Ask HN: My client want an agent on my laptop. Is this the new normal? • Hacker News Board

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#231

Post by vmception » Fri, Dec 17, 2021, 1:34 PM UTC

SkyMarshal wrote: post #70

gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

if only you could make a new set of those...

a lot of developers have separate everything

this can be bad when encountering the recruiters and hiring managers that still look at github activity as clout, but these days you still have to pass the technical interview no matter how much clout you have so I wouldn't worry about it

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#232

Post by tony-allan » Fri, Dec 17, 2021, 1:34 PM UTC

DnDGrognard wrote: post #150

gorgoiler wrote: post #48

Do you object outright to spyware, or to the client wanting to run their spyware on your equipment? It sounds like the spyware is non negotiable and I personally wouldn’t have issue with it if the client also provides a laptop on which to run it . The client is free to do whatever the hell they like with their own hardware . What’s objectionable about situations like this is the client wanting to have their spyware c…

And most peoples home network wont be able to support VLAN's and would your employer be more worried about your ISP provided router - hmm must really replace that huawei router on my network.

What about the guest network? These are usually isolated from other devices at home.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#233

Post by jdavis703 » Fri, Dec 17, 2021, 1:34 PM UTC

I don’t know what your agent does, but from day 1, pre-pandemic we had spy software installed on our work laptops. It ostensibly inspects all network connections looking for malware.

When I’m not using my laptop it’s closed, so the camera is off and the mic is muffled.

It doesn’t seem like that big of a deal to me. The laptop is for work stuff, most of which is in the cloud under their control anyways. Worst they’re going to find is my raw and unvarnished work logs, which might hurt some feelings if anyone is over-sensitive.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#234

Post by iandanforth » Fri, Dec 17, 2021, 1:38 PM UTC

Sounds like you need to say no. You can describe your expertise and ask if they care more about the appearance of security (SOC2 compliance) or real security. They will choose the appearance of security and you can move on.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#235

Post by tony-allan » Fri, Dec 17, 2021, 1:38 PM UTC

windex wrote: post #159

Ask for a separate work laptop from them, put it on a different VLAN without access to local resources. Do not login to anything personal on it. That's what I currently do. I also keep it in an office room away from living areas of the house. The VLAN also shuts access to the internet 90 minutes after working hours.

AKA - guest network at home...

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#236

Post by too_pricey » Fri, Dec 17, 2021, 1:40 PM UTC

lucraft wrote: post #186

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

You're completely right re Drata as a company (we use a different compliance vendor, but very similar setup re the agent).

You're a bit off on whether this would fail a SOC2 audit, thankfully. As the OP said, they don't have access to production systems, which basically means you can treat that employee however you want from a SOC2 (and ISO, and most other control framework perspectives). The company OP is working for can state "We do not require these controls on contractors without production access" and that is totally fine for SOC2. Pushing back on the agent requirement is totally reasonable!

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#237

Post by rjzzleep » Fri, Dec 17, 2021, 1:40 PM UTC

byron4242 wrote: post #163

SkyMarshal wrote: post #70

Earlier quoted context omitted.

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

It's a widespread practice that companies provide laptops to contractors to compartmentalize the way they interact with the company's IT. But I'm really quite opposed to it. At one point I had 3 sets of machines: Two different 14" laptops from two different clients and my own machines. At some point you simply run out of space on your desk and end up constantly either working on screens that are too small (14" really…

I still have two lying around. One of them was a 15” dell brick.

I had informed the client that I will be disposing of them when I’m back if they don’t handle it and that any and all third party liability well fall on the direct supervisor if he can’t organize the transfer.

Needlessly to say even me connecting them directly to the courier was not enough.

My guess is that the OP depends on the money otherwise he wouldn’t be asking for help. So either but a cheap laptop and then control it with barrier[1] from your main driver and don’t ask(because whatever you ask they will probably say no). Or let them ship theirs to you, but I’m willing to bet that it be worse than whatever second machine you get.

In the meantime I would suggest you look for a new client because judging from experience there is a lot more pain to come. I didn’t do it in time and ended up paying dearly for my lack of initiative on that front.

[1] https://github.com/debauchee/barrier

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#238

Post by wombatpm » Fri, Dec 17, 2021, 1:40 PM UTC

Juliate wrote: post #227

biztos wrote: post #167

Earlier quoted context omitted.

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…

> procuring the laptop might be a difficult thing for them to do bureaucratically Not if they are at the point where they need SOC2 cert, and where they install agents on their employees computers (and want to extend that to their suppliers).

My company is going through our SOC2 audit. We do not have such software and everyone is remote. I call BS as to the justification. This smells like a desire for corporate monitoring.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#239

Post by tw20212021 » Fri, Dec 17, 2021, 1:41 PM UTC

I don't find this uncommon. I also work as a freelancer, but for local companies (eu). Sometimes the company (banks for example) will ask me to work on one of their laptops, which has vpn and other software that they want. I can of course deny, but then I won't get the contract. As long as I don't feel that they are invading my privacy, like you hear some companies do by taking screenshots, checking for idleness, etc, then I don't mind. In your case I would just rent/buy a new laptop specifically for this job, install their tool and don't worry about it. At the end you can sell your laptop. Or maybe you can work out of a VM running on your laptop, and install it there.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#240

Post by lambdaba » Fri, Dec 17, 2021, 1:42 PM UTC

gnfargbl wrote: post #62

xyst wrote: post #58

Earlier quoted context omitted.

Network segmentation with vlan is what I would do.

Yep, exactly. I used to put client devices on a segregated network and tunnel their traffic out to pfSense running on a cheap cloud box somewhere. Worked well. (I should say that intentional monitoring of my private comms was never a concern for me when I freelanced, but I was somewhat worried about infections in my clients' devices moving laterally to my home network.)

As someone who isn't well versed in networking could you describe your setup in overview? Like, what software/hardware, etc.? Thank you