Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#61

Post by endofreach »

qwerty456127 wrote: post #49
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

Capture traffic and sue the f outta everything they do that‘s not covered by a contract.

Someone has to start stopping this madness and protect less informed people. We are all steering into a dark future. And i lose hope when i see all these smart programmers complaining but not stepping up.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#62

Post by gnfargbl »

xyst wrote: post #58
qwerty456127 wrote: post #49

Earlier quoted context omitted.

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

Network segmentation with vlan is what I would do.

Yep, exactly. I used to put client devices on a segregated network and tunnel their traffic out to pfSense running on a cheap cloud box somewhere. Worked well.

(I should say that intentional monitoring of my private comms was never a concern for me when I freelanced, but I was somewhat worried about infections in my clients' devices moving laterally to my home network.)

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#63

Post by bell-cot »

zaphirplane wrote: post #41

They provide a laptop not on your personal machine because you other client data, right

This. If "work [...] as a freelancer" means that you are not their employee, and they need the legal fiction that you normally have other 'clients' who you freelance for... If they do not provide the laptop, do they mind if your other clients also have agents & such on your machine?

If they are honest about this, then providing you with a nice laptop would be far cheaper than dealing with multiple-agent issues. Let alone getting into "how do we need to do this, to comply with laws & regulations?" conversations with lawyers. If they are not honest...

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#64

Post by illud_tempus »

jevoten wrote: post #32
ww520 wrote: post #17

It's not normal. Ask them if they and Drata are willing to be on the hook for all your potential bank breach in the future, as they are key-logging your online banking access. Ask them if they can put up a surety bond or insurance for any of your financial loss due to breach of privacy.

I believe reducing loss of privacy to only financial costs is the wrong approach. How will you quantify this cost when, for example, Drata runs some fancy ML algorithm on the gathered data, and starts offering employers a "unionization risk" score for new hires that they have intel on? What do you do when being without an evaluation by some spy company like Drata, since you're so privacy conscious, itself becomes a b…

> Rights should not be thought of in terms of their financial cost.

Agree!

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#66

Post by imhoguy »

A middle ground solution may be to use virtual machine on your computer or e.g. ask for access to AWS Workspace under their control.

The customer provided me an image with all necessary licensed software I need to use to provide the service, including software to connect to their production infra via VPN and encrypted filesystem. They don't have access to camera, mic, my private system or LAN (use NAT mode). Clipboard sharing is set with guest to host direction only. I can filter out any call home stuff I don't like on my router unless it goes thru their VPN. I Zoom them with my host system, then do screen-sharing of virtual machine window only.

In my opinion separating customer gigs with VMs in general is a safe way to prevent accidental cross-customer data leak. Of course it depends on kind of work you do and software you use, however personal licenses often allow to use software on multiple devices by the same person.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#67

Post by Falkon1313 »

If they own the laptop, they can request you to install anything they want on it, including spyware.

If it's your own laptop, you don't have to do that. That's yours, not their property. They can provide you with one configured as they request, or provide it and ask you to configure it that way. Or you could set up a VM for it.

Corporate spyware is kinda common nowadays. It's mildly annoying but mostly unlikely to be a problem in many/most places. Mostly just there to deal with problem situations.

And you mention that your client wants SOC 2 certification - chances are they'll never actually bother hiring someone to watch what you do on your computer, they just want to be able to check off a box on a form that says "yeah we do this, and all our employees have this thing installed, so we have central control of our data." to get the certification. Because that's what it's about. But also it's just bureaucracy, and probably just checking that box is all they care about so they can tell their clients/customers that their solution is officially certified safe. A lot o' stuff like that is driven by, and ultimately, just feature checklists.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#70

Post by SkyMarshal »

gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it.

I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

Post reply on HN