Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#211

Post by selfhoster11 »

biztos wrote: post #167
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…

Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#212

Post by daneel_w »

lucraft wrote: post #186

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

> "The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising".

> Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know."

Do you have any evidence that they don't? If so, can you describe a few bits of your investigative process and how you reached the conclusion? For the sake of alleviating people's fears and to clear up the nonsense.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#213

Post by propter_hoc »

blitzar wrote: post #122
illud_tempus wrote: post #73

Earlier quoted context omitted.

They have an exclusive clause, so at the moment I work only for them (and on a few open source projects). Legally I work for a company in the EU which I own. They are willing to pay for a decent laptop. That is not the issue. The issue is that I feel quite upset about this requirement. My motivation to discuss it here is to get an idea if I am out of touch with current reality (like some old guys some times are) - or…

Are you able to, as Your Company LLC, (self) certify yourself as a SOC2 complaint entity? Maintain your own records and be able to provide them for audits from the parent company? I agree with much of what has been said, security theatre etc etc; but at the highest level, should companies take IT security seriously , absolutely. Is the implementation correct? Probably / certainly not. The real cancer is the total dis…

> Are you able to, as Your Company LLC, (self) certify yourself as a SOC2 complaint entity? Maintain your own records and be able to provide them for audits from the parent company?

I recognize that you are just making a creative suggestion here, but that is impossible. SOC2 certification is incredibly complex and hard to manage (not to mention, costing tens of thousands of dollars a year). It is difficult to the point of impossibility for one person to achieve.

Not only is is practically impossible, it is also literally impossible for a one-man show to achieve SOC2, because there are control objectives that require separation of duties and verification of one person's work by another. I think the absolute smallest a company could be and achieve a SOC2 would be three people.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#214

Post by selfhoster11 »

nix23 wrote: post #149
RileyJames wrote: post #84

Earlier quoted context omitted.

I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity. Otherwise, I expected them to provide all hardware and software required to perform my role. And likewise, for security purposes, that’s exactly what they wanted as well. Tho I would note, the…

Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.

I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#216

Post by gorgoiler »

illud_tempus wrote: post #169
gorgoiler wrote: post #153

Earlier quoted context omitted.

Thanks for responding and writing up more details. I empathise with the frustration of having to follow rules for rules' sake. Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another. In the past I've been faced with similar situations where corporate IT required ne to run a "security agent" if I wanted to bring my own device to their network. I ended up…

> Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another. That would create a layer of cynicism between me and my work. I don't have that today, and I would rather avoid it.

Well said, and good luck with your problem. These workarounds are a flag one is in the wrong place. I recently left the job where I did the two-pis hack.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#217

Post by willcipriano »

qwerty456127 wrote: post #145
endofreach wrote: post #61

Earlier quoted context omitted.

Capture traffic and sue the f outta everything they do that‘s not covered by a contract. Someone has to start stopping this madness and protect less informed people. We are all steering into a dark future. And i lose hope when i see all these smart programmers complaining but not stepping up.

> Capture traffic and sue the f outta everything they do that‘s not covered by a contract. Whatever the app they would ask you to install would do probably is going to be allowed by its EULA (and I bet the EULA is also going to prohibit you from analyzing the app and whatever it does/communicates) and chances are you don't read it. And even if you do you most probably agree because you know all EULAs are brutal and t…

EULA is between the user and the vendor of the software, it isn't a agreement between the user and the users employer. Capturing traffic like that runs afoul of hacking laws.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#218

Post by illud_tempus »

lucraft wrote: post #186

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

> The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". Do you have any evidence for this??

I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their reply is in the header. Another issue I raised is that they expect me to accept undisclosed terms and conditions.

That said. I have worked with computer security at an advanced level, including consulting, training, penetration testing, design/implementation of x-platform server agents for monitoring and alerting, design/implementation of firewall. Once I designed an implemented a system to deal with NATO secrets (not very sensitive secrets, but still secrets) for a military subcontractor in EU. My computer is relatively secure. I follow best practices - and more. A hostile agent would decrease the security on my network. That was my first thought when I got that awful email.

Also, I don't get it why that need such a thing on my PC. I don't have credentials to production systems or production data. I am a software developer. I work with code and documentation. That's it. Anything I produce is reviewed by other developers and then tested independently by QA.

I am careful to be a freelancer, and not an employee, for several reasons. It means that legally I'm my own boss. That feels good (I have a great boss!) It also make it unproblematic to work on open source projects, without getting into discussions about who owns the intellectual rights to that work.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#219

Post by guhcampos »

eksapsy wrote: post #46

I know people who work for Fortune 500 companies who don't have such crap installed in their company laptops, and they mainly work remotely. I also work remotely and I dont have such thing installed either. Installing agents is a sign that the company doesn't value trust with their employees and treats them as liabilities. Companies that made me an offer who had asked me if I would have an issue installing an agent j…

These agents are not really meant to check if you are doing any work or not. They are there to find out if you are leaking company data out.

I have worked with some DLP such as digitalguardian.com that does indeed report the time you spent focusing on each app, for instance, which is a big no-no for me too, but most of the time the company is just interested if you haven't been copying data between your computer and some thumb drive, or copying it between you corporate and personal cloud drives, or syncing your corporate e-mail to an external account, that kind of stuff.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#220

Post by jameshart »

illud_tempus wrote: post #169
gorgoiler wrote: post #153

Earlier quoted context omitted.

Thanks for responding and writing up more details. I empathise with the frustration of having to follow rules for rules' sake. Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another. In the past I've been faced with similar situations where corporate IT required ne to run a "security agent" if I wanted to bring my own device to their network. I ended up…

> Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another. That would create a layer of cynicism between me and my work. I don't have that today, and I would rather avoid it.

But you’re the one describing a piece of software they are asking you to install as a condition of employment as a ‘hostile agent’.

Feels like the layer of cynicism is already there.

Post reply on HN