6 ms·

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still goi

> If you want to ship me a dedicated laptop for your engagement, I would be happy to install whatever you want on it. I wouldn't offer this. You're still going to need to login to Github/email/wherever with your personal password, manage private keys, and stuff like that. Just say no.

unnouinceput 5y ago
Login in GitHub/whatever on your other laptop. Then send via e-mail bits of code you need from one to the other. When asked why is taking longer vs. other clients point this as the culprit. And also charge this client more.
RileyJames 5y ago
I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity. Otherwise, I expected them to provide all hardware and software required to perform my role. And likewise, for security purposes, that’s exactly what they wanted as well. Tho I would note, they wanted to perform a background check prior to starting. And while i didn’t have a problem with the employer having those details (for the period of the contract) they performed this function through a 3rd party, who has stated they won’t delete my data (I will be following up post-contract). I was not happy for a 3rd party to have this data. I would also not login to or install any apps, or certificates on my phone. Again, if that’s required, send me a phone. The company I was working for had SOC2 / ISO2700 / what ever and I think this is exactly why they wanted all this. But it suited me to seperate things as well.
- nix23 5y ago
  Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.
  - Stranger43 5y ago
    Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.
    - nix23 5y ago
      If you can pay 7500$/y for spyware you can surely pay for a VDI-Product.
      - Stranger43 5y ago
        The problem is rarely the monetary costs alone it's more about the need for handling an one-off situation that require special policies, and becomes an special item on the budget. For large companies supplying VDI to consultants tend to be an standardized package that gets billed back to whatever project is hiring the consultants but for mid-sized organisation VDI is a big scary word that's going to require special handling. Most desktop support teams are completely dependent on standardization to the point where they tend to turn into complete control freaks, that panic at the thought of anything that is not "by the book", so they often just apply the book without additional budgets to external consultants.
        nix23 5y ago
        I am not interested in politics or humans when the problem is a technical one, i understand you but that's my stand ;)
  - selfhoster11 5y ago
    I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.
- learc83 5y ago
  One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools. It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.
  - shabble 5y ago
    You could reasonably invoice an upfront tooling cost ("isolated development workstation to meet customer IT policy requirements. Apple Macbook Foo, $BIGNUM") If you want to be really cheeky, could get some value-added margin on it too, and as a bonus, AIUI it would be yours to keep after the engagement, rather than having to return hardware they've assigned to you. Might be tough to get past finance though, unless they really want that certification :)
    - ganoushoreilly 5y ago
      We've got a few machines we've inherited this way. For one client they needed confirmation that we had a sanitized infrastructure for our pentest and that we captured and logged all traffic to and fro. We billed them for the equipment and network link etc. Upon completion of the project we provided a certified copy of data destruction in accordance with their policies / guidelines and were left with a bunch of stuff. Scored two GPU cracking rigs, couple laptops, and some Cisco gear. I didn't complain. Granted now those rigs are a bit dated, but at the time 1080's were hard to get during the last mining rush so they definitely weren't cheap.
  - RileyJames 5y ago
    But in that case I’d agree with the OP. I’m not installing what ever you want on my hardware. I probably was more of a “temporary employee” than a contractor. But what’s the difference at that point? I was paid more than the value of entitlements as cash. It suited both parties, and was mutually agreed. In hindsight, having them provide the hardware, and then handing it back at the end of the engagement would be my preference. It reduced any risks for them and me. Tho I can easily imagine on/off or short infrequent contracting scenarios that this would not work for.
GoblinSlayer 5y ago
Just compartmentalize your passwords and private keys. That said, private keys are generated on the dedicated hardware and always stay there - that's all you need to manage them.
- blitzar 5y ago
  + 2fa + sensible rotation of keys and passwords (especially if you use say github for personal / work / multiple clients) - they can have the password at that point and it is of limited use.
- withinboredom 5y ago
  I store all my keys in a yubikey (including ssh keys). The client can’t have the keys if I don’t have the keys.
ozim 5y ago
I would strongly advise to not use personal accounts for customer. Yeah like sending invoices arranging contracts I use my main mail account. For doing customer things I rather setup new email account or get one from the customer.
codingdave 5y ago
If they are sending a dedicated laptop, I'd recommend using dedicated accounts for that client. I don't use personal accounts on my work system even as a full-time employee.
byron4242 5y ago
It's a widespread practice that companies provide laptops to contractors to compartmentalize the way they interact with the company's IT. But I'm really quite opposed to it. At one point I had 3 sets of machines: Two different 14" laptops from two different clients and my own machines. At some point you simply run out of space on your desk and end up constantly either working on screens that are too small (14" really isn't enough to be productive), or plugging laptops in to and out of screens as you're context-switching. Carrying three laptops with you when you're travelling if you anticipate having to work for both clients during that timeframe is also not exactly my definition of great fun. And you end up duplicating a lot of effort around managing that IT, like tweaking settings the way you like them etc. The argument "we own this laptop, so we can do with it whatever we want, including spying on you" is just not valid. They're either doing things that I'm okay with, in which case I'm okay doing it on my own hardware. Or they're doing things I'm opposed to, in which case I'm opposed to it no matter who owns the hardware. Also: In many European countries, authorities are clamping down hard on practices whereby companies pass people off as contractors who really are employees. They usually work off of lists of criteria of what makes an employee, and if you fit too many of those criteria while, on paper, passing yourself off as a contractor, then you and your client can be in for a world of pain. One of the criteria that makes you look more like a contractor and less like an employee to the government is providing your own facilities like the computer you work with. And, last but not least, it's just not a good way of dealing with the planet's resources.
- skjoldr 5y ago
  If you can afford to spend a bit of money on the problem, it's possible to use something like PiKVM or KVM-over-IP to just leave a stack of client laptops or mini-PCs out of the way somewhere and connect to them remotely in a reliable way, so you can reset the machine if the remote desktop software fails.
- andrewzah 5y ago
  "either working on screens that are too small (14" really isn't enough to be productive)" I work primarily from a 13" xps. Given the high-res display + that I can switch desktops easily via i3, it's really a non issue for what I do. You can also use a dock. For my work laptop, I use the Caldigit TS3+ thunderbolt and it's great.
ljm 5y ago
Between a) using my own machine, b) using a company machine and c) firing the client, option B is pretty sensible. Option C is for when the client won't compromise at all. You can always make separate github accounts, SSH keys, and so on, specifically for the job.
illud_tempus 5y ago
I don't use my private accounts for anything related to this client.
vmception 5y ago
if only you could make a new set of those... a lot of developers have separate everything this can be bad when encountering the recruiters and hiring managers that still look at github activity as clout, but these days you still have to pass the technical interview no matter how much clout you have so I wouldn't worry about it
comeonseriously 5y ago
> personal Uh, hell no. You should have business accounts. Personal and business never mix.
janoc 5y ago
No sane person would use their personal logins or private keys for customer work. Create ones for that project! Yes, it is a pain but having a bunch of expensive lawyers breathing down your neck is an even bigger one! You want to separate your customer's work from your personal or other clients' data, even if they don't install any spyware on your computer. How are you supposed to ensure that you don't accidentally breach any NDAs (that you, no doubt, had to sign) if you are commingling the stuff?

unnouinceput 5y ago

Login in GitHub/whatever on your other laptop. Then send via e-mail bits of code you need from one to the other. When asked why is taking longer vs. other clients point this as the culprit. And also charge this client more.

RileyJames 5y ago

I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity. Otherwise, I expected them to provide all hardware and software required to perform my role. And likewise, for security purposes, that’s exactly what they wanted as well. Tho I would note, they wanted to perform a background check prior to starting. And while i didn’t have a problem with the employer having those details (for the period of the contract) they performed this function through a 3rd party, who has stated they won’t delete my data (I will be following up post-contract). I was not happy for a 3rd party to have this data. I would also not login to or install any apps, or certificates on my phone. Again, if that’s required, send me a phone. The company I was working for had SOC2 / ISO2700 / what ever and I think this is exactly why they wanted all this. But it suited me to seperate things as well.

nix23 5y ago
Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.
- Stranger43 5y ago
  Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.
  - nix23 5y ago
    If you can pay 7500$/y for spyware you can surely pay for a VDI-Product.
    - Stranger43 5y ago
      The problem is rarely the monetary costs alone it's more about the need for handling an one-off situation that require special policies, and becomes an special item on the budget. For large companies supplying VDI to consultants tend to be an standardized package that gets billed back to whatever project is hiring the consultants but for mid-sized organisation VDI is a big scary word that's going to require special handling. Most desktop support teams are completely dependent on standardization to the point where they tend to turn into complete control freaks, that panic at the thought of anything that is not "by the book", so they often just apply the book without additional budgets to external consultants.
      - nix23 5y ago
        I am not interested in politics or humans when the problem is a technical one, i understand you but that's my stand ;)
- selfhoster11 5y ago
  I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.
learc83 5y ago
One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools. It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.
- shabble 5y ago
  You could reasonably invoice an upfront tooling cost ("isolated development workstation to meet customer IT policy requirements. Apple Macbook Foo, $BIGNUM") If you want to be really cheeky, could get some value-added margin on it too, and as a bonus, AIUI it would be yours to keep after the engagement, rather than having to return hardware they've assigned to you. Might be tough to get past finance though, unless they really want that certification :)
  - ganoushoreilly 5y ago
    We've got a few machines we've inherited this way. For one client they needed confirmation that we had a sanitized infrastructure for our pentest and that we captured and logged all traffic to and fro. We billed them for the equipment and network link etc. Upon completion of the project we provided a certified copy of data destruction in accordance with their policies / guidelines and were left with a bunch of stuff. Scored two GPU cracking rigs, couple laptops, and some Cisco gear. I didn't complain. Granted now those rigs are a bit dated, but at the time 1080's were hard to get during the last mining rush so they definitely weren't cheap.
- RileyJames 5y ago
  But in that case I’d agree with the OP. I’m not installing what ever you want on my hardware. I probably was more of a “temporary employee” than a contractor. But what’s the difference at that point? I was paid more than the value of entitlements as cash. It suited both parties, and was mutually agreed. In hindsight, having them provide the hardware, and then handing it back at the end of the engagement would be my preference. It reduced any risks for them and me. Tho I can easily imagine on/off or short infrequent contracting scenarios that this would not work for.

GoblinSlayer 5y ago

Just compartmentalize your passwords and private keys. That said, private keys are generated on the dedicated hardware and always stay there - that's all you need to manage them.

blitzar 5y ago
+ 2fa + sensible rotation of keys and passwords (especially if you use say github for personal / work / multiple clients) - they can have the password at that point and it is of limited use.
withinboredom 5y ago
I store all my keys in a yubikey (including ssh keys). The client can’t have the keys if I don’t have the keys.

ozim 5y ago

I would strongly advise to not use personal accounts for customer. Yeah like sending invoices arranging contracts I use my main mail account. For doing customer things I rather setup new email account or get one from the customer.

codingdave 5y ago

If they are sending a dedicated laptop, I'd recommend using dedicated accounts for that client. I don't use personal accounts on my work system even as a full-time employee.

byron4242 5y ago

It's a widespread practice that companies provide laptops to contractors to compartmentalize the way they interact with the company's IT. But I'm really quite opposed to it. At one point I had 3 sets of machines: Two different 14" laptops from two different clients and my own machines. At some point you simply run out of space on your desk and end up constantly either working on screens that are too small (14" really isn't enough to be productive), or plugging laptops in to and out of screens as you're context-switching. Carrying three laptops with you when you're travelling if you anticipate having to work for both clients during that timeframe is also not exactly my definition of great fun. And you end up duplicating a lot of effort around managing that IT, like tweaking settings the way you like them etc. The argument "we own this laptop, so we can do with it whatever we want, including spying on you" is just not valid. They're either doing things that I'm okay with, in which case I'm okay doing it on my own hardware. Or they're doing things I'm opposed to, in which case I'm opposed to it no matter who owns the hardware. Also: In many European countries, authorities are clamping down hard on practices whereby companies pass people off as contractors who really are employees. They usually work off of lists of criteria of what makes an employee, and if you fit too many of those criteria while, on paper, passing yourself off as a contractor, then you and your client can be in for a world of pain. One of the criteria that makes you look more like a contractor and less like an employee to the government is providing your own facilities like the computer you work with. And, last but not least, it's just not a good way of dealing with the planet's resources.

skjoldr 5y ago
If you can afford to spend a bit of money on the problem, it's possible to use something like PiKVM or KVM-over-IP to just leave a stack of client laptops or mini-PCs out of the way somewhere and connect to them remotely in a reliable way, so you can reset the machine if the remote desktop software fails.
andrewzah 5y ago
"either working on screens that are too small (14" really isn't enough to be productive)" I work primarily from a 13" xps. Given the high-res display + that I can switch desktops easily via i3, it's really a non issue for what I do. You can also use a dock. For my work laptop, I use the Caldigit TS3+ thunderbolt and it's great.

ljm 5y ago

Between a) using my own machine, b) using a company machine and c) firing the client, option B is pretty sensible. Option C is for when the client won't compromise at all. You can always make separate github accounts, SSH keys, and so on, specifically for the job.

illud_tempus 5y ago

I don't use my private accounts for anything related to this client.

vmception 5y ago

if only you could make a new set of those... a lot of developers have separate everything this can be bad when encountering the recruiters and hiring managers that still look at github activity as clout, but these days you still have to pass the technical interview no matter how much clout you have so I wouldn't worry about it

comeonseriously 5y ago

> personal Uh, hell no. You should have business accounts. Personal and business never mix.

janoc 5y ago

No sane person would use their personal logins or private keys for customer work. Create ones for that project! Yes, it is a pain but having a bunch of expensive lawyers breathing down your neck is an even bigger one! You want to separate your customer's work from your personal or other clients' data, even if they don't install any spyware on your computer. How are you supposed to ensure that you don't accidentally breach any NDAs (that you, no doubt, had to sign) if you are commingling the stuff?