Make them provide you a laptop. Then only do work for them on that laptop.
Ask HN: My client want an agent on my laptop. Is this the new normal?
401–410 of 506 posts
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#402Make them provide you a machine. Don’t do any other work on the machine they provide.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#403If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…
^^^ - This!
You don't 'require' anything on equipment you don't provide. full stop. period.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#404Hi, Adam here, CEO at Drata.
While I don’t know all the details about this specific case, I want to clearly lay out and address some of the concerns and misinformation in your post. We believe trust is the most important aspect of any business, and it’s why we’ve ALWAYS made a point to be very transparent. As a company, we would never develop any software that does what you are claiming. In fact, Drata does just the opposite, by helping companies protect data.
First, we should address the WHY. In order to be SOC 2 compliant, one thing businesses need to do is ensure their employees’ and contractors’ computers are configured securely. The “agent” is one way Drata efficiently does this, especially for teams with remote employees.
Now, let’s look at the HOW:
- The Drata agent is a lightweight, read-only osquery based agent that reads system information such as hard-drive encryption, screen lock timeout, firewall status, etc. Drata collects that information to ensure companies are meeting their security/compliance requirements and so that these companies can prove their SOC2 obligations are being met during audits.
- Regarding the TOS, there is no monitoring or selling of your personal information. That is unequivocally false.
The question you asked Drata about over email was directly related to the TOS, and not the agent (though we’ve explained what the agent does above). As we stated, we don’t sell customer data. We never have and we never will.
I would be happy to chat more to address any concerns you have. You can reach out to me at adam [at] drata.com to chat anytime.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#405Earlier quoted context omitted.
> Not only that, in some EU countries it's even illegal for a freelancer to work for 1x customer. How does that work? Is it more "exclusively for one customer" similar to the how the IRS rules work?
Simply - if you are working only for a single customer within a certain time period/receiving the majority of your income from a single source, you are considered to be an undeclared employee and not really a freelancer (= business) - and that exposes both you and the company to big fines. It is not the only criteria for this but a pretty large one. Both France and Germany have such laws but other countries do too. T…
In France in practice you can work 2-3 years for the same client without too much problem from what I could see. They just make sure to change the mission once in a while, so that the contract does look like it's lasting too long.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#406It's normal but ask them for a work device. You shouldn't be expected to install this monitoring system on your own equipment.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#407Earlier quoted context omitted.
As others have said this area of SOC2 is often about "are you actually following the policies you've set" rather than "you have to do things this way" – most of our staff have company owned devices with MDM and an agent which mainly tracks installed applications versions, that Disk Encryption is turned on, and the OS patch level. But there are a couple of our contractors that rejected this for exactly this reason (th…
This. Every company I’ve ever worked at, and that includes very large ones, will have legal, HR, and finance tell you at some point that “you must do X”. Sometimes X is no big deal and you do it. Sometimes it’s hard, and you ask the business to fund it or remove the requirement. Sometimes it’s nonsensical in your context and at that point the job becomes understanding why X is a requirement and how you can satisfy th…
I had an employer that, once or twice a year would send out mandatory agreements we were "required" to sign-- under threat of dismissal. (I don't think this was legal at all).
One day they sent out a particularly onerous "agreement" that said that we agreed not to use a phone while driving a car and doing so would be cause for termination etc.
I went down to HR and asked them if they were really trying to regulate what I was doing in my personal vehicle with my personal phone and they replied "No, its only meant for when you're in a company vehicle or using a company phone."
But the agreement itself clearly stated any phone any car.
The workaround I came up with was this-- a friend of mine and I swapped forms, and signed each others names. HR had their illegal, unenforceable agreement, and life moved on.
I got my "revenge" 6 months or so later. HR was frantically calling me for some reason-- I was stuck on the freeway as is our custom in Orange County. I ignored them for something like two hours, and explained that "I was stuck in traffic and as they were no doubt aware, we are prohibited by company policy from using our phones while operating a vehicle."
The HR gal was visibly pissed off, but to be fair, I could have been fired for answering that phone call.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#408Earlier quoted context omitted.
Enforcing/auditing sane security settings on the device. Very much required for compliance, zero trust, protection of IP, and foundational to a reasonable security plan.
I think I added #4 after your comment. Which is essentially my response. It seems like a very weak measure, at the cost of privacy considering it's the worker's personal device... If our solution is to require separate devices anyway, then spyware seems like a waste of time, they should be providing secured hardware/OS. On second thought, this _is_ the answer... they are making a compromise on security, it's an econo…
Yes, it's definitely a economic decision. They're going to run this type of software on their own fleet and want it on everything connecting to the network. If you're willing to run it on your own device that saves them the hardware cost.
That said, a lot of users _want_ to use their own devices (maybe they have better equipment, maybe it's less locked down, maybe they don't want duplicates). It's not sane for the business to allow a device that is more likely to be compromised and/or have poor security hygiene on the network.
I'm a fan of privacy but... At least on my team, we're definitely not spying on you, we're making sure you have a password, encryption, antivirus, and updates installed before you can connect to resources. It's shocking how many people don't have authentication enabled and run as root, if they have a choice, on their home system. That said - we could flip switches and do a lot more spying if it was mandated :/
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#409Earlier quoted context omitted.
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.
That's a stretch. Most companies don't want to spy on their employees' free time. They want to 1- make sure they are compliant with the law and their confidential stuff is secure and 2 - make sure that you are actually working for them when you say you are. Installing something to listen to non-work related stuff serves neither of these goals, and would open them up to lawsuits and PR nightmares.
The people who decide the spyware must be installed are likely so far removed from the actual spyware and the people who admin it as to have no knowledge or understanding of the distinction.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#410Earlier quoted context omitted.
Network segmentation with vlan is what I would do.
This is what I do for a variety of different things: - $CORP devices are on a VLAN + Wifi that has access to the internet, but no other internal networks - Internal network for file servers/printers and the like - Personal device network, think laptops/phones/tablets that are mine, can reach internal network - IoT network - Think sensors/robot vacuums/"smart devices" - Guest network, for well visitors to my home - Ai…
Which TP-Link switch do you use?