Earlier quoted context omitted.
You keep your work laptop in your home network? Tut tut.
I work frim home ... pandemic and all that. What else am I supposed to do?
VLAN is the obvious and most cost-effective mitigation
Ask HN: My client want an agent on my laptop. Is this the new normal?
91–100 of 506 posts
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#92At a company like the one I work for, it's a hill noone can afford to die on. PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met. That entails dropping command and control agents on machines. Say what you will about PCI and credit card cartels, but no accreditation, no business. That said, as I work from home, my work laptop lid remains closed for…
> PCI-DSS demands at least some control over employee laptops to ensure that certain secure configuration standards are met. How does PCI-DSS compliance work in European countries, with GDPR and actual employee rights with teeth and serious fines at play?
[deleted]
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#93Somewhat tangentially: I note that most managers seem to equate hours at the keyboard with productivity. I have heard of some employees being monitored via the notebook's video camera. Is it so difficult to define deliverables and pay for completed and tested work? The business value of any given function point is the same whether it took 100 hours to develop or 10 hours. Of course, more productive programmers would…
> The business value of any given function point is the same whether it took 100 hours to develop or 10 hours.
That's the point of paying proportionate to hours and not value of your output. There's some delta! You can try the value of deliverables model but you'll have to be quite irreplaceable.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#94If everyone refused to comply, they (and all other companies) would have to rethink their approach and back up. Sometimes I really wish for a trade union of IT workers, however bad that sounds.
Why does that sound bad?
Trade unions can easily be run as maffia organizations, as it happened in the US in the 20th century.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#95Earlier quoted context omitted.
My client is quite reasonable, and is willing to compensate a new laptop. It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country. However, I still don't like th…
It's trivial for software inside to VM to detect that. So, I'd expect any competent agent software to report that back to base. Whether or not the people monitoring the agent's output will care, is a different question. ;)
> It's trivial for software inside to VM to detect that
QEMU can get you very far in masking the presence of a VM. If it can work around Nvidia's cash grab of not allowing consumer cards to be used in VMs, it should be able to deal with whatever bullshit spyware.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#96Ask them to provide a temp laptop for you.
+1. If it’s their laptop and you’re only using it for their work, no problem.
If they’re expecting you to provide the hardware, then politely decline.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#97You mention you are in the EU. That's important because the GDPR applies. Even if you are working for a US company.
The details come down to what exactly the software is spying on (I won't look at their website): if it's too invasive, even on a company-provided computer (as many other commenter suggested), it can run afoul of the GDPR (i.e. illegal). There have been some cases already on that [1], and looking up some of them might prove to be a very effective negotiating strategy against that.
[1] quick search on Google: https://www.complianceweek.com/data-privacy/employee-monitor...
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#98If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.
Just compartmentalize your passwords and private keys. That said, private keys are generated on the dedicated hardware and always stay there - that's all you need to manage them.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#99There is no justification for your client to even remotely think you should install this tool.
- It's a massive breach of trust (I'd consider just asking for that tool a testament of no trust at all, irrepairable actually)
- The job market gives them zero bargaining power
If it comes "out of the blue" like you say, chances are it's being driven by a new guy. You'd do yourself and your client a huge favor by immediately, and visibly to all stakeholders, pointing out the idiocy of that guy's idea (remember, the trust is gone already, no need to sugar coat it then).
Because there will be more of those ideas, if he's not interrupted, possibly harming the company in cataclysmic proportions down the road.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#100Earlier quoted context omitted.
That's what I do today. One VM per customer, on a pretty decent workstation. My host file system is encrypted. If I install the agent, it will complain about the VM's file system not being encrypted. If I double encrypt, compilation times will go up quite a bit. Besides, running the agent in a VM will just be theater. If the host machine is compromised, no security in the VM will mean anything. I could just as well r…
> If I double encrypt, compilation times will go up quite a bit. And that's the (poor) choice the company gets to make. Document/communicate that they're getting less work per money and let them deal with it.
I don't want to punish them for being stupid. I want them to not be stupid :)
I like the challenges I work on. I work with very smart people. The managers I know well are mostly good people.
But the company is growing fast, and there are new managers running loose every week, marking their territory and making signature changes. That's a bit exhausting.
Ideally, someone would hit the breaks, and come up with a solution where the company get whatever certifucations they need, without pushing me into "I'm hurt, so I'll hurt them back by being less productive" mode. I enjoy being productive.