16 ms·

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it."

anm89 5y ago
This sounds good on the surface but then you are still giving in to unnecessary surveillance during your workday. I would want a big compensation increase to deal with this. Like on the order of 2x my rate.
qwerty456127 5y ago
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.
- xyst 5y ago
  Network segmentation with vlan is what I would do.
  - gnfargbl 5y ago
    Yep, exactly. I used to put client devices on a segregated network and tunnel their traffic out to pfSense running on a cheap cloud box somewhere. Worked well. (I should say that intentional monitoring of my private comms was never a concern for me when I freelanced, but I was somewhat worried about infections in my clients' devices moving laterally to my home network.)
    - unbanned 5y ago
      Who the fuck has time to do that?
    - lambdaba 5y ago
      As someone who isn't well versed in networking could you describe your setup in overview? Like, what software/hardware, etc.? Thank you
      - xnyan 5y ago
        Mini-rant: people on hacker news frequently undervalue their knowledge and don't consider the things they know to be of much worth. A classic example of this is the "I can't see why dropbox is a thing, simply build a cloud file sync service - easy" post. This poster is running their own semi-professional router (pfsense) on whitebox hardware. I would not want to do that unless I already knew what I was doing or wanted to spend some time learning. The type of network segmentation being discussed is not rocket science, but it's not trivial either. VLAN segmentation can have tricky edge cases that cause things to break in a non-obvious way, nothing that can't be worked around but for someone who "isn't well versed in networking" would probably be more than you're up for. Also keep in mind that you can't do this with most consumer networking gear becasue it's too complicated to setup and support without some experience and knowledge. I'd not recommend VLAN segmentation unless you want to become someone who is more versed, which I don't oppose, but it's not a switch you can flip in 5 seconds and never think about it again.
        ArchOversight 5y ago
        I very much agree with this. I don't think that this is the solution for most home users/consultants working from home. The more obvious solution would be to get a separate WiFi router and internet connection strictly for work purposes. At that point you could also consider it a 100% home office expense and it may be tax deductible (talk to your accountant).
        Siira 5y ago
  - ArchOversight 5y ago
    This is what I do for a variety of different things: - $CORP devices are on a VLAN + Wifi that has access to the internet, but no other internal networks - Internal network for file servers/printers and the like - Personal device network, think laptops/phones/tablets that are mine, can reach internal network - IoT network - Think sensors/robot vacuums/"smart devices" - Guest network, for well visitors to my home - AirPlay network, has all my Apple devices on it to allow for music to be airplay'ed to TV's/HomePods, can be reached from internal/personal/guest network Now I also understand that I am outlier, I am running a fully segmented, firewall, traffic inspected/logged home network with small business or even large business network gear, with FreeBSD as the router/firewall with a managed switch/WAP platform from TP-Link. This is not something the average home user or consultant is going to setup/configure/manage and I don't expect it either. The worry that the $CORP device will be abused to "validate the security of the network its connected to" is very much a possibility. Most corporations have no desire to do so, and endpoint protection is their primary goal, and they don't need to scan your home network to do so, it is all local to the device. It's about protecting the integrity of the device, not the rest of the network around it.
    - neverartful 5y ago
      Which TP-Link switch do you use?
      - ArchOversight 5y ago
        I use the Omada SDN business line-up.
- endofreach 5y ago
  Capture traffic and sue the f outta everything they do that‘s not covered by a contract. Someone has to start stopping this madness and protect less informed people. We are all steering into a dark future. And i lose hope when i see all these smart programmers complaining but not stepping up.
  - qwerty456127 5y ago
    > Capture traffic and sue the f outta everything they do that‘s not covered by a contract. Whatever the app they would ask you to install would do probably is going to be allowed by its EULA (and I bet the EULA is also going to prohibit you from analyzing the app and whatever it does/communicates) and chances are you don't read it. And even if you do you most probably agree because you know all EULAs are brutal and there never is a button to object its specific part and continue. What we need is legislation to recognize all the data and metadata about your PC, all its software, your home networks&devices and their usage a kind of personal data and apply the same rules GDPR applies to tracking cookies - giving you the right to continue without agreeing to be spied on.
    - jtbayly 5y ago
      EULA has nothing to do with this. Question is whether software installed by company you’re working for spies on you in ways you haven’t agreed to. If so, sue them, not the co that wrote the spyware.
    - willcipriano 5y ago
      EULA is between the user and the vendor of the software, it isn't a agreement between the user and the users employer. Capturing traffic like that runs afoul of hacking laws.
      - qwerty456127 5y ago
        The employer can just give you an executable and say you must install it. The executable would show you an EULA and require you to accept it.
- cprecioso 5y ago
  If this is really the kind of things this company would do… why are you working for them?
  - Radim 5y ago
    Because people need money to pay bills. And it's a sad fact that companies who do shady shit tend to have more money. Simply because they outcompete companies who don't, all else being equal. Tugging against this evolutionary pressure is really hard, not only for individuals but also on the society level. "Just quit LOL!" is a commendable act of grassroots activism, but not everyone is able (or willing) to afford such luxury.
  - illud_tempus 5y ago
    > If this is really the kind of things this company would do… Because, until last week they didn't. Now I have to figure out if I'm just an unreasonable, stubborn old guy, or if this requirement is out of band.
    - hkt 5y ago
      It is out of band. Refuse or this becomes normal.
    - nix23 5y ago
      Tell them to provide you with a Virtual Desktop or a dedicated Laptop..never install Spyware on your own machine.
    - spookthesunset 5y ago
      I like others idea of getting them to spring for a dedicated computer. You just have to make it palatable to their accounting department. Maybe lease a laptop and expense the payments or something. If you have an accountant, I'd consider asking them for suggestions on "good ways" on how to make your client pay for your laptop. In my case, I just outright said "hey, you guys I really want you to be my client but I'm gonna need a new laptop". So we bought a new laptop as part of the contract.
    - 5y ago
- eurasiantiger 5y ago
  You keep your work laptop in your home network? Tut tut.
  - spc476 5y ago
    I work frim home ... pandemic and all that. What else am I supposed to do?
    - 88 5y ago
      VLAN is the obvious and most cost-effective mitigation
      - allarm 5y ago
        Not really. VLAN provides segmentation, but it does not provide any mechanisms to limit access to other vlans in your network - which are most likely routed by your router. You will need to add some L3 filtering (acls/iptables/whatever) to isolate segments.
        formerly_proven 5y ago
        That's only true if use of VLAN tags is controlled by hosts; if you use a smart switch to assign VLANs to ports it's pretty much as-if you have multiple, physically separated networks.
        addingnumbers 5y ago
        Segmenting your broadcast domains doesn't help much if traffic is routed freely between them.
        spookthesunset 5y ago
        All nice, but now you need managed switches and stuff plus some amount of unbillable time to configure it all and fix it when it breaks. Might be worth it if your bill rate accommodates it though.
- yholio 5y ago
  That's why you tape off cameras and stick a needle in condenser mics on any new laptop.
  - woodson 5y ago
    Don't they use MEMS microphones nowadays? (https://en.wikipedia.org/wiki/Microelectromechanical_systems https://en.wikipedia.org/wiki/Microelectromechanical_systems) Either way, solid advice!
    - shabble 5y ago
      sticking a needle in a MEMS microphone is just as effective, you just have to [find the damn thing, and] push the needle all the way through! If brute force isn't working, you're just not using enough of it yet.
    - yholio 5y ago
      Learn a thing every day I guess. Nonetheless, is inconsequential to task at hand if you apply the "Rosemary Kennedy" method to the laptobotomy: activate the mic, jam that needle in the hole and wiggle it around until the girl can no longer sing, no activity is detected on the vu-meters and nothing is played back in the recording. You have audio-video input sensors on all sort of programable devices nowadays, even some TVs can be turned into two way communication devices. That's a nice 1984ish vibe to ruin your late night matrimonial TV browsing.
- blitzar 5y ago
  > And they will install a trojan They WILL > which would eavesdrop your talks That absolutely WILL - use the microphone and listen to everything being said (why not the camera too and watch everthing?) > scan your home network and analyze its traffic. That absolutely WILL - do all this stuff I mean if this is definately going to happen, then the company can go ahead and cut an 8 figure cheque straight away. Which company and where do I sign up?
  - qwerty456127 5y ago
    > why not the camera too and watch everthing Because who doesn't have a lid/sticker over their webcam yet? I have also kill-switched the built-in mic in the BIOS set-up but I'm not sure how secure this is. I would prefer there to be no built-in microphones in any hardware (except phones) at all. Sadly every modern laptop is equipped with a mic.
    - dsr_ 5y ago
      Most mics have mediocre sensitivity. Stick a blob of blu-tack or similar cohesive putty on it, take it off when you want to use the mic. Test by making recordings -- some machines have two or three mics.
    - cuu508 5y ago
      That's one plus point for desktops and nettops with no-frills motherboards. No mic, no speakers, no bluetooth, no wifi.
- Illniyar 5y ago
  That's a stretch. Most companies don't want to spy on their employees' free time. They want to 1- make sure they are compliant with the law and their confidential stuff is secure and 2 - make sure that you are actually working for them when you say you are. Installing something to listen to non-work related stuff serves neither of these goals, and would open them up to lawsuits and PR nightmares.
  - b3morales 5y ago
    The people who decide the spyware must be installed are likely so far removed from the actual spyware and the people who admin it as to have no knowledge or understanding of the distinction.
- dtjb 5y ago
  Where are these IT depts that have all this unlimited time and resources to spy on their employees? Sure you might get a bad actor voyeur, but as a matter of policy, companies just don't care what you're doing at home as long as their security interests are protected.
- Vrondi 5y ago
  Go to your router's settings and create a separate wifi for just these work situations. Connect client hardware to that wifi only. This keeps them out of your LAN. If your router can't do this, get a better router.
- jjav 5y ago
  Don't put a work laptop on your internal home network! I have a separate network for work machines at home, which goes straight to Internet and can't route in or out of my actual home network which is behind its own firewall.
SkyMarshal 5y ago
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.
- unnouinceput 5y ago
  Login in GitHub/whatever on your other laptop. Then send via e-mail bits of code you need from one to the other. When asked why is taking longer vs. other clients point this as the culprit. And also charge this client more.
- RileyJames 5y ago
  I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity. Otherwise, I expected them to provide all hardware and software required to perform my role. And likewise, for security purposes, that’s exactly what they wanted as well. Tho I would note, they wanted to perform a background check prior to starting. And while i didn’t have a problem with the employer having those details (for the period of the contract) they performed this function through a 3rd party, who has stated they won’t delete my data (I will be following up post-contract). I was not happy for a 3rd party to have this data. I would also not login to or install any apps, or certificates on my phone. Again, if that’s required, send me a phone. The company I was working for had SOC2 / ISO2700 / what ever and I think this is exactly why they wanted all this. But it suited me to seperate things as well.
  - nix23 5y ago
    Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.
    - Stranger43 5y ago
      Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.
biztos 5y ago
I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but they let you use your personal mobile devices for work (including iPad which was pretty nice) -- and wanted you to install their preferred spyware on it. I didn't do that but I expected they would eventually tell me to do it or stop using my personal iPad. It seems like now that it's technically feasible, big corporate IT managers want their spyware of choice running everywhere. Someday you will have an arm full of Apple Watches, one for each client. You should embrace this future and price it in.
- selfhoster11 5y ago
  Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.
  - twox2 5y ago
    Or they reimburse the consultant when they procure their own dedicated laptop for the client's work.
    - DnDGrognard 5y ago
      Plus the 25% management fee on top of the price :-)
    - spookthesunset 5y ago
      And hey, when the gig is over you got a new laptop that just needs to be formatted and it's all yours!
      - _fat_santa 5y ago
        At my agency we have a client that always ships us locked down laptops (healthcare space so understandable). Thing is this client, while very good at getting the laptops out to you, is horrible at actually getting them back and pretty much lets you keep them....I have 4 Macbook Pro's sitting on a shelf behind me, all from this client.
lallysingh 5y ago
Can you run all that in a cloud vm, and RDP into it for work?
- Lendal 5y ago
  This is the better option. I used to have a separate laptop just for one client and it was a pain in the ass. What happens when it gets damaged? They could charge you for the repair. Not worth the hassle of keeping track of it, lugging it around everywhere, keeping it charged & updated. Definitely a pain in the ass. Just do a cloud VM that the client owns with VPN access to the client's network. These are common now with Amazon Workspaces.
  - hoffspot 5y ago
    Seconded. We use Amazon Workspaces with access to our VPC for an offshore contracting firm we are working with.
kwhitefoot 5y ago
> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it." That's what Statnett in Norway did when I did some work for them a year ago (Lenovo X1 Carbon). The difference being that installing anything on it was pretty much impossible. All traffic went through the Statnett VPN. It's the most security conscious company I have had any experience of. But I was also able to use my own laptop by installing the Citrix client and that was much better. I had never used Citrix before and was pleasantly surprised at how fast it was.
eweise 5y ago
I would just charge them for a new laptop that is used exclusively for that project.
stef25 5y ago
> If you are a freelancer then your contract should allow you to do work for others Not only that, in some EU countries it's even illegal for a freelancer to work for 1x customer.
- spookthesunset 5y ago
  > Not only that, in some EU countries it's even illegal for a freelancer to work for 1x customer. How does that work? Is it more "exclusively for one customer" similar to the how the IRS rules work?
  - janoc 5y ago
    Simply - if you are working only for a single customer within a certain time period/receiving the majority of your income from a single source, you are considered to be an undeclared employee and not really a freelancer (= business) - and that exposes both you and the company to big fines. It is not the only criteria for this but a pretty large one. Both France and Germany have such laws but other countries do too. The point is that many companies would otherwise stiffle workers by forcing them into becoming freelancers because then they don't have to provide legally prescribed healthcare benefits, paid vacation, contributions to pension, etc. that employees get. And at the same time those workers don't have really the position to meaningfully negotiate their contracts to e.g. include extra pay for that missing vacation or healthcare/pension insurance. I.e. we are not talking about IT consultants but delivery drivers, cleaners, etc. - low paying jobs. I.e. Uber's business model - and that's exactly why it was banned/had big problems in many EU countries (in addition to completely flouting the existing taxi service regulations).
    - forty 5y ago
      In France in practice you can work 2-3 years for the same client without too much problem from what I could see. They just make sure to change the mission once in a while, so that the contract does look like it's lasting too long.
      - 5y ago
blihp 5y ago
Keeping their software segregated is sound advice, but as they are your client there are a couple of other ways I'd offer to handle it: 1) Keep all software related to work for their company segregated inside a VM. Then you can install whatever they require without interfering with your main system or potentially exposing data for other clients. 2) If they want a separate physical system, tell them you would be happy to provide it for a fee: an upfront fee for the cost of the system and an ongoing fee for maintenance of it. Be sure to mark everything up as you don't work for free. Since you're not an employee, you really shouldn't be asking them to provide hardware as (in the U.S., at least) this could create tax problems.
- hoffspot 5y ago
  We provide hardware to contractors all the time. They don't own the hardware so the loaner does not trigger a taxable event for them. When the contract is over, they return the hardware. The hard part about this in the current day and age is getting the units through customs.
  - blihp 5y ago
    In the U.S. the issue isn't a taxable event, as in a gift. The issue is 'independent' contractors working on equipment supplied by their 'client'. This is one of several tests the IRS can use to reclassify them as an employee for tax purposes. This tends to be more of an issue for solo contractors rather than contract houses as the IRS tends to look the other way on most of the larger contracting outfits.
mech422 5y ago
^^^ - This! You don't 'require' anything on equipment you don't provide. full stop. period.
neilv 5y ago
For independent technical consulting for over a decade, I had only a small number of high-value clients, so I ended up dedicating a ThinkPad to each client. I also had email account specific to each client, so that I could have a mail program on that ThinkPad access only the respective account. There are many reasons to do one laptop per client (especially if you're WFH, not traveling), including not exposing personal and other-client stuff to whatever weird stuff is in the build environment of one client. Another reason, though this never came up for me, is that there can be legal orders to permit inspection of the computer, online accounts, etc., including by computer forensics. If that happened for one client, that could be in conflict with your obligations to another client (as well as in conflict with your SO's private vacation photos, if they were on the same device). Being able to reassure that everything for a client was compartmentalized to certain devices and accounts might come in handy. At one point, I even had color-coded labelmaker tape to help keep track of what was compartmentalized to what. And photos of the devices with the physical labeling on them, in case I ever needed to convey that I took it seriously. (Related: One time, I had a hard drive fail such that (despite encryption) I couldn't do an approved wipe of it before disposal or warranty return. That client's compliance policies required that I physically destroy the drive platters, and ship the remnants to them via Registered Mail. It was a slightly fun/cool exercise, especially since the platters shattered nicely. And the neighborhood of $100 lost was well-invested in professionalism goodwill with a client who paid a few orders of magnitude of that amount over time.) (In some ways, I'm now happy to no longer be running a consulting business, mainly because a predictable, consistent amount of money just appears in my bank account every couple weeks. :)
incredimike 5y ago
This is almost exactly what I said when I was asked to install end-to-end protection software into my laptop as a freelancer. I stood my ground and they understood. They initially said they would send me another laptop to work from, but eventually relented on the requirements altogether and just limited my access to customer data.

anm89 5y ago

This sounds good on the surface but then you are still giving in to unnecessary surveillance during your workday. I would want a big compensation increase to deal with this. Like on the order of 2x my rate.

qwerty456127 5y ago

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it And they will install a trojan which would eavesdrop your talks, scan your home network and analyze its traffic.

xyst 5y ago
Network segmentation with vlan is what I would do.
- gnfargbl 5y ago
  Yep, exactly. I used to put client devices on a segregated network and tunnel their traffic out to pfSense running on a cheap cloud box somewhere. Worked well. (I should say that intentional monitoring of my private comms was never a concern for me when I freelanced, but I was somewhat worried about infections in my clients' devices moving laterally to my home network.)
  - unbanned 5y ago
    Who the fuck has time to do that?
  - lambdaba 5y ago
    As someone who isn't well versed in networking could you describe your setup in overview? Like, what software/hardware, etc.? Thank you
    - xnyan 5y ago
      Mini-rant: people on hacker news frequently undervalue their knowledge and don't consider the things they know to be of much worth. A classic example of this is the "I can't see why dropbox is a thing, simply build a cloud file sync service - easy" post. This poster is running their own semi-professional router (pfsense) on whitebox hardware. I would not want to do that unless I already knew what I was doing or wanted to spend some time learning. The type of network segmentation being discussed is not rocket science, but it's not trivial either. VLAN segmentation can have tricky edge cases that cause things to break in a non-obvious way, nothing that can't be worked around but for someone who "isn't well versed in networking" would probably be more than you're up for. Also keep in mind that you can't do this with most consumer networking gear becasue it's too complicated to setup and support without some experience and knowledge. I'd not recommend VLAN segmentation unless you want to become someone who is more versed, which I don't oppose, but it's not a switch you can flip in 5 seconds and never think about it again.
      - ArchOversight 5y ago
        I very much agree with this. I don't think that this is the solution for most home users/consultants working from home. The more obvious solution would be to get a separate WiFi router and internet connection strictly for work purposes. At that point you could also consider it a 100% home office expense and it may be tax deductible (talk to your accountant).
        Siira 5y ago
- ArchOversight 5y ago
  This is what I do for a variety of different things: - $CORP devices are on a VLAN + Wifi that has access to the internet, but no other internal networks - Internal network for file servers/printers and the like - Personal device network, think laptops/phones/tablets that are mine, can reach internal network - IoT network - Think sensors/robot vacuums/"smart devices" - Guest network, for well visitors to my home - AirPlay network, has all my Apple devices on it to allow for music to be airplay'ed to TV's/HomePods, can be reached from internal/personal/guest network Now I also understand that I am outlier, I am running a fully segmented, firewall, traffic inspected/logged home network with small business or even large business network gear, with FreeBSD as the router/firewall with a managed switch/WAP platform from TP-Link. This is not something the average home user or consultant is going to setup/configure/manage and I don't expect it either. The worry that the $CORP device will be abused to "validate the security of the network its connected to" is very much a possibility. Most corporations have no desire to do so, and endpoint protection is their primary goal, and they don't need to scan your home network to do so, it is all local to the device. It's about protecting the integrity of the device, not the rest of the network around it.
  - neverartful 5y ago
    Which TP-Link switch do you use?
    - ArchOversight 5y ago
      I use the Omada SDN business line-up.
endofreach 5y ago
Capture traffic and sue the f outta everything they do that‘s not covered by a contract. Someone has to start stopping this madness and protect less informed people. We are all steering into a dark future. And i lose hope when i see all these smart programmers complaining but not stepping up.
- qwerty456127 5y ago
  > Capture traffic and sue the f outta everything they do that‘s not covered by a contract. Whatever the app they would ask you to install would do probably is going to be allowed by its EULA (and I bet the EULA is also going to prohibit you from analyzing the app and whatever it does/communicates) and chances are you don't read it. And even if you do you most probably agree because you know all EULAs are brutal and there never is a button to object its specific part and continue. What we need is legislation to recognize all the data and metadata about your PC, all its software, your home networks&devices and their usage a kind of personal data and apply the same rules GDPR applies to tracking cookies - giving you the right to continue without agreeing to be spied on.
  - jtbayly 5y ago
    EULA has nothing to do with this. Question is whether software installed by company you’re working for spies on you in ways you haven’t agreed to. If so, sue them, not the co that wrote the spyware.
  - willcipriano 5y ago
    EULA is between the user and the vendor of the software, it isn't a agreement between the user and the users employer. Capturing traffic like that runs afoul of hacking laws.
    - qwerty456127 5y ago
      The employer can just give you an executable and say you must install it. The executable would show you an EULA and require you to accept it.
cprecioso 5y ago
If this is really the kind of things this company would do… why are you working for them?
- Radim 5y ago
  Because people need money to pay bills. And it's a sad fact that companies who do shady shit tend to have more money. Simply because they outcompete companies who don't, all else being equal. Tugging against this evolutionary pressure is really hard, not only for individuals but also on the society level. "Just quit LOL!" is a commendable act of grassroots activism, but not everyone is able (or willing) to afford such luxury.
- illud_tempus 5y ago
  > If this is really the kind of things this company would do… Because, until last week they didn't. Now I have to figure out if I'm just an unreasonable, stubborn old guy, or if this requirement is out of band.
  - hkt 5y ago
    It is out of band. Refuse or this becomes normal.
  - nix23 5y ago
    Tell them to provide you with a Virtual Desktop or a dedicated Laptop..never install Spyware on your own machine.
  - spookthesunset 5y ago
    I like others idea of getting them to spring for a dedicated computer. You just have to make it palatable to their accounting department. Maybe lease a laptop and expense the payments or something. If you have an accountant, I'd consider asking them for suggestions on "good ways" on how to make your client pay for your laptop. In my case, I just outright said "hey, you guys I really want you to be my client but I'm gonna need a new laptop". So we bought a new laptop as part of the contract.
  - 5y ago
eurasiantiger 5y ago
You keep your work laptop in your home network? Tut tut.
- spc476 5y ago
  I work frim home ... pandemic and all that. What else am I supposed to do?
  - 88 5y ago
    VLAN is the obvious and most cost-effective mitigation
    - allarm 5y ago
      Not really. VLAN provides segmentation, but it does not provide any mechanisms to limit access to other vlans in your network - which are most likely routed by your router. You will need to add some L3 filtering (acls/iptables/whatever) to isolate segments.
      - formerly_proven 5y ago
        That's only true if use of VLAN tags is controlled by hosts; if you use a smart switch to assign VLANs to ports it's pretty much as-if you have multiple, physically separated networks.
        addingnumbers 5y ago
        Segmenting your broadcast domains doesn't help much if traffic is routed freely between them.
        spookthesunset 5y ago
        All nice, but now you need managed switches and stuff plus some amount of unbillable time to configure it all and fix it when it breaks. Might be worth it if your bill rate accommodates it though.
yholio 5y ago
That's why you tape off cameras and stick a needle in condenser mics on any new laptop.
- woodson 5y ago
  Don't they use MEMS microphones nowadays? (https://en.wikipedia.org/wiki/Microelectromechanical_systems https://en.wikipedia.org/wiki/Microelectromechanical_systems) Either way, solid advice!
  - shabble 5y ago
    sticking a needle in a MEMS microphone is just as effective, you just have to [find the damn thing, and] push the needle all the way through! If brute force isn't working, you're just not using enough of it yet.
  - yholio 5y ago
    Learn a thing every day I guess. Nonetheless, is inconsequential to task at hand if you apply the "Rosemary Kennedy" method to the laptobotomy: activate the mic, jam that needle in the hole and wiggle it around until the girl can no longer sing, no activity is detected on the vu-meters and nothing is played back in the recording. You have audio-video input sensors on all sort of programable devices nowadays, even some TVs can be turned into two way communication devices. That's a nice 1984ish vibe to ruin your late night matrimonial TV browsing.
blitzar 5y ago
> And they will install a trojan They WILL > which would eavesdrop your talks That absolutely WILL - use the microphone and listen to everything being said (why not the camera too and watch everthing?) > scan your home network and analyze its traffic. That absolutely WILL - do all this stuff I mean if this is definately going to happen, then the company can go ahead and cut an 8 figure cheque straight away. Which company and where do I sign up?
- qwerty456127 5y ago
  > why not the camera too and watch everthing Because who doesn't have a lid/sticker over their webcam yet? I have also kill-switched the built-in mic in the BIOS set-up but I'm not sure how secure this is. I would prefer there to be no built-in microphones in any hardware (except phones) at all. Sadly every modern laptop is equipped with a mic.
  - dsr_ 5y ago
    Most mics have mediocre sensitivity. Stick a blob of blu-tack or similar cohesive putty on it, take it off when you want to use the mic. Test by making recordings -- some machines have two or three mics.
  - cuu508 5y ago
    That's one plus point for desktops and nettops with no-frills motherboards. No mic, no speakers, no bluetooth, no wifi.
Illniyar 5y ago
That's a stretch. Most companies don't want to spy on their employees' free time. They want to 1- make sure they are compliant with the law and their confidential stuff is secure and 2 - make sure that you are actually working for them when you say you are. Installing something to listen to non-work related stuff serves neither of these goals, and would open them up to lawsuits and PR nightmares.
- b3morales 5y ago
  The people who decide the spyware must be installed are likely so far removed from the actual spyware and the people who admin it as to have no knowledge or understanding of the distinction.
dtjb 5y ago
Where are these IT depts that have all this unlimited time and resources to spy on their employees? Sure you might get a bad actor voyeur, but as a matter of policy, companies just don't care what you're doing at home as long as their security interests are protected.
Vrondi 5y ago
Go to your router's settings and create a separate wifi for just these work situations. Connect client hardware to that wifi only. This keeps them out of your LAN. If your router can't do this, get a better router.
jjav 5y ago
Don't put a work laptop on your internal home network! I have a separate network for work machines at home, which goes straight to Internet and can't route in or out of my actual home network which is behind its own firewall.

SkyMarshal 5y ago

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

unnouinceput 5y ago
Login in GitHub/whatever on your other laptop. Then send via e-mail bits of code you need from one to the other. When asked why is taking longer vs. other clients point this as the culprit. And also charge this client more.
RileyJames 5y ago
I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity. Otherwise, I expected them to provide all hardware and software required to perform my role. And likewise, for security purposes, that’s exactly what they wanted as well. Tho I would note, they wanted to perform a background check prior to starting. And while i didn’t have a problem with the employer having those details (for the period of the contract) they performed this function through a 3rd party, who has stated they won’t delete my data (I will be following up post-contract). I was not happy for a 3rd party to have this data. I would also not login to or install any apps, or certificates on my phone. Again, if that’s required, send me a phone. The company I was working for had SOC2 / ISO2700 / what ever and I think this is exactly why they wanted all this. But it suited me to seperate things as well.
- nix23 5y ago
  Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.
  - Stranger43 5y ago
    Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.

biztos 5y ago

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but they let you use your personal mobile devices for work (including iPad which was pretty nice) -- and wanted you to install their preferred spyware on it. I didn't do that but I expected they would eventually tell me to do it or stop using my personal iPad. It seems like now that it's technically feasible, big corporate IT managers want their spyware of choice running everywhere. Someday you will have an arm full of Apple Watches, one for each client. You should embrace this future and price it in.

selfhoster11 5y ago
Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.
- twox2 5y ago
  Or they reimburse the consultant when they procure their own dedicated laptop for the client's work.
  - DnDGrognard 5y ago
    Plus the 25% management fee on top of the price :-)
  - spookthesunset 5y ago
    And hey, when the gig is over you got a new laptop that just needs to be formatted and it's all yours!
    - _fat_santa 5y ago
      At my agency we have a client that always ships us locked down laptops (healthcare space so understandable). Thing is this client, while very good at getting the laptops out to you, is horrible at actually getting them back and pretty much lets you keep them....I have 4 Macbook Pro's sitting on a shelf behind me, all from this client.

lallysingh 5y ago

Can you run all that in a cloud vm, and RDP into it for work?

Lendal 5y ago
This is the better option. I used to have a separate laptop just for one client and it was a pain in the ass. What happens when it gets damaged? They could charge you for the repair. Not worth the hassle of keeping track of it, lugging it around everywhere, keeping it charged & updated. Definitely a pain in the ass. Just do a cloud VM that the client owns with VPN access to the client's network. These are common now with Amazon Workspaces.
- hoffspot 5y ago
  Seconded. We use Amazon Workspaces with access to our VPC for an offshore contracting firm we are working with.

kwhitefoot 5y ago

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it." That's what Statnett in Norway did when I did some work for them a year ago (Lenovo X1 Carbon). The difference being that installing anything on it was pretty much impossible. All traffic went through the Statnett VPN. It's the most security conscious company I have had any experience of. But I was also able to use my own laptop by installing the Citrix client and that was much better. I had never used Citrix before and was pleasantly surprised at how fast it was.

eweise 5y ago

I would just charge them for a new laptop that is used exclusively for that project.

stef25 5y ago

> If you are a freelancer then your contract should allow you to do work for others Not only that, in some EU countries it's even illegal for a freelancer to work for 1x customer.

spookthesunset 5y ago
> Not only that, in some EU countries it's even illegal for a freelancer to work for 1x customer. How does that work? Is it more "exclusively for one customer" similar to the how the IRS rules work?
- janoc 5y ago
  Simply - if you are working only for a single customer within a certain time period/receiving the majority of your income from a single source, you are considered to be an undeclared employee and not really a freelancer (= business) - and that exposes both you and the company to big fines. It is not the only criteria for this but a pretty large one. Both France and Germany have such laws but other countries do too. The point is that many companies would otherwise stiffle workers by forcing them into becoming freelancers because then they don't have to provide legally prescribed healthcare benefits, paid vacation, contributions to pension, etc. that employees get. And at the same time those workers don't have really the position to meaningfully negotiate their contracts to e.g. include extra pay for that missing vacation or healthcare/pension insurance. I.e. we are not talking about IT consultants but delivery drivers, cleaners, etc. - low paying jobs. I.e. Uber's business model - and that's exactly why it was banned/had big problems in many EU countries (in addition to completely flouting the existing taxi service regulations).
  - forty 5y ago
    In France in practice you can work 2-3 years for the same client without too much problem from what I could see. They just make sure to change the mission once in a while, so that the contract does look like it's lasting too long.
    - 5y ago

blihp 5y ago

Keeping their software segregated is sound advice, but as they are your client there are a couple of other ways I'd offer to handle it: 1) Keep all software related to work for their company segregated inside a VM. Then you can install whatever they require without interfering with your main system or potentially exposing data for other clients. 2) If they want a separate physical system, tell them you would be happy to provide it for a fee: an upfront fee for the cost of the system and an ongoing fee for maintenance of it. Be sure to mark everything up as you don't work for free. Since you're not an employee, you really shouldn't be asking them to provide hardware as (in the U.S., at least) this could create tax problems.

hoffspot 5y ago
We provide hardware to contractors all the time. They don't own the hardware so the loaner does not trigger a taxable event for them. When the contract is over, they return the hardware. The hard part about this in the current day and age is getting the units through customs.
- blihp 5y ago
  In the U.S. the issue isn't a taxable event, as in a gift. The issue is 'independent' contractors working on equipment supplied by their 'client'. This is one of several tests the IRS can use to reclassify them as an employee for tax purposes. This tends to be more of an issue for solo contractors rather than contract houses as the IRS tends to look the other way on most of the larger contracting outfits.

mech422 5y ago

^^^ - This! You don't 'require' anything on equipment you don't provide. full stop. period.

neilv 5y ago

For independent technical consulting for over a decade, I had only a small number of high-value clients, so I ended up dedicating a ThinkPad to each client. I also had email account specific to each client, so that I could have a mail program on that ThinkPad access only the respective account. There are many reasons to do one laptop per client (especially if you're WFH, not traveling), including not exposing personal and other-client stuff to whatever weird stuff is in the build environment of one client. Another reason, though this never came up for me, is that there can be legal orders to permit inspection of the computer, online accounts, etc., including by computer forensics. If that happened for one client, that could be in conflict with your obligations to another client (as well as in conflict with your SO's private vacation photos, if they were on the same device). Being able to reassure that everything for a client was compartmentalized to certain devices and accounts might come in handy. At one point, I even had color-coded labelmaker tape to help keep track of what was compartmentalized to what. And photos of the devices with the physical labeling on them, in case I ever needed to convey that I took it seriously. (Related: One time, I had a hard drive fail such that (despite encryption) I couldn't do an approved wipe of it before disposal or warranty return. That client's compliance policies required that I physically destroy the drive platters, and ship the remnants to them via Registered Mail. It was a slightly fun/cool exercise, especially since the platters shattered nicely. And the neighborhood of $100 lost was well-invested in professionalism goodwill with a client who paid a few orders of magnitude of that amount over time.) (In some ways, I'm now happy to no longer be running a consulting business, mainly because a predictable, consistent amount of money just appears in my bank account every couple weeks. :)

incredimike 5y ago

This is almost exactly what I said when I was asked to install end-to-end protection software into my laptop as a freelancer. I stood my ground and they understood. They initially said they would send me another laptop to work from, but eventually relented on the requirements altogether and just limited my access to customer data.