Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

341–350 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#341
post #283

Earlier quoted context omitted.

Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.

If you can pay 7500$/y for spyware you can surely pay for a VDI-Product.

The problem is rarely the monetary costs alone it's more about the need for handling an one-off situation that require special policies, and becomes an special item on the budget.

For large companies supplying VDI to consultants tend to be an standardized package that gets billed back to whatever project is hiring the consultants but for mid-sized organisation VDI is a big scary word that's going to require special handling.

Most desktop support teams are completely dependent on standardization to the point where they tend to turn into complete control freaks, that panic at the thought of anything that is not "by the book", so they often just apply the book without additional budgets to external consultants.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#342

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

Go to your router's settings and create a separate wifi for just these work situations. Connect client hardware to that wifi only. This keeps them out of your LAN. If your router can't do this, get a better router.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#343

Earlier quoted context omitted.

> procuring the laptop might be a difficult thing for them to do bureaucratically Not if they are at the point where they need SOC2 cert, and where they install agents on their employees computers (and want to extend that to their suppliers).

My company is going through our SOC2 audit. We do not have such software and everyone is remote. I call BS as to the justification. This smells like a desire for corporate monitoring.

You're mostly wrong here. First: many, many companies install agents as one of their SOC2-stated controls. More importantly: depending on where they are in their SOC2 process --- ie, if they've already had their Type 1 --- they may essentially be required to keep instrumenting machines: once you state a control, it's a mess to get rid of it. You can't just decide to make a random exception for a noisy contractor.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#344

Earlier quoted context omitted.

SOC2 isn’t prescriptive. SOC2 is just a certification that you are following your own internal policies. If the company made the mistake of creating a policy that they use this software as one of their controls, then the auditor will ding them if they don’t use it. It’s an absurd system.

Yes and no. SOC2 doesn't say you need to install an agent, and may not be explicitly prescriptive about whether computers that have access to production data or systems need encrypted drives, screenlocks, etc. But a non-hack SOC2 auditor is going to expect you to have some reasonable policy and controls in that area. So yeah, the main thrust of SOC2 is "are you following your own internal policies", but the auditors…

More importantly: once you start using agents as a control, your auditor is very much going to expect you to be consistent about it; that's essentially the core thing SOC2 measures, is consistent enforcement of a documented policy. The whole point is not making random exceptions.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#345
post #299

Earlier quoted context omitted.

Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.

Or they reimburse the consultant when they procure their own dedicated laptop for the client's work.

Plus the 25% management fee on top of the price :-)

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#346

Earlier quoted context omitted.

My company is going through our SOC2 audit. We do not have such software and everyone is remote. I call BS as to the justification. This smells like a desire for corporate monitoring.

SOC2 isn’t prescriptive. SOC2 is just a certification that you are following your own internal policies. If the company made the mistake of creating a policy that they use this software as one of their controls, then the auditor will ding them if they don’t use it. It’s an absurd system.

The same thing happened in the early days of ISO 9000

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#347
Never heard of SOC 2 Cert. Its as disturbing as CSAM. Its basically as you put it bend over and take it compliance, total subjection based on a power imbalance.

I love the PR. Why is SOC2 important. Because relentless unrestricted spying allows you to foster a control system like never before over your pathetic serfs that dare wish to maintain a work life balance. When that project you forgot to assign goes over deadline use SOC2 to flay them with human resources over too many seconds of bathroom time causing the project to fall behind.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#348
It's not the new normal unless you let it be. If the other teams are mad, collude with them to refuse.

They're not a client if they can make you do this, they're your boss. So don't let them make you do it, because you're not their employee.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#349

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

> The Drata agent is a pretty innocuous thing.

Can anyone even verify that? Is it open source?

Last time I allowed one of these "agents" into my computer, I discovered it was running in kernel mode and intercepting every single network connection.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#350
post #24

Sounds like you'll be purchasing a new laptop for that client and bill them for the price of the laptop, and several additional hours on maintaining said laptop.

OP could just use virtual machines. I use my own equipment for my work and it's all on a VM. Everything work related is done on the VM. If I leave all I have to do is delete the VM.

OMG, a comment with a clue!
Post reply on HN