Ask HN: My client want an agent on my laptop. Is this the new normal?

My company is implementing this exact thing - and in general for company laptops I'd say it's not really too crazy (freelancers, contactors will most likely be given machines too if they need any level of access to our stuff/code). From what drata told our team - the agent is based on OSQuery, and just reports disk encryption, antivirus, screen lock, installed applications.

Not sure what the other commenters in this thread are going on about but AICPA's soc2 common criteria _do_ require that a bunch of that stuff is configured. The reality we're facing is that unless we actually monitor for those basic security config things, sales/marketing/etc will disable those setting for no reason and promptly leave their laptop in a Starbucks with client user lists or confidential data on it.

For other context - based on our research, compliance automation platforms like drata or secureframe greatly decrease the cost of the actual audit since it makes evidence collection that the proper security controls are in place and are functioning much easier.

From your perspective though I 100% get the concern though from a freelancer - I'd say that they shouldn't want you to be handling their source code on your personal machine anyways and should prob. send you a laptop.

We as in tech nerds, or we as in whole society?

Any decent company that has you work from home (contractor or employee) will provide you with a laptop. That laptop should be used only for work for that company and when you're done with the contract, you return the laptop.

This is especially true when you're connecting to their network and using their data. I'm sure there are exceptions for certain types of contracts, but for hourly work this is the norm for companies that take their data security seriously.

> Reply to parent

Next client! This is potentially an indicator of a bad customer or management.

My hardware = my software (not yours) end of discussion. Don't like it? Have fun finding someone better that will put up with your nonsense.

Now if they provide a laptop with corp network access etc that is different.

I'm a professional similar to yourself. 15 years as a consultant and freelancer.

"Just for the record: I don't have credentials to production systems, and I don't work with production data. I just figure out how to transform dreams into code, I write parts of that code, and then I fix it as needed."

Since the certificate is about protecting user data - and you say you do not have user data - then I would not just accept it, without trying to reason with them, that the general approach they are doing is maybe too broad and unneccesary.