3 ms·

A monitoring agent is used on platforms such as UpWork, where you often deal with untrusted contractors for hourly contracts. That is a part of the contract tha

A monitoring agent is used on platforms such as UpWork, where you often deal with untrusted contractors for hourly contracts. That is a part of the contract that both sides need to agree on before starting any work. The screenshots can then be as part of the dispute resolution process, and can also protect the contractor in case of disputes from unscrupulous companies. The agent captures screenshots every few minutes, and the contractor can review and redact any screenshots before sending them. Adding a monitoring agent for an existing contractor is a major change in the contract terms, and not something that I would consider acceptable. It's not normal, and not something you should agree to.

unbanned 5y ago
This is ridiculous. Whomever came up with this practice has their head in the clouds. Whether the work was done to a satisfactory standard or not should be the only measure, the journey there shouldn't matter a toss.
stuaxo 5y ago
People that pay the least trust the least - which makes sense, people know they are being screwed and treat things accordingly.
yosito 5y ago
Another reason not to work with UpWork!
neonnomad 5y ago
Just to be clear the Drata agent never captures screenshots of the desktop or anything of the sort. It is a lightweight osquery agent that reads system information like patching, screen lock, firewall status, etc. We collect that information for security/compliance purposes so companies can ensure they are meeting their internal controls as well as formal compliance frameworks such as SOC2. We are happy to share our security validation report of the agent as well as the configuration with any prospects/customer. Source: I am the Drata CISO
- illud_tempus 5y ago
  > We are happy to share our security validation report of the agent as well as the configuration with any prospects/customer. I am the OP. I am not your customer. My customer is your customer. My customer wants me to install your agent. When I contacted Drata on email with some concerns before I accepted your terms and conditions (which I will never accept in its current form) and got any real information about your agent, your secretary responded: "Feel free to reach out to your Drata administrator internally with concerns. Do note, that when your company contracted with Drata, any edits or redlines they provided will prevail for all employees of your company." That is not very reassuring for a company (Drata) that want me to accept undisclosed terms and conditions, wants to sell my personal data to targeted marketing, reserves the right to change the user agreement over night, and who exploits a loophole in GDPR so you can move my personal data out of EU and do things with it that would be a crime in EU. I interperate that reply, from your secretary, as: "We already sold our thing to your company, so we don't care. Not about you. Not about your company. Bend over and take it like a good bitch!" As others have suggested here; if you want people to trust your agent, you should open source it, have it audited, and publish the audit reports.

unbanned 5y ago

This is ridiculous. Whomever came up with this practice has their head in the clouds. Whether the work was done to a satisfactory standard or not should be the only measure, the journey there shouldn't matter a toss.

stuaxo 5y ago

People that pay the least trust the least - which makes sense, people know they are being screwed and treat things accordingly.

yosito 5y ago

Another reason not to work with UpWork!

neonnomad 5y ago

Just to be clear the Drata agent never captures screenshots of the desktop or anything of the sort. It is a lightweight osquery agent that reads system information like patching, screen lock, firewall status, etc. We collect that information for security/compliance purposes so companies can ensure they are meeting their internal controls as well as formal compliance frameworks such as SOC2. We are happy to share our security validation report of the agent as well as the configuration with any prospects/customer. Source: I am the Drata CISO

illud_tempus 5y ago
> We are happy to share our security validation report of the agent as well as the configuration with any prospects/customer. I am the OP. I am not your customer. My customer is your customer. My customer wants me to install your agent. When I contacted Drata on email with some concerns before I accepted your terms and conditions (which I will never accept in its current form) and got any real information about your agent, your secretary responded: "Feel free to reach out to your Drata administrator internally with concerns. Do note, that when your company contracted with Drata, any edits or redlines they provided will prevail for all employees of your company." That is not very reassuring for a company (Drata) that want me to accept undisclosed terms and conditions, wants to sell my personal data to targeted marketing, reserves the right to change the user agreement over night, and who exploits a loophole in GDPR so you can move my personal data out of EU and do things with it that would be a crime in EU. I interperate that reply, from your secretary, as: "We already sold our thing to your company, so we don't care. Not about you. Not about your company. Bend over and take it like a good bitch!" As others have suggested here; if you want people to trust your agent, you should open source it, have it audited, and publish the audit reports.