4 ms·

I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was

I’d like to say no, but I’m not sure it’s an unreasonable request. I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity. Otherwise, I expected them to provide all hardware and software required to perform my role. And likewise, for security purposes, that’s exactly what they wanted as well. Tho I would note, they wanted to perform a background check prior to starting. And while i didn’t have a problem with the employer having those details (for the period of the contract) they performed this function through a 3rd party, who has stated they won’t delete my data (I will be following up post-contract). I was not happy for a 3rd party to have this data. I would also not login to or install any apps, or certificates on my phone. Again, if that’s required, send me a phone. The company I was working for had SOC2 / ISO2700 / what ever and I think this is exactly why they wanted all this. But it suited me to seperate things as well.

nix23 5y ago
Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.
- Stranger43 5y ago
  Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.
  - nix23 5y ago
    If you can pay 7500$/y for spyware you can surely pay for a VDI-Product.
    - Stranger43 5y ago
      The problem is rarely the monetary costs alone it's more about the need for handling an one-off situation that require special policies, and becomes an special item on the budget. For large companies supplying VDI to consultants tend to be an standardized package that gets billed back to whatever project is hiring the consultants but for mid-sized organisation VDI is a big scary word that's going to require special handling. Most desktop support teams are completely dependent on standardization to the point where they tend to turn into complete control freaks, that panic at the thought of anything that is not "by the book", so they often just apply the book without additional budgets to external consultants.
      - nix23 5y ago
        I am not interested in politics or humans when the problem is a technical one, i understand you but that's my stand ;)
- selfhoster11 5y ago
  I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.
  - discardedrefuse 5y ago
    > Internet Explorer ActiveX plugin Virtualized desktops have been solved. All the major players offer them. FFS, you can run Xbox One games in the cloud and play in your browser now.
  - nix23 5y ago
    That sound's like it is a looong time ago, todays VD's are extremely responsive just have a look at Shadow for example.
    - selfhoster11 5y ago
      ~6 years ago. I'd be surprised if such things weren't still deployed in places.
- solnyshok 5y ago
  why not spin up a VM dedicated to that client and confine all crapware to that VM?
  - nix23 5y ago
    Absolutely!
learc83 5y ago
One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools. It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.
- shabble 5y ago
  You could reasonably invoice an upfront tooling cost ("isolated development workstation to meet customer IT policy requirements. Apple Macbook Foo, $BIGNUM") If you want to be really cheeky, could get some value-added margin on it too, and as a bonus, AIUI it would be yours to keep after the engagement, rather than having to return hardware they've assigned to you. Might be tough to get past finance though, unless they really want that certification :)
  - ganoushoreilly 5y ago
    We've got a few machines we've inherited this way. For one client they needed confirmation that we had a sanitized infrastructure for our pentest and that we captured and logged all traffic to and fro. We billed them for the equipment and network link etc. Upon completion of the project we provided a certified copy of data destruction in accordance with their policies / guidelines and were left with a bunch of stuff. Scored two GPU cracking rigs, couple laptops, and some Cisco gear. I didn't complain. Granted now those rigs are a bit dated, but at the time 1080's were hard to get during the last mining rush so they definitely weren't cheap.
- RileyJames 5y ago
  But in that case I’d agree with the OP. I’m not installing what ever you want on my hardware. I probably was more of a “temporary employee” than a contractor. But what’s the difference at that point? I was paid more than the value of entitlements as cash. It suited both parties, and was mutually agreed. In hindsight, having them provide the hardware, and then handing it back at the end of the engagement would be my preference. It reduced any risks for them and me. Tho I can easily imagine on/off or short infrequent contracting scenarios that this would not work for.

nix23 5y ago

Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.

Stranger43 5y ago
Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.
- nix23 5y ago
  If you can pay 7500$/y for spyware you can surely pay for a VDI-Product.
  - Stranger43 5y ago
    The problem is rarely the monetary costs alone it's more about the need for handling an one-off situation that require special policies, and becomes an special item on the budget. For large companies supplying VDI to consultants tend to be an standardized package that gets billed back to whatever project is hiring the consultants but for mid-sized organisation VDI is a big scary word that's going to require special handling. Most desktop support teams are completely dependent on standardization to the point where they tend to turn into complete control freaks, that panic at the thought of anything that is not "by the book", so they often just apply the book without additional budgets to external consultants.
    - nix23 5y ago
      I am not interested in politics or humans when the problem is a technical one, i understand you but that's my stand ;)
selfhoster11 5y ago
I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.
- discardedrefuse 5y ago
  > Internet Explorer ActiveX plugin Virtualized desktops have been solved. All the major players offer them. FFS, you can run Xbox One games in the cloud and play in your browser now.
- nix23 5y ago
  That sound's like it is a looong time ago, todays VD's are extremely responsive just have a look at Shadow for example.
  - selfhoster11 5y ago
    ~6 years ago. I'd be surprised if such things weren't still deployed in places.
solnyshok 5y ago
why not spin up a VM dedicated to that client and confine all crapware to that VM?
- nix23 5y ago
  Absolutely!

learc83 5y ago

One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools. It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.

shabble 5y ago
You could reasonably invoice an upfront tooling cost ("isolated development workstation to meet customer IT policy requirements. Apple Macbook Foo, $BIGNUM") If you want to be really cheeky, could get some value-added margin on it too, and as a bonus, AIUI it would be yours to keep after the engagement, rather than having to return hardware they've assigned to you. Might be tough to get past finance though, unless they really want that certification :)
- ganoushoreilly 5y ago
  We've got a few machines we've inherited this way. For one client they needed confirmation that we had a sanitized infrastructure for our pentest and that we captured and logged all traffic to and fro. We billed them for the equipment and network link etc. Upon completion of the project we provided a certified copy of data destruction in accordance with their policies / guidelines and were left with a bunch of stuff. Scored two GPU cracking rigs, couple laptops, and some Cisco gear. I didn't complain. Granted now those rigs are a bit dated, but at the time 1080's were hard to get during the last mining rush so they definitely weren't cheap.
RileyJames 5y ago
But in that case I’d agree with the OP. I’m not installing what ever you want on my hardware. I probably was more of a “temporary employee” than a contractor. But what’s the difference at that point? I was paid more than the value of entitlements as cash. It suited both parties, and was mutually agreed. In hindsight, having them provide the hardware, and then handing it back at the end of the engagement would be my preference. It reduced any risks for them and me. Tho I can easily imagine on/off or short infrequent contracting scenarios that this would not work for.