Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#51

Post by illud_tempus »

eksapsy wrote: post #46

I know people who work for Fortune 500 companies who don't have such crap installed in their company laptops, and they mainly work remotely. I also work remotely and I dont have such thing installed either. Installing agents is a sign that the company doesn't value trust with their employees and treats them as liabilities. Companies that made me an offer who had asked me if I would have an issue installing an agent j…

Have you been met with such expectations often?

I have been a developer for more than 3 decades, and I have never even heard about it before.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#53

Post by yjftsjthsd-h »

illud_tempus wrote: post #27
MarkSweep wrote: post #15

Earlier quoted context omitted.

I second this. Create a VM for work or a VM per client. It makes it much easier to say “I don’t have any of your intellectual property” at the end of your contract when you can delete the whole VM.

That's what I do today. One VM per customer, on a pretty decent workstation. My host file system is encrypted. If I install the agent, it will complain about the VM's file system not being encrypted. If I double encrypt, compilation times will go up quite a bit. Besides, running the agent in a VM will just be theater. If the host machine is compromised, no security in the VM will mean anything. I could just as well r…

> If I double encrypt, compilation times will go up quite a bit.

And that's the (poor) choice the company gets to make. Document/communicate that they're getting less work per money and let them deal with it.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#54

Post by yjftsjthsd-h »

jusonchan81 wrote: post #22

The agent isn’t mandatory for SOC2, there is an option to just upload screenshots of settings periodically. I had the same situation and I opted to upload the screenshots.

What control is that for? I've worked at multiple SOC2 shops and not encountered any such requirement.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#55

Post by benjaminwootton »

I would buy another laptop specific for that customer.

You can then either build the cost into your rates or suggest you bill them for it. You could even sell the laptop when the project ends.

Of course you can also be principled over it if you don’t need the work. It is after all a B2B relationship.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#57

Post by illud_tempus »

zepolen wrote: post #18
illud_tempus wrote: post #7

Earlier quoted context omitted.

My client is quite reasonable, and is willing to compensate a new laptop. It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country. However, I still don't like th…

Just get the laptop, use it for work only. This is the best way forward. They are looking for their interests (minimize security breaches) and that's a perfectly understandable position and solution to the problem. In this day and age the risk from a breach is much larger than in the past. Since they are willing to provide the necessary equipment for that then there is no issue from your end.

> They are looking for their interests (minimize security breaches)

No. This comes from the sales people. They want to provide a "SOC 2 Audited" certificate to their potential customers. They don't give a rats ass about actual security.

The upper management does care about security. But I don't think this particular requirement offer much of that.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#58

Post by xyst »

qwerty456127 wrote: post #49
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

Network segmentation with vlan is what I would do.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#59

Post by noisy_boy »

GianFabien wrote: post #23
illud_tempus wrote: post #13

Earlier quoted context omitted.

> Soc compliance is not ensured by spying on employees activities That part is clearly Security Theater. Having worked with real security for decades (consulting, training, building server monitoring and alerting tools, building commercial firewalls) I get quite provoked by fake security. For example, this "agent" checks for disk encryption. It does not check for password strength, or even if there is a password (you…

Had a quick look at drata.com. Looks like vendorware. Some manager got hoodwinked into buying the product to justify their existence. Now they have to force everybody to use it to justify the exorbitant price.

> hoodwinked

Or they just saw an opportunity :)

Post reply on HN