Ask HN: My client want an agent on my laptop. Is this the new normal? • Hacker News Board

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#281

Post by micromacrofoot » Fri, Dec 17, 2021, 2:52 PM UTC

wombatpm wrote: post #238

Juliate wrote: post #227

Earlier quoted context omitted.

> procuring the laptop might be a difficult thing for them to do bureaucratically Not if they are at the point where they need SOC2 cert, and where they install agents on their employees computers (and want to extend that to their suppliers).

My company is going through our SOC2 audit. We do not have such software and everyone is remote. I call BS as to the justification. This smells like a desire for corporate monitoring.

My company didn't need endpoint monitoring for SOC2, but does need it for ISO27001

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#282

Post by gwbas1c » Fri, Dec 17, 2021, 2:53 PM UTC

illud_tempus wrote: post #218

lucraft wrote: post #186

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

> The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". Do you have any evidence for this?? I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their…

FWIW: I never do personal stuff on company hardware. I always assume that anything I do on company hardware can be tracked, even if no one is deliberately trying to track me.

I think you have 4 options:

- If you use a company-provided computer, install it on their computer. It's their computer, not yours.

- If you use your own computer, set up a VM for this client and install the agent in the VM. Then do your day-to-day work inside of the VM.

- If you use your own computer, buy / expense a dedicated computer for the job

- Politely refuse to install it and accept the consequences. (IE, you might be out of a job.)

Remember that you are paid to do a job. If you don't like the conditions of the job, you can always walk away. As an earlier poster mentioned, this tool appears rather benign.

Regarding company hardware and tracking: Many companies set up things like automatic backups, snapshotting, ect. These aren't meant to track you, but if you're doing personal stuff on your computer, it's very easy to accidentally leak things into the company backup that you might not want there.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#283

Post by nix23 » Fri, Dec 17, 2021, 2:53 PM UTC

Stranger43 wrote: post #174

nix23 wrote: post #149

Earlier quoted context omitted.

Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.

Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.

If you can pay 7500$/y for spyware you can surely pay for a VDI-Product.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#284

Post by zivkovicp » Fri, Dec 17, 2021, 2:54 PM UTC

Personally I would simply refuse and prepare for the possibility that this company will no longer be a client... or charge more for the inconvenience and change in relationship status. I presume you freelance because of freedom to choose clients, projects, and terms.

If this is really just your employer (only client), but you have a "freelance" relationship for tax purposes or whatever, then you might want to consider whether you will be better off just getting a job.

As a software engineer, I assume you have employment options (there is demand everywhere it seems), so you can probably afford to do what makes you happy.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#285

Post by fallingknife_ » Fri, Dec 17, 2021, 2:56 PM UTC

Move on. There are so many job openings right now... Find someone better to work with.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#286

Post by Vendan » Fri, Dec 17, 2021, 2:57 PM UTC

lucraft wrote: post #250

too_pricey wrote: post #236

Earlier quoted context omitted.

You're completely right re Drata as a company (we use a different compliance vendor, but very similar setup re the agent). You're a bit off on whether this would fail a SOC2 audit, thankfully. As the OP said, they don't have access to production systems, which basically means you can treat that employee however you want from a SOC2 (and ISO, and most other control framework perspectives). The company OP is working fo…

Do you think? I wasn't sure because although he doesn't have access to production systems a lot of controls are around access to the code, e.g. Github. But quite possibly you are right.

I've been through SOC2 (sat in with auditors and walked them through pretty much all of our stuff around source code and testing and building things). SOC2 is very much a "do you have policies for x, y and z" and "are you actually implementing those policies", with a VERY HEAVY emphasis on "are you doing what you say you'll do". There's nothing that says "You must monitor any place your source code could exist", but there's plenty that says "You must have a policy for change management" and stuff like. And you'll get dinged hard if you have a policy that says "We monitor every device that has our source code on it" and then turn around and have contractors you don't monitor.

That said, it's also completely trivial (on the auditor side) for them to say "Oh, we're changing this policy to 'We monitor devices with production access'". Good luck pushing for that to happen as a contractor, though...

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#287

Post by _jwfergus » Fri, Dec 17, 2021, 2:57 PM UTC

#1 - every client gets their own VM. Unless it acts badly on my network, I'll install pretty much any requirement they ask me to on that VM.

#2 - if they require something specific in terms of hardware ("install this spyware directly on bare metal"), have the discussion about hardware setup cost/time and then expense them for the hardware you have to purchase.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#288

Post by cure » Fri, Dec 17, 2021, 3:00 PM UTC

formerly_proven wrote: post #249

lucraft wrote: post #186

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

> Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. In other words, Drata is a CYAaaS. > The Drata agent is a pretty innocuous thing. It checks you have done things like turn on disk encryptio…

> Guessing it is privileged and self-updating.

And closed source, of course. Must be totally free of bugs too, like all software.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#289

Post by sciurus » Fri, Dec 17, 2021, 3:00 PM UTC

My employer-provided computer runs multiple agents. They're only used for security auditing as far as I can tell.

One of them is reporting all the processes I'm running. Certain keywords will trigger IT to reach out to investigate.

Another of them is intercepting all my web traffic, even going as far as installing its own CA and decrypting SSL. It's fun when that hiccups and I start getting SEC_ERROR_REUSED_ISSUER_AND_SERIAL errors everywhere.

This provides great incentive for me to keep personal usage off my work computer.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#290

Post by kgwxd » Fri, Dec 17, 2021, 3:02 PM UTC

Not new, I've been working remotely on and off for 20 years, there's always something they want to install/control. I learned early on to require they give me a dedicated machine. It's just way too messy trying to use a personal (or other business) machine in an environment that requires that level of control. I've been offered the option to Remote Desktop into a VM the company controls but that always requires using their VPN (and sometimes requires a specific security suite be installed), same problem.