoring the agent's output will care, is a different question. ;)
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#27You have a third option: Install a VM for working with your client and let their agent run in that.
I second this. Create a VM for work or a VM per client. It makes it much easier to say “I don’t have any of your intellectual property” at the end of your contract when you can delete the whole VM.
That's what I do today. One VM per customer, on a pretty decent workstation.
My host file system is encrypted. If I install the agent, it will complain about the VM's file system not being encrypted. If I double encrypt, compilation times will go up quite a bit. Besides, running the agent in a VM will just be theater. If the host machine is compromised, no security in the VM will mean anything. I could just as well run the agent on dedicated VM with antivirus and disk encryption and just forget about it. Theater is theater. The audience would be the same, and they would see the same Play. However, it would not be ethical. It wold also lower my local security, as it's not impossible for malware to escape from a VM to the host machine. (I have worked for a VM vendor. I know a thing or two about VM's).
I have reasonable good security on my devices. Complying faithfully with this requirement would lower my security. If I silo it in it's own LAN, on it's own hardware, it would lower my job satisfaction and my performance.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#28You have two options: (1) quit or (2) "renegotiate the relationship", as the saying goes. Specifically, it's perfectly reasonable for you to say "OK -- if you're willing to provide me with a dedicated laptop". They can say no of course, but so can you. Or you can request a rate increase (which they would probably say no to, if they won't provide you with a laptop). Either way, those are you choices. Yes it sucks to a…
Don't forget option C: Talk with all the other teams and present a united front, whatever you decide to do.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#29Earlier quoted context omitted.
My client is quite reasonable, and is willing to compensate a new laptop. It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country. However, I still don't like th…
Just get the laptop, use it for work only. This is the best way forward. They are looking for their interests (minimize security breaches) and that's a perfectly understandable position and solution to the problem. In this day and age the risk from a breach is much larger than in the past. Since they are willing to provide the necessary equipment for that then there is no issue from your end.
Since when a backdoor is useful to minimize security breaches?
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#30Tell them no. End of story.