9 ms·

I agree in general. And I do not get the BYOD thing. As another commenter said, an employer should provide the tools necessary. Or live with the constraints. I

I agree in general. And I do not get the BYOD thing. As another commenter said, an employer should provide the tools necessary. Or live with the constraints. I am in another camp. Until recently my employer had a policy of treating our devices somewhat like private devices. We are provided with the device, are allowed to use them at home at will, are full admins. We are only requested to encrypt the harddrive. My employee never had access to my data if I did not provide it to them. So now two situations changed. Clients of ours force us to use endpoint management to ensure different "security" standards (some not as secure as I had before). Also we got bought by a bigger company and they have rules and regulations for their ~470k employees. These mean we will get some hefty spyware on our devices while still being officially allowed to take the devices home with us, use them privately and so on. Well. I am not so sure, I will do this in the future. I am not willing to introduce spyware that also scans all devices within the network to my home network. I do not want some admin on the other side of the world to be able to download any file from my device. Or to upload any file onto my device. So I will probably buy another computer (not having owned a private laptop for quite some time) to use at home. Same with my mobile phone. On the other hand - I hate to carry two devices with me. For me separating out private/freelance stuff onto one machine and corporate stuff onto another makes things more complicated. And I know convenience kills security. Sorry for my rant, without providing much to the discussion. I mean - it is my work device and my employer is within their full right to install whatever they wish - once the works council agrees.

gdfasfklshg4 7y ago
> I am not willing to introduce spyware that also scans all devices within the network to my home network. In the EU I would seriously doubt that your employer is allowed to do this.
- sdoering 7y ago
  > In the EU I would seriously doubt that your employer is allowed to do this. Sadly they are. At least as far as any lawyer on this topic currently stated.
- tinus_hn 7y ago
  Why not? It’s a company device, if you don’t want your employer to access your network through it, don’t connect it to your network. You can hardly blame them for administering their own device.
  - gdfasfklshg4 7y ago
    If an employer expected me to use such a device I would assume that they would also pay for me to have a separate internet connection (this could easily be tethering to my work provided mobile data).
    - tinus_hn 7y ago
      If you have a decent router you can just create an isolated network for devices you don’t trust.
      - gdfasfklshg4 7y ago
        Sounds like something I would need my work to pay for...
forgone 7y ago
what company has 470k employees?
- jconnop 7y ago
  http://fortune.com/global500/list/filtered?sortBy=employees http://fortune.com/global500/list/filtered?sortBy=employees
- joefife 7y ago
  Well the NHS has nearly 1.5 million employees, so I guess there's a few!
- aidanlister 7y ago
  My guess is that he is talking about Accenture
  - wincy 7y ago
    I’m also curious about this, I’m guessing DHL because he’s in Germany but Accenture matches up too.
- unfunco 7y ago
  Amazon had 647,500 as of 2018...
elithrar 7y ago
> while still being officially allowed to take the devices home with us, use them privately and so on. Who owns the rights to IP developed on these company-owned laptops? One of the biggest problems with this kind of ‘unspoken flexibility’ is that any side projects you work on are in-part owned by the company, under most standard agreements.
- reubenmorais 7y ago
  Isn't that the case regardless of what laptop you're using? As far as I can tell you should assume any side projects are Copyright (c) your employer unless you talk to legal first and make an arrangement (for each project). See for example: https://www.joelonsoftware.com/2016/12/09/developers-side-projects/ https://www.joelonsoftware.com/2016/12/09/developers-side-pr...
  - userbinator 7y ago
    No, what you do on your own time (not company time) with your own resources can't be owned by the company, because otherwise everything you do would be owned by the company, which is absurd; suppose I went to a friend or relative and helped him/her out by writing a simple script, does that belong to the company now? How about posts you make on HN outside of work (if you do it at work, that's... questionable)? The possibility of companies disagreeing is why I keep my work and private life completely separate, and the online portion of the latter does not even use my name nor anything that could be associated with my "offline" identity.
    - reubenmorais 7y ago
      Please see the link I added. You should check your employment contract to see the exact terms of the copyright assignment clause you signed, but it's definitely very common to have to assign any inventions you make that are "related to your employers area of work", regardless of what hardware you use or if you do it in the office or at home.
      - 7y ago
na85 7y ago
>And I do not get the BYOD thing. I get it. My employer provided phone is a Blackberry Leap.
- oarsinsync 7y ago
  I don't get it. My employer provided phone was a Blackberry Bold. I need a work phone to make and receive work related calls, and to keep work related matters off my personal phone, enabling me to not have to think about work once I leave the office unless someone phones me.
- AdmiralAsshat 7y ago
  Can it receive calls and read e-mails? If so, that should be all my employer expects of me when I'm provided with a company phone. I can't imagine what they would want me to do that would require a smartphone. Anything more complicated would be better accomplished on a laptop.
  - na85 7y ago
    >Can it receive calls and read e-mails? Barely. But there's more to it than that. I can't use the browser to look work-related things up because the blackberry browser hasn't been updated in years. I end up using my own device which defeats the purpose.
x0x0 7y ago
I am the employer in this situation. The problem was that 1 - some employees do not read policies (despite some really explicit training during onboarding) and disable the password so they don't have to type it during login; 2 - apple software is hot shit and somehow filevault disabled itself on an employee laptop. I'm 100% sure that it was previously enabled. It required multiple support calls, an OS reinstall, and a full machine wipe performed at an apple store to get it re-enabled, so I believe the employee who says he didn't disable it. Either way, I had to install an mdm to make sure that there always is a password on the machine, a lockout time, and filevault enabled. That mdm, unfortunately, gives me far more control than I want, but there's nothing I can do about that; it's a package deal. I'd prefer not to install them, but one idiot disabling passwords, even after very specific training, because it's inconvenient to type them ruined it for everyone.
- sdoering 7y ago
  Why not let go of said idiot and keep the culture as it was? Why ruin it for everybody because of one bad apple? Why punish everybody and send a sign of mistrust to everybody for one idiot?
  - x0x0 7y ago
    one idiot, and one serious macos bug (re: disabling filevault) And the answer roughly comes down to (1) it trained me out of trusting, even in a small shop; and (2) now that I know these things happen, I have to protect against them. If I abuse what the mdm gives me, I expect my employees to fire me. ie quit.
- tinus_hn 7y ago
  Yeah that never happened with Microsoft’s Bitlocker
wincy 7y ago
I’m going to guess the new employer is Deutsche Post DHL Group? I’m basing this on you mentioning being in Germany and company size. Off topic, but I just went down a small rabbit hole of employers with >400k employees and there’s not many, most of them are either state owned/militaries (I’m assuming Russia’s Gasprom doesn’t have many German employees) or Walmart/McDonald’s (which has far more employees than 470k). For anyone interested I guessed based on this article. https://www.lovemoney.com/galleries/amp/67573/the-worlds-30-biggest-employers https://www.lovemoney.com/galleries/amp/67573/the-worlds-30-...

gdfasfklshg4 7y ago

> I am not willing to introduce spyware that also scans all devices within the network to my home network. In the EU I would seriously doubt that your employer is allowed to do this.

sdoering 7y ago
> In the EU I would seriously doubt that your employer is allowed to do this. Sadly they are. At least as far as any lawyer on this topic currently stated.
tinus_hn 7y ago
Why not? It’s a company device, if you don’t want your employer to access your network through it, don’t connect it to your network. You can hardly blame them for administering their own device.
- gdfasfklshg4 7y ago
  If an employer expected me to use such a device I would assume that they would also pay for me to have a separate internet connection (this could easily be tethering to my work provided mobile data).
  - tinus_hn 7y ago
    If you have a decent router you can just create an isolated network for devices you don’t trust.
    - gdfasfklshg4 7y ago
      Sounds like something I would need my work to pay for...

forgone 7y ago

what company has 470k employees?

jconnop 7y ago
http://fortune.com/global500/list/filtered?sortBy=employees http://fortune.com/global500/list/filtered?sortBy=employees
joefife 7y ago
Well the NHS has nearly 1.5 million employees, so I guess there's a few!
aidanlister 7y ago
My guess is that he is talking about Accenture
- wincy 7y ago
  I’m also curious about this, I’m guessing DHL because he’s in Germany but Accenture matches up too.
unfunco 7y ago
Amazon had 647,500 as of 2018...

elithrar 7y ago

> while still being officially allowed to take the devices home with us, use them privately and so on. Who owns the rights to IP developed on these company-owned laptops? One of the biggest problems with this kind of ‘unspoken flexibility’ is that any side projects you work on are in-part owned by the company, under most standard agreements.

reubenmorais 7y ago
Isn't that the case regardless of what laptop you're using? As far as I can tell you should assume any side projects are Copyright (c) your employer unless you talk to legal first and make an arrangement (for each project). See for example: https://www.joelonsoftware.com/2016/12/09/developers-side-projects/ https://www.joelonsoftware.com/2016/12/09/developers-side-pr...
- userbinator 7y ago
  No, what you do on your own time (not company time) with your own resources can't be owned by the company, because otherwise everything you do would be owned by the company, which is absurd; suppose I went to a friend or relative and helped him/her out by writing a simple script, does that belong to the company now? How about posts you make on HN outside of work (if you do it at work, that's... questionable)? The possibility of companies disagreeing is why I keep my work and private life completely separate, and the online portion of the latter does not even use my name nor anything that could be associated with my "offline" identity.
  - reubenmorais 7y ago
    Please see the link I added. You should check your employment contract to see the exact terms of the copyright assignment clause you signed, but it's definitely very common to have to assign any inventions you make that are "related to your employers area of work", regardless of what hardware you use or if you do it in the office or at home.
    - 7y ago

na85 7y ago

>And I do not get the BYOD thing. I get it. My employer provided phone is a Blackberry Leap.

oarsinsync 7y ago
I don't get it. My employer provided phone was a Blackberry Bold. I need a work phone to make and receive work related calls, and to keep work related matters off my personal phone, enabling me to not have to think about work once I leave the office unless someone phones me.
AdmiralAsshat 7y ago
Can it receive calls and read e-mails? If so, that should be all my employer expects of me when I'm provided with a company phone. I can't imagine what they would want me to do that would require a smartphone. Anything more complicated would be better accomplished on a laptop.
- na85 7y ago
  >Can it receive calls and read e-mails? Barely. But there's more to it than that. I can't use the browser to look work-related things up because the blackberry browser hasn't been updated in years. I end up using my own device which defeats the purpose.

x0x0 7y ago

I am the employer in this situation. The problem was that 1 - some employees do not read policies (despite some really explicit training during onboarding) and disable the password so they don't have to type it during login; 2 - apple software is hot shit and somehow filevault disabled itself on an employee laptop. I'm 100% sure that it was previously enabled. It required multiple support calls, an OS reinstall, and a full machine wipe performed at an apple store to get it re-enabled, so I believe the employee who says he didn't disable it. Either way, I had to install an mdm to make sure that there always is a password on the machine, a lockout time, and filevault enabled. That mdm, unfortunately, gives me far more control than I want, but there's nothing I can do about that; it's a package deal. I'd prefer not to install them, but one idiot disabling passwords, even after very specific training, because it's inconvenient to type them ruined it for everyone.

sdoering 7y ago
Why not let go of said idiot and keep the culture as it was? Why ruin it for everybody because of one bad apple? Why punish everybody and send a sign of mistrust to everybody for one idiot?
- x0x0 7y ago
  one idiot, and one serious macos bug (re: disabling filevault) And the answer roughly comes down to (1) it trained me out of trusting, even in a small shop; and (2) now that I know these things happen, I have to protect against them. If I abuse what the mdm gives me, I expect my employees to fire me. ie quit.
tinus_hn 7y ago
Yeah that never happened with Microsoft’s Bitlocker

wincy 7y ago

I’m going to guess the new employer is Deutsche Post DHL Group? I’m basing this on you mentioning being in Germany and company size. Off topic, but I just went down a small rabbit hole of employers with >400k employees and there’s not many, most of them are either state owned/militaries (I’m assuming Russia’s Gasprom doesn’t have many German employees) or Walmart/McDonald’s (which has far more employees than 470k). For anyone interested I guessed based on this article. https://www.lovemoney.com/galleries/amp/67573/the-worlds-30-biggest-employers https://www.lovemoney.com/galleries/amp/67573/the-worlds-30-...