Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

461–470 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#461

Post by neonnomad »

jwithington wrote: post #306
lucraft wrote: post #262

Earlier quoted context omitted.

> I read their Privacy Policy. They are quite explicit about what they plan to do to you. OK, well, I've skimmed it and I can't see anything that suggests they are going to spy on our employees and sell the data to advertisers. I hate to drop it back on you but which passages make you think they do that? These things do often sound terrifying because things like "I'm going to use Google Analytics to see which parts o…

I think the OP is talking about the "How We Use Your Personal Information" on https://drata.com/privacy That would seem to only pertain to their website. Yes, they're going to want to market it to you, so that makes sense. The actual privacy policy for the product the OP is using is likely found in the contract Drata signed with the client company.

You are 100% correct.

Source: I am the Drata CISO

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#462

Post by neonnomad »

nyir wrote: post #359
cure wrote: post #288

Earlier quoted context omitted.

> Guessing it is privileged and self-updating. And closed source, of course. Must be totally free of bugs too, like all software.

At least it's using some OSS, like osquery, c.f. https://cdn.drata.com/agent/osquery/queries.json >, so you can easily see quite a bit of what it's going to gather.

It is based on osquery and we are happy to share any information including our third party security validation of the agent with prospects/customers.

Source: I am the Drata CISO

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#463

Post by incredimike »

gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

This is almost exactly what I said when I was asked to install end-to-end protection software into my laptop as a freelancer. I stood my ground and they understood. They initially said they would send me another laptop to work from, but eventually relented on the requirements altogether and just limited my access to customer data.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#464

Post by xtracto »

tptacek wrote: post #422
xtracto wrote: post #420

Earlier quoted context omitted.

Right, I setup SOC2 compliance processes for a small startup, and we didn't have money to buy all those fancy automation programs. We managed ourselves with recurring JIRA tickets and screenshots taken by personnel. I think the only service we had to pay was for security awareness training, and it was a site that provided security awareness videos..

This is what a lot of companies do for SOC2. There's a cottage industry of consultants and product vendors selling companies on the idea that SOC2 is difficult and needs bespoke automation, but plenty of companies get by with just Jira. For that matter: you probably didn't need to spend money on security awareness videos.

Ya, i bought knowbe4 because we also needed it for PCI compliance, and it made things easier for the IT/Sec team.

But you are right. All those ceryification companies are a mafia.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#465

Post by jjav »

qwerty456127 wrote: post #49
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

Don't put a work laptop on your internal home network!

I have a separate network for work machines at home, which goes straight to Internet and can't route in or out of my actual home network which is behind its own firewall.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#466

Post by jjav »

speedgoose wrote: post #138
eurasiantiger wrote: post #79

Earlier quoted context omitted.

You keep your work laptop in your home network? Tut tut.

If I couldn't trust my company on my home network, why would I work for them?

> If I couldn't trust my company on my home network, why would I work for them?

Your employer isn't your friend.

It might be an awesome company to work for perhaps, but it's still a company (unless you work for like a 2 person startup). A company subject to audits and regulations and all kinds of other pressures (some of them actually valid, though many are theater) to monitor and control data and flows on their hardware.

You don't want those monitors etc on your personal data and network which has nothing to do with work.

So, keep them separate is the best possible advice.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#467

Post by jjav »

illud_tempus wrote: post #3
mixmastamyk wrote: post #2

I would decline. There are other jobs out there. Another alternative might be to install it into a VM or old but freshly-paved computer.

So far my strategy is to just ignore it and pray that the problem goes away by itself. If I have to deal with it eventually - quitting is the most appealing option. However, the reason I asked here is to get a feeling about how common this thing is. Is this normal? Am I the rat in the lab, or am I just late to the party?

> So far my strategy is to just ignore it and pray that the problem goes away by itself. If I have to deal with it eventually - quitting is the most appealing option.

It won't go away by itself because if they're asking it means you are in their corporate directory and showing up as noncompliant in the Drata dashboard.

It's extremely normal on company hardware used for business purposes. The conflict here is trying to run multiple clients on the same personal hardware. Never do that.

If they're willing to give you a company-owned laptop, take that. Then it is their machine to configure however they like. If not, tell them you'll lease a laptop dedicated to them only and pass on the monthly cost (with some profit margin) as part of your monthly invoice.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#469

Post by illud_tempus »

neonnomad wrote: post #387
eknkc wrote: post #188

Drata has a web application where you can upload evidences of the requirements. The agent just makes it easier. If you are not comfortable, it should not be a big issue. You can choose not to install it and upload a couple screenshots of requested settings (having disk encryption enabled, having a password manager installed etc) periodically. If the client forces it that is a little unreasonable because drata tracks…

Just wanted to say thank you for this response around what the agent actually does, there is a lot of misinformation here around what the agent does and we are trying to clear that up.

> there is a lot of misinformation here around what the agent does

May be. May be not. I have not decompiled their client, so I don't know what it does. However, Dratas Terms Of Service states: "Drata will notify you of updates via an email or a notification on the platform. Unless the notice states otherwise, the updated terms of this Agreement will become effective and binding on the next business day after it is posted." I assume this is US business days. So I could be on Easter vacation in Romania, while they changed their contract.

Drata gives themselves the right to change what they call "the Agreement" virtually without notice. Unless I have a hook in my email client, and a bot looking for notifications on their "platform", and are ready to get up in the middle of the night to print out and read their new "Agreement" - they could fuck me any way they like. Including updating their client with one that does something entirely different than the one thy have today.

For a company with a mandatory service, they are surely engaging in a lot of dark anti-patterns. I don't believe for a second that they act in good faith. I don't trust them.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#470

Post by [deleted] »

illud_tempus wrote: post #469
neonnomad wrote: post #387

Earlier quoted context omitted.

Just wanted to say thank you for this response around what the agent actually does, there is a lot of misinformation here around what the agent does and we are trying to clear that up.

> there is a lot of misinformation here around what the agent does May be. May be not. I have not decompiled their client, so I don't know what it does. However, Dratas Terms Of Service states: "Drata will notify you of updates via an email or a notification on the platform. Unless the notice states otherwise, the updated terms of this Agreement will become effective and binding on the next business day after it is p…

[deleted]
Post reply on HN