Live data from Hacker News

Ask HN: My client want an agent on my laptop. Is this the new normal?

news.ycombinator.com

271–280 of 506 posts

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#271

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

> Reply to parent Next client! This is potentially an indicator of a bad customer or management. My hardware = my software (not yours) end of discussion. Don't like it? Have fun finding someone better that will put up with your nonsense. Now if they provide a laptop with corp network access etc that is different. I'm a professional similar to yourself. 15 years as a consultant and freelancer.

I agree: a company asking developers to install security monitoring agents like this should also offer company laptops. Same with mobile phones, actually, for remote wipe profiles and location tracking and things.

If they don't offer company hardware I don't think they can rightfully demand agents be installed. But if they do, and if you decline to use it then you have to accept agents on your own machine.

Not sure what OPs situation is - but I'd think it very reasonable to go back and say "if you want to install this you have to provide me a laptop"

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#272

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

I'm going to piggyback on your comment because it's one of the more reasonable and informed takes here.

I'm currently in the middle of our company's first evaluation window for SOC2 Type 2.

I'm not familiar with Drata, but at a surface-level, it sounds pretty similar to Vanta, who we use.

OP says "The motivation is that my client badly want a SOC 2 certification", which sounds about right. If anyone isn't familiar with SOC2, it's generally not something that you start out wanting or caring about, but eventually you get some big potential customers and they tell your sales people that they can't sign the contract unless you can show them your SOC2 attestation. Then you scramble to figure out what it is and what you have to do to get it. Depending on how your business works, it's the kind of thing that can very quickly go from "we don't know what that is" to "the future of our company depends on this". If you're a small team without experience in the area, it's a total mess and hard to understand exactly what's required. Signing up with someone like Vanta or Drata to walk you through the process and provides a bunch of tools to tick boxes and get you through an audit with a minimal amount of manual work and ambiguity (though there will still be a lot of that).

SOC2 tends to be very vague on actual technical controls and is more focused on the documentation of whatever controls you have set for yourself and gotten your auditor to agree are reasonable. You're going to have a very hard time getting most auditors to agree to something less strict than "devices that are used to access production systems or could otherwise touch sensitive data must have encrypted drives, be password protected, and kept up to date with security patches". If you have a traditional IT setup and provide hardware to all of your employees, you can probably generate some documentation showing how you enforce that policy. It's trickier in remote setups, BYOD environments, or with contractors/freelancers. Your two options are basically to have people install an agent like Dasta or Vanta's or to require them to upload screenshots of all the relevant settings on their devices somewhere on a regular basis (typically monthly), and then have an admin check them and sign off. That second approach isn't hard, but it tends to be very labour intensive and annoying as well as very easy for someone to forget and produce gaps/exceptions that then have to be explained to your auditor.

In our case, we're a fully remote company and fully BYOD (you get a hardware stipend but we don't really have an IT department so we're not in a good position to manage peoples' devices for them; we do strongly encourage people to use separate devices for work and personal). We completely understand the reticence towards installing a 3rd party agent on their own machines, so we give our employees the option of using Vanta's agent or doing the monthly screenshot thing. Boy is the screenshot thing a pain in my butt and don't I wish everyone would just use the agent. In the future, it might push us to change our BYOD policy and instead supply managed devices (but I'm not crazy about that approach either for other reasons).

One piece of feedback we've given Vanta at every opportunity (and I assume would apply to Dasta as well) is that we'd have a much easier time getting adoption of the agent among our developers if they'd make it open source so anyone with privacy concerns could audit it themselves. So far we haven't gotten any indications that they're moving in that direction. FWIW, reverse engineering and spying on the Vanta agent with eBPF and other tools to try to catch it doing something it shouldn't has become a bit of a side hobby of mine (it's mostly a wrapper around OSQuery and I've been able to log all the queries that it makes and not yet found anything nefarious, but absence of proof isn't proof of absence).

IMO, it's completely reasonable for the OP, as a freelance contractor, to refuse to install an agent on their personal machine and instead provide screenshots/etc as evidence. They say "Just for the record: I don't have credentials to production systems, and I don't work with production data.". If that's really true, then that should be fine. We have freelancers who do certain things for us (eg, market research), and if they don't have access to production systems/data, it's very straightforward for us to classify them that way and exclude them from the various secure development controls. Though they may not fully understand the scope of "production systems", which could include things like Github repos which contain code that gets deployed to production (SOC2 auditors want to see that the whole development lifecycle is secure so a compromised developer laptop couldn't be used to push out a backdoor without leaving a very obvious trail).

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#274

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

I'm going to piggyback on your comment because it's one of the more reasonable and informed takes here. I'm currently in the middle of our company's first evaluation window for SOC2 Type 2. I'm not familiar with Drata, but at a surface-level, it sounds pretty similar to Vanta, who we use. OP says "The motivation is that my client badly want a SOC 2 certification", which sounds about right. If anyone isn't familiar wi…

Terrific follow up, thanks.

I agree with your final paragraph 100%

And good luck with your evaluation!

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#275
post #149

Earlier quoted context omitted.

Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.

I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.

> Internet Explorer ActiveX plugin

Virtualized desktops have been solved. All the major players offer them. FFS, you can run Xbox One games in the cloud and play in your browser now.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#276
post #257

There's a load of nonsense in the comments here today. * Drata is a vendor that helps a company navigate your SOC2 compliance process, by organizing all the controls and helping you gather evidence that you have done so. For instance, they'll connect with Github and make sure everyone with access to your repos is a company employee. If you don't use Drata you have to gather this evidence yourself, repeatedly over mon…

Maybe I'm very naive here but does SOC2 explicitly require monitoring? Can't a contractor simply sign a form that says all relevant rules are followed on their end and thus if that's not the case, the company is off the hook? If active monitoring is really required than the only solution I see is one device/customer and thus as a freelancer I'd have to request said device be provided by the customer.

In principle, a company’s security policy could be to enforce security settings on employee computers with an agent like Drata, and contractually guarantee those same settings for contractors. The evidence during the audit would be the Drata report for employee computers and the signed contracts for the contractors.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#277

Earlier quoted context omitted.

I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity. Otherwise, I expected them to provide all hardware and software required to perform my role. And likewise, for security purposes, that’s exactly what they wanted as well. Tho I would note, the…

One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools. It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.

You could reasonably invoice an upfront tooling cost ("isolated development workstation to meet customer IT policy requirements. Apple Macbook Foo, $BIGNUM")

If you want to be really cheeky, could get some value-added margin on it too, and as a bonus, AIUI it would be yours to keep after the engagement, rather than having to return hardware they've assigned to you.

Might be tough to get past finance though, unless they really want that certification :)

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#278
post #149

Earlier quoted context omitted.

Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.

I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.

That sound's like it is a looong time ago, todays VD's are extremely responsive just have a look at Shadow for example.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#279

Earlier quoted context omitted.

My company is going through our SOC2 audit. We do not have such software and everyone is remote. I call BS as to the justification. This smells like a desire for corporate monitoring.

SOC2 isn’t prescriptive. SOC2 is just a certification that you are following your own internal policies. If the company made the mistake of creating a policy that they use this software as one of their controls, then the auditor will ding them if they don’t use it. It’s an absurd system.

Reminds me when I was doing PCI compliance.

A PCI question asks if all outbound traffic is explicitly authorized. I took that to mean getting a list of all the IPs for the APIs of services we hit, and even constructed that entire list except for one, the payment processor itself.

The payment processor did not have any stable IPs, and could not give me a list. Their official solution was to have our policy be that we explicitly allow _all_ outbound traffic.

If such an option is allowed by PCI, what is even the point of making it a requirement?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#280
post #179

Earlier quoted context omitted.

That's why you tape off cameras and stick a needle in condenser mics on any new laptop.

Don't they use MEMS microphones nowadays? ( https://en.wikipedia.org/wiki/Microelectromechanical_systems ) Either way, solid advice!

sticking a needle in a MEMS microphone is just as effective, you just have to [find the damn thing, and] push the needle all the way through!

If brute force isn't working, you're just not using enough of it yet.

Post reply on HN