Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#71

Post by jhoelzel »

I have been tasked to write software like this for a couple of clients throught my carrer and once I even made a working prototype in C# for Windows. which turns out is not so hard.

The reality is though, after i had completed the intial client-app for the Pc's I called the client and terminated the project. He was not to happy about it and a lengthy discussion about whats right or wrong about it ensured. We agreed that it is really not neccesairy and also unwanted surveillance. so i was happy and the code has been scrapped.

....Until his inhouse staff taught him how to read the logins from the actice directory....

Truth be told, if they supply the hardware and you consent to it( at lesat in europe), they are within their rights. If you think its right and give your consent to it, is up to you though

PS: A permanently running agent is most likely to make screencaps too.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#72

Post by zby »

illud_tempus wrote: post #57
zepolen wrote: post #18

Earlier quoted context omitted.

Just get the laptop, use it for work only. This is the best way forward. They are looking for their interests (minimize security breaches) and that's a perfectly understandable position and solution to the problem. In this day and age the risk from a breach is much larger than in the past. Since they are willing to provide the necessary equipment for that then there is no issue from your end.

> They are looking for their interests (minimize security breaches) No. This comes from the sales people. They want to provide a "SOC 2 Audited" certificate to their potential customers. They don't give a rats ass about actual security. The upper management does care about security. But I don't think this particular requirement offer much of that.

I googled "SOC 2 Audited" - and I've got: """ A SOC 2 audit is a company-wide certification that evaluates an organization's standards regarding its core data security infrastructure, information handling practices, consumer privacy, and confidentiality. For this purpose, an SOC 2 auditor needs to evaluate various aspects of a company's systems and processes """ So it is about security. I guess your point is that it is just a security theatre and not related to the real thing - but that is a different discussion. It would be a discussion about https://slatestarcodex.com/2014/07/30/meditations-on-moloch/ and https://www.amazon.com/Moral-Mazes-World-Corporate-Managers/... and etc

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#73

Post by illud_tempus »

bell-cot wrote: post #63
zaphirplane wrote: post #41

They provide a laptop not on your personal machine because you other client data, right

This. If "work [...] as a freelancer" means that you are not their employee, and they need the legal fiction that you normally have other 'clients' who you freelance for... If they do not provide the laptop, do they mind if your other clients also have agents & such on your machine? If they are honest about this, then providing you with a nice laptop would be far cheaper than dealing with multiple-agent issues. Let a…

They have an exclusive clause, so at the moment I work only for them (and on a few open source projects).

Legally I work for a company in the EU which I own.

They are willing to pay for a decent laptop. That is not the issue. The issue is that I feel quite upset about this requirement. My motivation to discuss it here is to get an idea if I am out of touch with current reality (like some old guys some times are) - or if this is a form of cancer it's worth fighting against.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#74

Post by psnosignaluk »

At a company like the one I work for, it's a hill noone can afford to die on. PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met. That entails dropping command and control agents on machines. Say what you will about PCI and credit card cartels, but no accreditation, no business.

That said, as I work from home, my work laptop lid remains closed for all but a fortnightly company all-hands meeting, and I ensure that I keep zero personal data on it. I'd be an absolute no if the demand ever morphed to always on video or activity trackers. That's a bridge too far.

As it stands, I understand the need for some policy enforcement/remote control of their assets, but will make whatever moves I must to ensure that policy doesn't infringe on the rest of my environment.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#75

Post by unnouinceput »

SkyMarshal wrote: post #70
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

Login in GitHub/whatever on your other laptop. Then send via e-mail bits of code you need from one to the other. When asked why is taking longer vs. other clients point this as the culprit. And also charge this client more.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#76

Post by gibs0ns »

Having previously led a SoC2 implementation at a few large multi-nationals, the request coming from your company strikes me as either;

A) they're being super lazy and using Drata as a blanket to cover a bunch of SoC2 requirements

B) it has nothing to do with SoC2, it's just their excuse to push this employee spyware

Try asking for a company provided computer. I'd also put that company device on it's own VLAN.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#79

Post by eurasiantiger »

qwerty456127 wrote: post #49
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

You keep your work laptop in your home network? Tut tut.
Post reply on HN