I don't know anything about Drata but these packages are usually a small step away from malware if they haven't already crossed that line. If you have to do this then insist your employer ships you a laptop that you will use exclusively for the work you do for them. Your device: your rules. Their device: their rules.
Ask HN: My client want an agent on my laptop. Is this the new normal?
331–340 of 506 posts
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#332Send them a bill for a new dedicated laptop and extra time for setup and drop in development efficiency?
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#333Personally I would simply refuse and prepare for the possibility that this company will no longer be a client... or charge more for the inconvenience and change in relationship status. I presume you freelance because of freedom to choose clients, projects, and terms. If this is really just your employer (only client), but you have a "freelance" relationship for tax purposes or whatever, then you might want to conside…
> Personally I would simply refuse and prepare for the possibility that this company will no longer be a client
That is the easy solution. Problem is, I really like the projects I work on and the people I work with.
Economically, I could drop out at any time.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#334Earlier quoted context omitted.
> If you are a freelancer then your contract should allow you to do work for others Not only that, in some EU countries it's even illegal for a freelancer to work for 1x customer.
> Not only that, in some EU countries it's even illegal for a freelancer to work for 1x customer. How does that work? Is it more "exclusively for one customer" similar to the how the IRS rules work?
Simply - if you are working only for a single customer within a certain time period/receiving the majority of your income from a single source, you are considered to be an undeclared employee and not really a freelancer (= business) - and that exposes both you and the company to big fines. It is not the only criteria for this but a pretty large one.
Both France and Germany have such laws but other countries do too.
The point is that many companies would otherwise stiffle workers by forcing them into becoming freelancers because then they don't have to provide legally prescribed healthcare benefits, paid vacation, contributions to pension, etc. that employees get.
And at the same time those workers don't have really the position to meaningfully negotiate their contracts to e.g. include extra pay for that missing vacation or healthcare/pension insurance. I.e. we are not talking about IT consultants but delivery drivers, cleaners, etc. - low paying jobs.
I.e. Uber's business model - and that's exactly why it was banned/had big problems in many EU countries (in addition to completely flouting the existing taxi service regulations).
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#335Why not just run a VM for their stuff and install it there. You can block the camera and microphone from the host. Do you work in the VM.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#336Earlier quoted context omitted.
> procuring the laptop might be a difficult thing for them to do bureaucratically Not if they are at the point where they need SOC2 cert, and where they install agents on their employees computers (and want to extend that to their suppliers).
As others have said this area of SOC2 is often about "are you actually following the policies you've set" rather than "you have to do things this way" – most of our staff have company owned devices with MDM and an agent which mainly tracks installed applications versions, that Disk Encryption is turned on, and the OS patch level. But there are a couple of our contractors that rejected this for exactly this reason (th…
This.
Every company I’ve ever worked at, and that includes very large ones, will have legal, HR, and finance tell you at some point that “you must do X”. Sometimes X is no big deal and you do it. Sometimes it’s hard, and you ask the business to fund it or remove the requirement. Sometimes it’s nonsensical in your context and at that point the job becomes understanding why X is a requirement and how you can satisfy that requirement in some more pragmatic way.
At the end of the day, these functions are there to support the business.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#337"Agent"? Yet another name for malware.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#338If all else fails, consider spinning up a virtual machine just for that client, and do all work, install all required apps for that client inside that VM only. I am truly shocked at all the outrage posts with no mention of this.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#339Earlier quoted context omitted.
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.
It's a widespread practice that companies provide laptops to contractors to compartmentalize the way they interact with the company's IT. But I'm really quite opposed to it. At one point I had 3 sets of machines: Two different 14" laptops from two different clients and my own machines. At some point you simply run out of space on your desk and end up constantly either working on screens that are too small (14" really…
If you can afford to spend a bit of money on the problem, it's possible to use something like PiKVM or KVM-over-IP to just leave a stack of client laptops or mini-PCs out of the way somewhere and connect to them remotely in a reliable way, so you can reset the machine if the remote desktop software fails.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#340It's not the "new" normal. It's a very old normal.
I spent about 15 years consulting, on short- to medium-term often-recurring projects. Most clients didn't ask vendors to instrument their machines. Some did; for those clients, the solution tended to be that the client provided us with a machine to work on.
Most of these agents are truly awful. I don't know anything about Drata. You should not be psyched to have that running on your machine; I would isolate it somehow so that it's only in contact with that one client's workload.
But they're not making up the SOC2 thing. It's pretty likely they won't budge from this, not because they really care about the agent thing, but because they really do have a documented SOC2 process with "agents on desktops" as a stated control (almost everybody with SOC2 has some kind of agent somewhere, though you usually hope it's just MDM). They do not have a choice about whether to tool you up; your choice is likely just to stop working for them or not.