Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#251

Post by joekrill »

lucraft wrote: post #186

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

The underlying problem is they are asking you to trust Drata implicitly, sight-unseen, and give them unfettered access to their laptop. There is nothing preventing Drata from changing their minds and altering how their agent works or what it collects.

Then there's the unintentional aspect. There is, of course, no guarantee their agent is bug-free. Data leaks and compromises happen all the time, by every facet of company (large, small, respected, hated, etc).

This is really a huge risk IMO. If anything, it's being downplayed and far from "nonsense".

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#253

Post by dsr_ »

qwerty456127 wrote: post #243
blitzar wrote: post #225

Earlier quoted context omitted.

> And they will install a trojan They WILL > which would eavesdrop your talks That absolutely WILL - use the microphone and listen to everything being said (why not the camera too and watch everthing?) > scan your home network and analyze its traffic. That absolutely WILL - do all this stuff I mean if this is definately going to happen, then the company can go ahead and cut an 8 figure cheque straight away. Which com…

> why not the camera too and watch everthing Because who doesn't have a lid/sticker over their webcam yet? I have also kill-switched the built-in mic in the BIOS set-up but I'm not sure how secure this is. I would prefer there to be no built-in microphones in any hardware (except phones) at all. Sadly every modern laptop is equipped with a mic.

Most mics have mediocre sensitivity. Stick a blob of blu-tack or similar cohesive putty on it, take it off when you want to use the mic. Test by making recordings -- some machines have two or three mics.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#254

Post by jorgeleo »

Request a laptop with whatever they want pre-installed. Use that laptop only for work for that client.

Another solution: Virtualize a pc, put everything that you need to work for that client in that VPC, install they drata only in the vpc. Or better yet, ask them to provide you with a VPC image with what they want.

I can understand being piss about it, but unless you are ready to drop them over this, getting angry will be of no consequence

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#255

Post by learc83 »

wombatpm wrote: post #238
Juliate wrote: post #227

Earlier quoted context omitted.

> procuring the laptop might be a difficult thing for them to do bureaucratically Not if they are at the point where they need SOC2 cert, and where they install agents on their employees computers (and want to extend that to their suppliers).

My company is going through our SOC2 audit. We do not have such software and everyone is remote. I call BS as to the justification. This smells like a desire for corporate monitoring.

SOC2 isn’t prescriptive. SOC2 is just a certification that you are following your own internal policies.

If the company made the mistake of creating a policy that they use this software as one of their controls, then the auditor will ding them if they don’t use it.

It’s an absurd system.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#256

Post by Arubis »

They can send you a laptop running whatever they want. Unfortunately, you can’t install an agent not under your direct control on your freelance business laptop, because it would potentially compromise your confidentiality and security agreements with your other clients. This is out of showing your other clients the same level of respect that your subject client can expect.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#257

Post by kriro »

lucraft wrote: post #186

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

Maybe I'm very naive here but does SOC2 explicitly require monitoring? Can't a contractor simply sign a form that says all relevant rules are followed on their end and thus if that's not the case, the company is off the hook?

If active monitoring is really required than the only solution I see is one device/customer and thus as a freelancer I'd have to request said device be provided by the customer.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#258

Post by NikolaNovak »

yes and no.

It's normal to have software that safeguards company's intellectual property (how suitable this particular software is, I cannot speak). However, with that goal in mind, it's also normal for company to provide a dedicated, company-owned-and-managed hardware as well, such as laptop or phone.

Demanding that employee or contractor use personal hardware but install monitoring software seems a lose-lose proposition for everybody - it will not necessarily achieve the level of control and safeguards that company desires, and it compromises the contractor's ability to safeguard their own and other clients' data.

Depending on circumstances, my own approach would be to start with a friendly email indicating that you understand and support their goals, and propose that the best way to achieve them is to use customer provided and managed hardware.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#259

Post by learc83 »

RileyJames wrote: post #84
SkyMarshal wrote: post #70

Earlier quoted context omitted.

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity. Otherwise, I expected them to provide all hardware and software required to perform my role. And likewise, for security purposes, that’s exactly what they wanted as well. Tho I would note, the…

One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools.

It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#260

Post by [deleted] »

allo37 wrote: post #244
illud_tempus wrote: post #218

Earlier quoted context omitted.

> The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". Do you have any evidence for this?? I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their…

Unfortunately, "I know a lot about security, trust me bro" doesn't satisfy the compliance box-tickers, for better or worse. Maybe run it inside a VM?

[deleted]
Post reply on HN