Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

481–490 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#481

Post by illud_tempus »

kenrose wrote: post #221
daneel_w wrote: post #212

Earlier quoted context omitted.

> "The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". > Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my…

That’s not how burden of proof works. OP made a claim that Drata collects private employee info and resells it. That’s a large claim. It’s on OP to justify that position, not on the parent to rebut the opposite.

> OP made a claim that Drata collects private employee info and resells it. That’s a large claim.

What I know is:

1) They collect mandatory private information. They already know my name and my email, and they used that information to ask me to complete some tasks on their website. I don't know what those tasks are, because I first have to accept their TOS, which contains clauses that is referred to, but not disclosed. I declined.

2) Their "webpage" is part of their service. This is where I supply personal information (presumably more than they already have). So unless they have another TOS, after I accept the publicly available one, that's the rules: I have to give them personal data, because my employer (well, in my case it's my customer, not my employer - Drata have no agreement with my employer) signed a contract with them.

3) They give themselves the right, in the websites TOS, to sell my data.

So: 1 + 2 + 3 = Drata collects private employee info and resells it.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#482

Post by illud_tempus »

neonnomad wrote: post #383
_gsmq wrote: post #173

Watch out for what all permissions that software agent has. Big firms when they issue their own hardware often install such agents that have ability to not just monitor activity, but also wipe out data or change user account credentials. I personally find it weird if the ask is to install such agent on BYOD (personal device), since not just the company data, but your personal data can also be wiped out remotely, or y…

The agent is read-only and has no capability to wipe a device, it is a read-only agent that we have security validated with a third party. You can see my other responses in the thread around what it collects but it is just system information to ensure the device is meeting the appropriate security/compliance controls for the company to meet its compliance obligations. Source: I am the Drata CISO

> The agent is read-only and has no capability to wipe a device, it is a read-only agent that we have security validated with a third party.

And you can change that over night, without notice to anyone not actively monitoring your platform for such messages.

Why is that your policy.

You expect a high level of trust. And still you engage in dark anti-patterns that nukes any kind of trust for anyone who know how to read.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#483

Post by illud_tempus »

neonnomad wrote: post #378
ww520 wrote: post #17

It's not normal. Ask them if they and Drata are willing to be on the hook for all your potential bank breach in the future, as they are key-logging your online banking access. Ask them if they can put up a surety bond or insurance for any of your financial loss due to breach of privacy.

The Drata agent is a lightweight osquery agent that is read only that reads things like - screen saver timeout, auto-updates turned on, is AV software installed, etc. We collect that data to show the device is compliant with the companies policies and the compliance frameworks they have agreed to. The company this person contracts with requires the agent be installed to monitor compliance for all devices, employee an…

How does the agent know what user it is monitoring?

What other kinds of personal information does it process or collect, locally or in it's server endpoint?

An external IP address is personal information. A UUID identifying a block device is personal information. A hostname is personal information. Anything in "/usr/home" is personal information.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#484

Post by illud_tempus »

neonnomad wrote: post #458
more_corn wrote: post #314

Say no. Name and shame. The soc2 controls in question can be met with a handful of config changes and an antivirus install. (I’ve implemented soc2 controls five times) Full disk encryption with FileVault or Bitlocker Screen lock Enable automatic security updates Use of password manager Virus scan with ClamAv or windows defender. If they want an agent to make sure you’re working when you say you’re working I’d pass.

The Drata agent does exactly what you are talking about with a lightweight osquery based read-only agent. Literally just monitors some system settings like screen lock timeout, av-install, updates, etc. We collect that data to then be able to show your auditor you are meeting your controls. Source: I am the Drata CISO

> The Drata agent does exactly what you are talking about

Does it also name and shame? ;)

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#485

Post by Stranger43 »

physicsguy wrote: post #472
Stranger43 wrote: post #168

Under EU law that would potentially make you an employee rather then a contractor, as a major part of the destruction is control and time management and the more the Company wants to manage your equipment and time the more the balance swings towards employee status. This is also part of the reason why BYOD is going nowhere as the second the company wants to audit/control setting it's no longer "Your Own Device".

There’s not really blanket “EU law” on contractors, it’s up to the individual countries which all have wildly different tax and employment rules built on a small common base of employer regulation.

No but there is directives that greatly shape the individual member states laws on those subjects.

It's complicated and would probably require an law school Phd. dissertation to fully answer how the whole mess regarding when a single unincorporated freelancer becomes an employee but it's a really really good argument to throw at overly aggressive corporate compliance types trying to push remote control agents onto a freelancers personally owned laptop.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#486

Post by [deleted] »

adamdrata wrote: post #404

Hi, Adam here, CEO at Drata. While I don’t know all the details about this specific case, I want to clearly lay out and address some of the concerns and misinformation in your post. We believe trust is the most important aspect of any business, and it’s why we’ve ALWAYS made a point to be very transparent. As a company, we would never develop any software that does what you are claiming. In fact, Drata does just the…

[deleted]

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#487

Post by [deleted] »

mandelbrotwurst wrote: post #369
selfhoster11 wrote: post #211

Earlier quoted context omitted.

Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.

It also creates friction for the client, making it less likely that you get paid.

[deleted]

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#488

Post by illud_tempus »

adamdrata wrote: post #404

Hi, Adam here, CEO at Drata. While I don’t know all the details about this specific case, I want to clearly lay out and address some of the concerns and misinformation in your post. We believe trust is the most important aspect of any business, and it’s why we’ve ALWAYS made a point to be very transparent. As a company, we would never develop any software that does what you are claiming. In fact, Drata does just the…

Hi Adam. I appreciate that this issue caught your attention.

Question: If Drata is nice, why do you portrait yourself as evil in your TOS?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#489

Post by Siira »

pheleven wrote: post #408
tomxor wrote: post #399

Earlier quoted context omitted.

I think I added #4 after your comment. Which is essentially my response. It seems like a very weak measure, at the cost of privacy considering it's the worker's personal device... If our solution is to require separate devices anyway, then spyware seems like a waste of time, they should be providing secured hardware/OS. On second thought, this _is_ the answer... they are making a compromise on security, it's an econo…

Yes, it's definitely a economic decision. They're going to run this type of software on their own fleet and want it on everything connecting to the network. If you're willing to run it on your own device that saves them the hardware cost. That said, a lot of users _want_ to use their own devices (maybe they have better equipment, maybe it's less locked down, maybe they don't want duplicates). It's not sane for the bu…

Why don’t you write an opensource “agent” then, with no remote code execution capability? I doubt people would mind running some opensource bash script that hardens their devices.

Anything but this, and it’s clear you’re just evil.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#490

Post by wkrsz »

luma wrote: post #197
secondcoming wrote: post #162

Earlier quoted context omitted.

OP could just use virtual machines. I use my own equipment for my work and it's all on a VM. Everything work related is done on the VM. If I leave all I have to do is delete the VM.

I'm surprised I had to scroll this far into the comments to find this obvious answer. Each of my customers has a dedicated VM and I compartmentalize all sensitive data into each environment. In this manner, I can run each customer's goofy VPN client, endpoint scanning, device policy compliance etc without any of it touching my primary system. If there is some security exposure in one of the VMs, it won't impact my pr…

Do you have Drata (the software mentioned by OP) installed in any of your VMs? Does it complain that it's installed in a VM?

I've read that Valorant refuses to work on VMs and requires full hardware access for its anti-cheat software. I can imagine "corporate security" agent software doing the same.

Post reply on HN