Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

391–400 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#391

Post by ArchOversight »

xnyan wrote: post #364
lambdaba wrote: post #240

Earlier quoted context omitted.

As someone who isn't well versed in networking could you describe your setup in overview? Like, what software/hardware, etc.? Thank you

Mini-rant: people on hacker news frequently undervalue their knowledge and don't consider the things they know to be of much worth. A classic example of this is the "I can't see why dropbox is a thing, simply build a cloud file sync service - easy" post. This poster is running their own semi-professional router (pfsense) on whitebox hardware. I would not want to do that unless I already knew what I was doing or wante…

I very much agree with this. I don't think that this is the solution for most home users/consultants working from home.

The more obvious solution would be to get a separate WiFi router and internet connection strictly for work purposes.

At that point you could also consider it a 100% home office expense and it may be tax deductible (talk to your accountant).

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#392

Post by mandelbrotwurst »

swagasaurus-rex wrote: post #373
mandelbrotwurst wrote: post #369

Earlier quoted context omitted.

It also creates friction for the client, making it less likely that you get paid.

Wouldn't the source of the friction be them asking to install spyware on your personal machine?

There are multiple points of friction in this scenario. Their asking you to install spyware is friction for you, your asking them to buy a laptop is friction for them.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#393

Post by ArchOversight »

formerly_proven wrote: post #223
allarm wrote: post #183

Earlier quoted context omitted.

Not really. VLAN provides segmentation, but it does not provide any mechanisms to limit access to other vlans in your network - which are most likely routed by your router. You will need to add some L3 filtering (acls/iptables/whatever) to isolate segments.

That's only true if use of VLAN tags is controlled by hosts; if you use a smart switch to assign VLANs to ports it's pretty much as-if you have multiple, physically separated networks.

You'd still need the router to tag/untag those VLAN's and allow traffic to flow. So if the router does VLAN tagging but just routes between the different network segments you haven't fixed anything.

You'd also need a firewall, and to configure it correctly.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#394

Post by exikyut »

biztos wrote: post #167
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…

> Someday you will have an arm full of Apple Watches, one for each client.

Noooo. Armfuls of watches are just for hilarious movies and such. It's not supposed to have a corporate elementttt. The cyberpunk vibes are too much with this.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#395

Post by andrewzah »

byron4242 wrote: post #163
SkyMarshal wrote: post #70

Earlier quoted context omitted.

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

It's a widespread practice that companies provide laptops to contractors to compartmentalize the way they interact with the company's IT. But I'm really quite opposed to it. At one point I had 3 sets of machines: Two different 14" laptops from two different clients and my own machines. At some point you simply run out of space on your desk and end up constantly either working on screens that are too small (14" really…

"either working on screens that are too small (14" really isn't enough to be productive)"

I work primarily from a 13" xps. Given the high-res display + that I can switch desktops easily via i3, it's really a non issue for what I do.

You can also use a dock. For my work laptop, I use the Caldigit TS3+ thunderbolt and it's great.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#396

Post by 2Gkashmiri »

ganoushoreilly wrote: post #370
_fat_santa wrote: post #325

Earlier quoted context omitted.

At my agency we have a client that always ships us locked down laptops (healthcare space so understandable). Thing is this client, while very good at getting the laptops out to you, is horrible at actually getting them back and pretty much lets you keep them....I have 4 Macbook Pro's sitting on a shelf behind me, all from this client.

Are they all still locked to an MDM profile, if so while they're yours, at any point you could lose access to them and that sucks. There's a ton of laptops that have been up on Ebay that ended up having mdm. We bought a few on accident for our non-profit. Fortunately we were able to find the original owners and they were gracious to remove them. We were also lucky they hadn't been disabled. Thing is most people don't…

woo... linux and windows don't have that, at least not windows yet. you never know.... they might make uefi behind a subscription making mdm thing over to windows/linux side

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#397

Post by pheleven »

tomxor wrote: post #386
biztos wrote: post #167

Earlier quoted context omitted.

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…

> You should embrace this future and price it in. Should we though? what you and the parent outline is a most sensible way of accommodating it while minimising invasion of privacy, however I question the underlying reasoning, and therefore whether or not we should encourage it. What perceived gains are to be had beyond merely box checking for accreditations? and in those cases why is it part of those accreditations,…

Enforcing/auditing sane security settings on the device.

Very much required for compliance, zero trust, protection of IP, and foundational to a reasonable security plan.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#398

Post by marcosdumay »

citizenpaul wrote: post #363
biztos wrote: post #167

Earlier quoted context omitted.

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…

Also as a freelancer you may end up with a farm of a dozen single purpose laptops....

All rented out? Seems like an easy win on the PaaS market (and make enough profit on them).

Just remember to put some customized adhesives telling what laptop is rented to what customer.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#399

Post by tomxor »

pheleven wrote: post #397
tomxor wrote: post #386

Earlier quoted context omitted.

> You should embrace this future and price it in. Should we though? what you and the parent outline is a most sensible way of accommodating it while minimising invasion of privacy, however I question the underlying reasoning, and therefore whether or not we should encourage it. What perceived gains are to be had beyond merely box checking for accreditations? and in those cases why is it part of those accreditations,…

Enforcing/auditing sane security settings on the device. Very much required for compliance, zero trust, protection of IP, and foundational to a reasonable security plan.

I think I added #4 after your comment. Which is essentially my response. It seems like a very weak measure, at the cost of privacy considering it's the worker's personal device... If our solution is to require separate devices anyway, then spyware seems like a waste of time, they should be providing secured hardware/OS.

On second thought, this _is_ the answer... they are making a compromise on security, it's an economic decision. Maybe it makes sense from a business perspective: check some boxes, get a bit of security (not much) for almost nothing - but as you can probably tell, I think it's both pretentious and disrespectful.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#400

Post by TimButterfield »

Use a VM (local or in the cloud). I do this for each client. If they have certain software, such as VPN, RDP launcher, etc., it gets installed in the VM. If they wanted an agent in the VM, I would add that also. This protects my main system from their software and, once the project is over, I can easily archive or delete the VM and not worry about a corrupted or compromised local system.
Post reply on HN