Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

471–480 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#471

Post by [deleted] »

neonnomad wrote: post #387
eknkc wrote: post #188

Drata has a web application where you can upload evidences of the requirements. The agent just makes it easier. If you are not comfortable, it should not be a big issue. You can choose not to install it and upload a couple screenshots of requested settings (having disk encryption enabled, having a password manager installed etc) periodically. If the client forces it that is a little unreasonable because drata tracks…

Just wanted to say thank you for this response around what the agent actually does, there is a lot of misinformation here around what the agent does and we are trying to clear that up.

[deleted]

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#472

Post by physicsguy »

Stranger43 wrote: post #168

Under EU law that would potentially make you an employee rather then a contractor, as a major part of the destruction is control and time management and the more the Company wants to manage your equipment and time the more the balance swings towards employee status. This is also part of the reason why BYOD is going nowhere as the second the company wants to audit/control setting it's no longer "Your Own Device".

There’s not really blanket “EU law” on contractors, it’s up to the individual countries which all have wildly different tax and employment rules built on a small common base of employer regulation.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#473

Post by speedgoose »

jjav wrote: post #466
speedgoose wrote: post #138

Earlier quoted context omitted.

If I couldn't trust my company on my home network, why would I work for them?

> If I couldn't trust my company on my home network, why would I work for them? Your employer isn't your friend. It might be an awesome company to work for perhaps, but it's still a company (unless you work for like a 2 person startup). A company subject to audits and regulations and all kinds of other pressures (some of them actually valid, though many are theater) to monitor and control data and flows on their hard…

Yes my company monitors the network at work and on my work computer, as they must do so.

But they are not allowed to scan my home network and other devices, and they have no reason to break the law. I trust them to not do that more than half of the devices running on my home network.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#474

Post by illud_tempus »

neonnomad wrote: post #379
shaicoleman wrote: post #112

A monitoring agent is used on platforms such as UpWork, where you often deal with untrusted contractors for hourly contracts. That is a part of the contract that both sides need to agree on before starting any work. The screenshots can then be as part of the dispute resolution process, and can also protect the contractor in case of disputes from unscrupulous companies. The agent captures screenshots every few minutes…

Just to be clear the Drata agent never captures screenshots of the desktop or anything of the sort. It is a lightweight osquery agent that reads system information like patching, screen lock, firewall status, etc. We collect that information for security/compliance purposes so companies can ensure they are meeting their internal controls as well as formal compliance frameworks such as SOC2. We are happy to share our…

> We are happy to share our security validation report of the agent as well as the configuration with any prospects/customer.

I am the OP. I am not your customer. My customer is your customer. My customer wants me to install your agent.

When I contacted Drata on email with some concerns before I accepted your terms and conditions (which I will never accept in its current form) and got any real information about your agent, your secretary responded: "Feel free to reach out to your Drata administrator internally with concerns. Do note, that when your company contracted with Drata, any edits or redlines they provided will prevail for all employees of your company."

That is not very reassuring for a company (Drata) that want me to accept undisclosed terms and conditions, wants to sell my personal data to targeted marketing, reserves the right to change the user agreement over night, and who exploits a loophole in GDPR so you can move my personal data out of EU and do things with it that would be a crime in EU.

I interperate that reply, from your secretary, as: "We already sold our thing to your company, so we don't care. Not about you. Not about your company. Bend over and take it like a good bitch!"

As others have suggested here; if you want people to trust your agent, you should open source it, have it audited, and publish the audit reports.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#475

Post by illud_tempus »

byron4242 wrote: post #448
ganoushoreilly wrote: post #440

Earlier quoted context omitted.

You can disagree with the expectation of privacy but it’s been held up in court multiple times that personal actions ok a corporate resource are not protected. Ideologies and realties are different. If you care about personal data, don’t put it on the company. The company however has a huge liability with your personal data. I’ve mentioned else where I have dealt with issues of personal data becoming an issue for the…

We're agreed that separation of work and private spheres is good practice. But I'm not sure what country and what legal concept it is that you are referring to when you say "it's been held up in court multiple times that..." I'm based in Germany and have recently undergone GDPR-related training with a lawyer specializing in privacy law. In the training, the lawyer explained court cases that involved regrettable inter…

Very informative. Thanks.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#476

Post by [deleted] »

secondcoming wrote: post #162
vegai_ wrote: post #24

Sounds like you'll be purchasing a new laptop for that client and bill them for the price of the laptop, and several additional hours on maintaining said laptop.

OP could just use virtual machines. I use my own equipment for my work and it's all on a VM. Everything work related is done on the VM. If I leave all I have to do is delete the VM.

[deleted]

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#477

Post by illud_tempus »

neonnomad wrote: post #461
jwithington wrote: post #306

Earlier quoted context omitted.

I think the OP is talking about the "How We Use Your Personal Information" on https://drata.com/privacy That would seem to only pertain to their website. Yes, they're going to want to market it to you, so that makes sense. The actual privacy policy for the product the OP is using is likely found in the contract Drata signed with the client company.

You are 100% correct. Source: I am the Drata CISO

> You are 100% correct. > Source: I am the Drata CISO

May be you should go over your user agreement documents and:

1) Make sure that all relevant information is available, so a user can make an informed decision.

2) Distinguish between the user roles, and have different agreements for the different roles. One role is your customer. A second role is the employee of your customer. A third role is the contractor for your customer. A potential fourth role is the person(s) working for the customer that is responsible for dealing with personal and confidential information related to you, employees and contractors.

As of today, your user agreement is a mess, appearing as something you have copied and pasted together without much thought, except for how to cover your own asses. Including the ridiculed clause Microsoft is infamous for, warning that your software is unfit and unusable for any purpose.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#478

Post by [deleted] »

neonnomad wrote: post #459
dalai wrote: post #382

Earlier quoted context omitted.

The first paragraph says that it is the privacy policy with respect to the website. Why do you think it covers the data collected by the agent?

This is correct. The privacy policy listed here is for the website. Source: I am the Drata CISO

[deleted]

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#479

Post by illud_tempus »

neonnomad wrote: post #459
dalai wrote: post #382

Earlier quoted context omitted.

The first paragraph says that it is the privacy policy with respect to the website. Why do you think it covers the data collected by the agent?

This is correct. The privacy policy listed here is for the website. Source: I am the Drata CISO

> This is correct. The privacy policy listed here is for the website.

Is that the 100% honest answer?

From my understanding, your website is where you collect my mandatory personal information, if I agree with your TOS. It's not just a glossy brochure for your product - it is your product.

I cannot choose what I share with you. But you can choose with whom you share what information I provide. And from your websites TOS, you seem very eager to share it.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#480

Post by illud_tempus »

dalai wrote: post #382
Gareth321 wrote: post #366

Earlier quoted context omitted.

>We do not share your personal information with third parties without your consent, except in the following circumstances or as described in this Privacy Policy: Affiliates. We may share your personal information with our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy. Service providers. We may share your personal information with third party companies and individuals…

The first paragraph says that it is the privacy policy with respect to the website. Why do you think it covers the data collected by the agent?

> Why do you think it covers the data collected by the agent?

The agent is not the only concern. Before you even get to install the agent, you have to provide personal information to their website (I believe - I don't now, because I rejected the TOS and don't have access to the non-public part of their website).

The thing is - Drata collects mandatory information from their customers employees and contractors trough their website. The TOS for the website is explicit about how they plan to use that information.

Post reply on HN