[deleted]
Ask HN: My client want an agent on my laptop. Is this the new normal?
301–310 of 506 posts
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#302Since this 'Drata' thing is intended to keep employees/contractor computers in check with policy requirements, runs as (equivalent of) root, and auto-updates, I assume it must be: * completely open source * have gone through security audits with public reports, and a favorable outcome * have reproducable and verifiable builds, and those are the only ones distributed, and the end user can easily verify that their bina…
> Because if not, aren't you just adding another attack vector onto all your employee/contractor laptops when you use 'Drata' to check a policy box on your SOC2 application?
I have bad news: gaining security certifications mostly through pointless or even harmful measures is the norm.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#303If they have SOC 2 requirements your options are to install the client or find a different job. That will be completely non-negotiable. We have a division that has to be compliant and they are regularly audited and there are no exceptions allowed. The guys in that group complain daily about what a pain it is so I understand the concern/frustration.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#304Earlier quoted context omitted.
I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but t…
> procuring the laptop might be a difficult thing for them to do bureaucratically Not if they are at the point where they need SOC2 cert, and where they install agents on their employees computers (and want to extend that to their suppliers).
As others have said this area of SOC2 is often about "are you actually following the policies you've set" rather than "you have to do things this way" – most of our staff have company owned devices with MDM and an agent which mainly tracks installed applications versions, that Disk Encryption is turned on, and the OS patch level.
But there are a couple of our contractors that rejected this for exactly this reason (they had other clients). For one of them, we just bought him a laptop that he does all our work on (it cost less than 1 day of his time, so it was a no brainer), and the other, we realized we didn't have to as long as he did periodic (documented) reporting of screenshots of his OS version being up to date, Disk Encryption enabled, and screen saver settings are appropriate. And they legally attest that they make a best faith effort to delete any sensitive data off their laptops (if they ever download it).
We've talked to a couple of auditors and that seems to be sufficient and pragmatic as it accomplishes the same goal.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#305If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…
I would just charge them for a new laptop that is used exclusively for that project.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#306Earlier quoted context omitted.
> The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". Do you have any evidence for this?? I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their…
> I read their Privacy Policy. They are quite explicit about what they plan to do to you. OK, well, I've skimmed it and I can't see anything that suggests they are going to spy on our employees and sell the data to advertisers. I hate to drop it back on you but which passages make you think they do that? These things do often sound terrifying because things like "I'm going to use Google Analytics to see which parts o…
I think the OP is talking about the "How We Use Your Personal Information" on https://drata.com/privacy
That would seem to only pertain to their website. Yes, they're going to want to market it to you, so that makes sense.
The actual privacy policy for the product the OP is using is likely found in the contract Drata signed with the client company.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#307Earlier quoted context omitted.
> The poster says "Their business model (in my case) seems to be to take money from companies to spy on their employees/contractors, and then they sell the employees/contractors private information to "targeted advertising". Do you have any evidence for this?? I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their…
> I read their Privacy Policy. They are quite explicit about what they plan to do to you. OK, well, I've skimmed it and I can't see anything that suggests they are going to spy on our employees and sell the data to advertisers. I hate to drop it back on you but which passages make you think they do that? These things do often sound terrifying because things like "I'm going to use Google Analytics to see which parts o…
> OK, well, I've skimmed it and I can't see anything that suggests they are going to spy on our employees and sell the data to advertisers
"We, our service providers and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes: ... Interest-based advertising. ... We may also share information about our users with these companies to facilitate interest-based advertising ... We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect ... and share it with third parties for our lawful business purposes"
Such "de-identified data" is often trivial to re-identify. There are research papers about that. It's well known in the security and privacy community.
Also, they use dark anti-patterns for opting out from them even using your personal data for their own advertising. "You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us at ..."
If Drata intended to be a nice, trustworthy security partner, use of any personal data for targeted marketing, or sale of any personal information would be opt in, not "out out if you can figure out how ...".
I have not read their terms of conditions or even their glossy information about the agent. I never got that far, as I declined to accept the terms and conditions for using their website. Already at that point, I saw red flags the size of Australia.
I don't believe for one second that Drata has any intention of showing any decency or that they act in good faith towards their customers or anyone else. If they did, they would have developed reasonable terms and conditions. What they have don't even distinguish clearly between the roles of a customer and an employee or contractor for their customers. Hell, they don't even define the term "Customer".
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#308Earlier quoted context omitted.
Not really. VLAN provides segmentation, but it does not provide any mechanisms to limit access to other vlans in your network - which are most likely routed by your router. You will need to add some L3 filtering (acls/iptables/whatever) to isolate segments.
That's only true if use of VLAN tags is controlled by hosts; if you use a smart switch to assign VLANs to ports it's pretty much as-if you have multiple, physically separated networks.
Segmenting your broadcast domains doesn't help much if traffic is routed freely between them.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#309 I have been through this as well.
My client accounts for 90% of my current work, but my laptop contains information about many other clients. Due to the excessive access and control that their spyware requires (Cortex XDR with complete remote access capabilities in this case), I was unable to use the same computer that I use for all other work. I have no choice but to use a separate computer unless I'd be willing to hand over all the information and assets I have for other clients, which I am not.
In my case, the client was able to provide me a machine specifically to use with them.
I would say that this is the new norm if you're doing long-term engagements with any company that pursues SOC2.
Re: Ask HN: My client want an agent on my laptop. Is this the new normal?
#310If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…
> If you are a freelancer then your contract should allow you to do work for others
Not only that, in some EU countries it's even illegal for a freelancer to work for 1x customer.