Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

361–370 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#361

Post by jcims »

bigbillheck wrote: post #356
biztos wrote: post #167

Earlier quoted context omitted.

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…

> I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically That's not OP's problem.

It is if OP loses work because of it.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#362

Post by MeinBlutIstBlau »

In the US, a company cannot mandate that stuff if you are in fact an independent contractor. If they get to monitor your actions, you've got a strong rationale for claiming you are in fact an employee.

Lot of companies like to pull this BS thinking independent contractors are just cheap employees. They are in reality, wholly autonomous individuals that operate within the grounds of a contract. If I have to give them a product in X months, go dark for all X, then give them exactly what they needed in X months, I have fulfilled my obligations. They absolutely cannot monitor or manage you at all.

I would tell them to get renegotiate the contract or get bent. They can demand all the oversight they want, but I'd explicitly state that they are monitoring me like a W-2 employee and not a 1099 independent contractor (like that explicit). This would ruffle some feathers but I'd make that clear so they know I'm not afraid to walk away. Some schmuck isn't going to pretend he cant just walk all over me just cause he has money. Having to screw around and find another vendor that can deliver something for them in the time they need it is just as important as getting it for the price you pay.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#363

Post by citizenpaul »

biztos wrote: post #167
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…

Also as a freelancer you may end up with a farm of a dozen single purpose laptops....

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#364

Post by xnyan »

lambdaba wrote: post #240
gnfargbl wrote: post #62

Earlier quoted context omitted.

Yep, exactly. I used to put client devices on a segregated network and tunnel their traffic out to pfSense running on a cheap cloud box somewhere. Worked well. (I should say that intentional monitoring of my private comms was never a concern for me when I freelanced, but I was somewhat worried about infections in my clients' devices moving laterally to my home network.)

As someone who isn't well versed in networking could you describe your setup in overview? Like, what software/hardware, etc.? Thank you

Mini-rant: people on hacker news frequently undervalue their knowledge and don't consider the things they know to be of much worth. A classic example of this is the "I can't see why dropbox is a thing, simply build a cloud file sync service - easy" post. This poster is running their own semi-professional router (pfsense) on whitebox hardware. I would not want to do that unless I already knew what I was doing or wanted to spend some time learning.

The type of network segmentation being discussed is not rocket science, but it's not trivial either. VLAN segmentation can have tricky edge cases that cause things to break in a non-obvious way, nothing that can't be worked around but for someone who "isn't well versed in networking" would probably be more than you're up for. Also keep in mind that you can't do this with most consumer networking gear becasue it's too complicated to setup and support without some experience and knowledge.

I'd not recommend VLAN segmentation unless you want to become someone who is more versed, which I don't oppose, but it's not a switch you can flip in 5 seconds and never think about it again.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#365

Post by neverartful »

formerly_proven wrote: post #223
allarm wrote: post #183

Earlier quoted context omitted.

Not really. VLAN provides segmentation, but it does not provide any mechanisms to limit access to other vlans in your network - which are most likely routed by your router. You will need to add some L3 filtering (acls/iptables/whatever) to isolate segments.

That's only true if use of VLAN tags is controlled by hosts; if you use a smart switch to assign VLANs to ports it's pretty much as-if you have multiple, physically separated networks.

Sounds like a great approach. Any recommendations for such a switch for WFH?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#366

Post by Gareth321 »

lucraft wrote: post #186

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

>We do not share your personal information with third parties without your consent, except in the following circumstances or as described in this Privacy Policy: Affiliates. We may share your personal information with our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy. Service providers. We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate the Service (such as customer support, hosting, analytics, email delivery, marketing, and database management services). These third parties may use your personal information only as directed or authorized by us and in a manner consistent with this Privacy Policy, and are prohibited from using or disclosing your information for any other purpose. Partners. We may sometimes share your personal information with partners or enable partners to collect information directly via our Service. Professional advisors. We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us. For compliance, fraud prevention and safety. We may share your personal information for the compliance, fraud prevention and safety purposes described above. Business transfers. We may sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.

That is in their privacy policy (https://drata.com/privacy). They go into even more detail about the advertising they serve to you based on the information they collect. They suggest a drawn-out method to opt out of their advertising tracking. Honestly, this alone would rule out Drata for any similar project I was considering. How in the world is it acceptable for a security and compliance tool to gather and store personal data for the purposes of marketing?? With all due respect, how did you miss this???

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#368

Post by neverartful »

windex wrote: post #159

Ask for a separate work laptop from them, put it on a different VLAN without access to local resources. Do not login to anything personal on it. That's what I currently do. I also keep it in an office room away from living areas of the house. The VLAN also shuts access to the internet 90 minutes after working hours.

Can you elaborate a bit more on your setup? What switch do you use?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#369

Post by mandelbrotwurst »

selfhoster11 wrote: post #211
biztos wrote: post #167

Earlier quoted context omitted.

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…

Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.

It also creates friction for the client, making it less likely that you get paid.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#370

Post by ganoushoreilly »

_fat_santa wrote: post #325
spookthesunset wrote: post #313

Earlier quoted context omitted.

And hey, when the gig is over you got a new laptop that just needs to be formatted and it's all yours!

At my agency we have a client that always ships us locked down laptops (healthcare space so understandable). Thing is this client, while very good at getting the laptops out to you, is horrible at actually getting them back and pretty much lets you keep them....I have 4 Macbook Pro's sitting on a shelf behind me, all from this client.

Are they all still locked to an MDM profile, if so while they're yours, at any point you could lose access to them and that sucks. There's a ton of laptops that have been up on Ebay that ended up having mdm. We bought a few on accident for our non-profit. Fortunately we were able to find the original owners and they were gracious to remove them. We were also lucky they hadn't been disabled. Thing is most people don't realize that when you restore / setup that laptop it will pull that profile regardless of how you wipe or clear it.

TLDR; Make sure MDM profiles are gone and the laptops are cleared before doing anything personal :D

Post reply on HN