5 ms·

Do you object outright to spyware, or to the client wanting to run their spyware on your equipment? It sounds like the spyware is non negotiable and I personal

Do you object outright to spyware, or to the client wanting to run their spyware on your equipment? It sounds like the spyware is non negotiable and I personally wouldn’t have issue with it if the client also provides a laptop on which to run it. The client is free to do whatever the hell they like with their own hardware. What’s objectionable about situations like this is the client wanting to have their spyware cake and eat it on someone else’s computer. That’s a great deal for them — why pay $5k for a laptop when you can just pay $100 for the spyware license instead?! I realize the economics aren’t exactly on point, but I tend to view situations like this as them stealing $5000 — my laptop — from me. So moving forward: 1/ you are “happy to help them reach their compliance goal and move to a Drata controlled environment” 2/ to do so you “will need to isolate them, as a client, to an airgapped environment solely for their work” 3/ which will need “$5k up front and a lead time of a week to order new hardware, or for the client to ship you a preconfigured laptop with configuration X Y and Z.” Saying yes with principled conditions is always a good route forward. Yes-but instead of no-but.

illud_tempus 5y ago
> Do you object outright to spyware, or to the client wanting to run their spyware on your equipment? I don't know for a fact that it is spyware. For now I just think of it as an "hostile agent". I object because a) I don't want frustrations at work. I want to focus on the problems I am there to solve (which are quite interesting), b) I don't want a hostile agent from a company selling data to "targeted marketing" in my network, c) I don't want such companies even to know my real name, d) I take security seriously - I hate security theater. That's what I object to.
- gorgoiler 5y ago
  Thanks for responding and writing up more details. I empathise with the frustration of having to follow rules for rules' sake. Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another. In the past I've been faced with similar situations where corporate IT required ne to run a "security agent" if I wanted to bring my own device to their network. I ended up bringing a Raspberry Pi which ran their "security agent", but then I did all my work on a laptop that connected through the Pi via NAT. This was at a high school where I was a teacher. The "agent" did an SSL MITM attack, allowing the school IT to see all my traffic. I'm fine with needing that stuff to keep the kids safe but I objected to the school needing to inspect staff traffic. If they mistrusted me to the level of needing to read my email, what the hell were they doing leaving me in a roomful of children all day? If you had two spare Pis you could do a three machine shit-sandwich: (1) trusted-pi is all yours and connects to your home network offering strictly controlled minimal internet access to... (2) the security-theatre-pi, running the client's weird spy/monitoring software; and then (3) your personal laptop connects via the security-theatre-pi. I'd prefer to be direct and up-front with them – it doesn't feel great to have to be duplicitous with people the way I did / suggest you do – but a $50 pi might be able to tick their box and let you get on with the interesting stuff.
  - illud_tempus 5y ago
    > Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another. That would create a layer of cynicism between me and my work. I don't have that today, and I would rather avoid it.
    - gorgoiler 5y ago
      Well said, and good luck with your problem. These workarounds are a flag one is in the wrong place. I recently left the job where I did the two-pis hack.
      - Jenda_ 5y ago
        It's interesting that both the school and the job "security agent" ran on Linux on ARM. I would expect these things to be Windows-only, or at least x86-only.
    - jameshart 5y ago
      But you’re the one describing a piece of software they are asking you to install as a condition of employment as a ‘hostile agent’. Feels like the layer of cynicism is already there.
      - illud_tempus 5y ago
        Not on my part. Not with the people in the company I usually deal with. When a new manager I don't know send me an email to install some "agent" from a company I have never heard about, and that company turns out to have terms and conditions from hell (like references to undisclosed terms and conditions they want me to accept) - then I label that thing, in my mind, as a "hostile agent". It's not something that will ever get access to my lan. It's something I don't even want in a VM, because it may know how to escape from a VM. That's not cynicism. That's risk assessment.
DnDGrognard 5y ago
And most peoples home network wont be able to support VLAN's and would your employer be more worried about your ISP provided router - hmm must really replace that huawei router on my network.
- gorgoiler 5y ago
  Here's a five port 802.1Q VLAN switch for $39.99 + tax: https://www.newegg.com/netgear-gs105e/p/N82E16833122598 https://www.newegg.com/netgear-gs105e/p/N82E16833122598
  - tyingq 5y ago
    I think it would be reasonable to ask for a separate internet connection and router myself. If someone wants me to install opaque software that can do whatever it wants in terms of outbound/inbound packets, then they should be okay paying for it to be completely separate.
  - DnDGrognard 5y ago
    Interesting though my network is powerline so id need one in front of every POE switch (and that's assuming the powerline devices would pass the Vlan tags) And id need a VDSL Router that supported Vlans as well so that's 4 switch's plus a router.
    - DnDGrognard 5y ago
      Edit I meant switch in front of each powerline adaptor
- tony-allan 5y ago
  What about the guest network? These are usually isolated from other devices at home.

illud_tempus 5y ago

> Do you object outright to spyware, or to the client wanting to run their spyware on your equipment? I don't know for a fact that it is spyware. For now I just think of it as an "hostile agent". I object because a) I don't want frustrations at work. I want to focus on the problems I am there to solve (which are quite interesting), b) I don't want a hostile agent from a company selling data to "targeted marketing" in my network, c) I don't want such companies even to know my real name, d) I take security seriously - I hate security theater. That's what I object to.

gorgoiler 5y ago
Thanks for responding and writing up more details. I empathise with the frustration of having to follow rules for rules' sake. Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another. In the past I've been faced with similar situations where corporate IT required ne to run a "security agent" if I wanted to bring my own device to their network. I ended up bringing a Raspberry Pi which ran their "security agent", but then I did all my work on a laptop that connected through the Pi via NAT. This was at a high school where I was a teacher. The "agent" did an SSL MITM attack, allowing the school IT to see all my traffic. I'm fine with needing that stuff to keep the kids safe but I objected to the school needing to inspect staff traffic. If they mistrusted me to the level of needing to read my email, what the hell were they doing leaving me in a roomful of children all day? If you had two spare Pis you could do a three machine shit-sandwich: (1) trusted-pi is all yours and connects to your home network offering strictly controlled minimal internet access to... (2) the security-theatre-pi, running the client's weird spy/monitoring software; and then (3) your personal laptop connects via the security-theatre-pi. I'd prefer to be direct and up-front with them – it doesn't feel great to have to be duplicitous with people the way I did / suggest you do – but a $50 pi might be able to tick their box and let you get on with the interesting stuff.
- illud_tempus 5y ago
  > Another approach you can try is to conform to their requirements on one machine, but do all your actual work on another. That would create a layer of cynicism between me and my work. I don't have that today, and I would rather avoid it.
  - gorgoiler 5y ago
    Well said, and good luck with your problem. These workarounds are a flag one is in the wrong place. I recently left the job where I did the two-pis hack.
    - Jenda_ 5y ago
      It's interesting that both the school and the job "security agent" ran on Linux on ARM. I would expect these things to be Windows-only, or at least x86-only.
  - jameshart 5y ago
    But you’re the one describing a piece of software they are asking you to install as a condition of employment as a ‘hostile agent’. Feels like the layer of cynicism is already there.
    - illud_tempus 5y ago
      Not on my part. Not with the people in the company I usually deal with. When a new manager I don't know send me an email to install some "agent" from a company I have never heard about, and that company turns out to have terms and conditions from hell (like references to undisclosed terms and conditions they want me to accept) - then I label that thing, in my mind, as a "hostile agent". It's not something that will ever get access to my lan. It's something I don't even want in a VM, because it may know how to escape from a VM. That's not cynicism. That's risk assessment.

DnDGrognard 5y ago

And most peoples home network wont be able to support VLAN's and would your employer be more worried about your ISP provided router - hmm must really replace that huawei router on my network.

gorgoiler 5y ago
Here's a five port 802.1Q VLAN switch for $39.99 + tax: https://www.newegg.com/netgear-gs105e/p/N82E16833122598 https://www.newegg.com/netgear-gs105e/p/N82E16833122598
- tyingq 5y ago
  I think it would be reasonable to ask for a separate internet connection and router myself. If someone wants me to install opaque software that can do whatever it wants in terms of outbound/inbound packets, then they should be okay paying for it to be completely separate.
- DnDGrognard 5y ago
  Interesting though my network is powerline so id need one in front of every POE switch (and that's assuming the powerline devices would pass the Vlan tags) And id need a VDSL Router that supported Vlans as well so that's 4 switch's plus a router.
  - DnDGrognard 5y ago
    Edit I meant switch in front of each powerline adaptor
tony-allan 5y ago
What about the guest network? These are usually isolated from other devices at home.