Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#81

Post by mschuster91 »

psnosignaluk wrote: post #74

At a company like the one I work for, it's a hill noone can afford to die on. PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met. That entails dropping command and control agents on machines. Say what you will about PCI and credit card cartels, but no accreditation, no business. That said, as I work from home, my work laptop lid remains closed for…

> PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met.

How does PCI-DSS compliance work in European countries, with GDPR and actual employee rights with teeth and serious fines at play?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#84

Post by RileyJames »

SkyMarshal wrote: post #70
gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

I’d like to say no, but I’m not sure it’s an unreasonable request.

I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity.

Otherwise, I expected them to provide all hardware and software required to perform my role.

And likewise, for security purposes, that’s exactly what they wanted as well.

Tho I would note, they wanted to perform a background check prior to starting. And while i didn’t have a problem with the employer having those details (for the period of the contract) they performed this function through a 3rd party, who has stated they won’t delete my data (I will be following up post-contract). I was not happy for a 3rd party to have this data.

I would also not login to or install any apps, or certificates on my phone. Again, if that’s required, send me a phone.

The company I was working for had SOC2 / ISO2700 / what ever and I think this is exactly why they wanted all this. But it suited me to seperate things as well.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#85

Post by mschuster91 »

5e92cb50239222b wrote: post #50
GianFabien wrote: post #19

Somewhat tangentially: I note that most managers seem to equate hours at the keyboard with productivity. I have heard of some employees being monitored via the notebook's video camera. Is it so difficult to define deliverables and pay for completed and tested work? The business value of any given function point is the same whether it took 100 hours to develop or 10 hours. Of course, more productive programmers would…

> Is it so difficult to define deliverables and pay for completed and tested work It is? It's a problem as old as the hills — how do you measure the amount of work done? I can churn out several new features in very short time, but then spend two days chasing a bug which results in a single-line fix. From the management POV this looks like I've been very productive for a few hours and then spent two days doing fuck al…

Ideally you'd have a competent team lead that can evaluate whether people are bored out or overloaded with tasks and if their output quality matches expectations.

JIRA, Trello or other tools are (usually) not used for the team's benefit, but as "actionable items" or whatever for clueless upper management.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#86

Post by spc476 »

eurasiantiger wrote: post #79
qwerty456127 wrote: post #49

Earlier quoted context omitted.

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

You keep your work laptop in your home network? Tut tut.

I work frim home ... pandemic and all that. What else am I supposed to do?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#87

Post by illud_tempus »

chx wrote: post #47
illud_tempus wrote: post #3

Earlier quoted context omitted.

So far my strategy is to just ignore it and pray that the problem goes away by itself. If I have to deal with it eventually - quitting is the most appealing option. However, the reason I asked here is to get a feeling about how common this thing is. Is this normal? Am I the rat in the lab, or am I just late to the party?

This is spreading but still we must try to stop it. We will fail as we have failed so many times in the past but still we must try. Say, we fought against DRM and while the music industry have completely abandoned it, that victory turns out to be useless because the video streaming industry have embraced it total and there's not even resistance against it this time. I am so, so tired of fighting against these. I tran…

> We will fail as we have failed so many times in the past but still we must try.

This is a thing the unions would have exterminated in the past. Problem is, most developers are not in a union.

There is still the choice to "just say no".

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#88

Post by sirwitti »

I had a similar issues this year - a client's admin wanted me to hand over my device for him to setup vpn access.

My response was that I'm contractually forbidden to allow that since on my device there's data GDPR-relevant and otherwise of other customers.

You can also make up a company-policy (even if you're a single person) and communicate it that way. "There's a strict company policy preventing me/us from installing this kind of software."

Apart from that, this violates the no-asshole-rule.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#89

Post by drran »

5e92cb50239222b wrote: post #50
GianFabien wrote: post #19

Somewhat tangentially: I note that most managers seem to equate hours at the keyboard with productivity. I have heard of some employees being monitored via the notebook's video camera. Is it so difficult to define deliverables and pay for completed and tested work? The business value of any given function point is the same whether it took 100 hours to develop or 10 hours. Of course, more productive programmers would…

> Is it so difficult to define deliverables and pay for completed and tested work It is? It's a problem as old as the hills — how do you measure the amount of work done? I can churn out several new features in very short time, but then spend two days chasing a bug which results in a single-line fix. From the management POV this looks like I've been very productive for a few hours and then spent two days doing fuck al…

The manager then can look at data and think, "Hm, these bugs are costly. What we can use to reduce number of bugs to reduce costs?"

Bugs are a waste. Number of bugs can be reduced with better practices: peer review, various tests; better software: linter, automatic verifier, compile time checkers (-Wall + -Werror, rust), code generators, libraries; or additional business process: quality assurance.

To improve something, your manager need to measure it first. You can propose everyday reporting of spent time instead of spying tool, e.g. "2h working on #1234, 6h fixing bug #23456", which is much more valuable to your manager than raw data.

In my previous company, we reduced the number of bugs and time to fix by an order of magnitude, because we were able to see the effect of changes in tooling and development process.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#90

Post by reincarnate0x14 »

I deal with critical infrastructure consulting all the time and if the client wants some specific agent run, they send me the laptop to do it on.

Not only is your personal equipment yours, it likely contains information about other businesses that you probably have legal obligations to, like NDAs, and if the client doesn't understand that you can't ethically violate that for them, then they're not a client you need to be dealing with.

It doesn't help that the 3-5 "IT agents" they run are rarely doing anything useful expect fulfilling 3-5 different directors idea of spying.

Post reply on HN