6 ms·

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, y

by biztos 5y ago

I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically. On the other hand, you renting a laptop and charging them for it, would be pretty simple, presumably your contract covers expenses and all you'd need is an OK from the manager. I worked for a big company that had various spyware thingies installed on all the company laptops, but they let you use your personal mobile devices for work (including iPad which was pretty nice) -- and wanted you to install their preferred spyware on it. I didn't do that but I expected they would eventually tell me to do it or stop using my personal iPad. It seems like now that it's technically feasible, big corporate IT managers want their spyware of choice running everywhere. Someday you will have an arm full of Apple Watches, one for each client. You should embrace this future and price it in.

selfhoster11 5y ago
Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.
- twox2 5y ago
  Or they reimburse the consultant when they procure their own dedicated laptop for the client's work.
  - DnDGrognard 5y ago
    Plus the 25% management fee on top of the price :-)
  - spookthesunset 5y ago
    And hey, when the gig is over you got a new laptop that just needs to be formatted and it's all yours!
    - _fat_santa 5y ago
      At my agency we have a client that always ships us locked down laptops (healthcare space so understandable). Thing is this client, while very good at getting the laptops out to you, is horrible at actually getting them back and pretty much lets you keep them....I have 4 Macbook Pro's sitting on a shelf behind me, all from this client.
      - ganoushoreilly 5y ago
        Are they all still locked to an MDM profile, if so while they're yours, at any point you could lose access to them and that sucks. There's a ton of laptops that have been up on Ebay that ended up having mdm. We bought a few on accident for our non-profit. Fortunately we were able to find the original owners and they were gracious to remove them. We were also lucky they hadn't been disabled. Thing is most people don't realize that when you restore / setup that laptop it will pull that profile regardless of how you wipe or clear it. TLDR; Make sure MDM profiles are gone and the laptops are cleared before doing anything personal :D
        2Gkashmiri 5y ago
        woo... linux and windows don't have that, at least not windows yet. you never know.... they might make uefi behind a subscription making mdm thing over to windows/linux side
        zamadatix 5y ago
        Used to work in Healthcare, we'd use Computrace which operated at the motherboard firmware level. It can remotely brick a device and also automatically manage installing additional payloads in Windows once an internet connection was formed.
      - eqvinox 5y ago
        Doesn't this put you in a position of potential liability, if, say, someone breaks into your home/agency, steals those 4 laptops, and leaks personal healthcare data off them?
- mandelbrotwurst 5y ago
  It also creates friction for the client, making it less likely that you get paid.
  - swagasaurus-rex 5y ago
    Wouldn't the source of the friction be them asking to install spyware on your personal machine?
    - mandelbrotwurst 5y ago
      There are multiple points of friction in this scenario. Their asking you to install spyware is friction for you, your asking them to buy a laptop is friction for them.
      - _hcuq 5y ago
        Charge them for laptop rental. As another poster said. If you have other clients you are betraying their trust by installing the spyware.
  - deleted 5y ago
    [deleted]
Juliate 5y ago
> procuring the laptop might be a difficult thing for them to do bureaucratically Not if they are at the point where they need SOC2 cert, and where they install agents on their employees computers (and want to extend that to their suppliers).
- wombatpm 5y ago
  My company is going through our SOC2 audit. We do not have such software and everyone is remote. I call BS as to the justification. This smells like a desire for corporate monitoring.
  - Juliate 5y ago
    Definitely. My point is that if/when you get to need a SOC2 certification, you put the resources towards this, and you definitely have the financial/org means to procure hardware to suppliers if required.
  - a2tech 5y ago
    A lot of it comes down to the agency thats doing your audit. Its supposed to be a fair process, but just like PCI compliance, there's a huge amount of variability. Most auditing houses are going to be pushing 'solutions' to problems they find so they can milk the company out of more money. Its all snake oil.
  - learc83 5y ago
    SOC2 isn’t prescriptive. SOC2 is just a certification that you are following your own internal policies. If the company made the mistake of creating a policy that they use this software as one of their controls, then the auditor will ding them if they don’t use it. It’s an absurd system.
    - georgyo 5y ago
      Reminds me when I was doing PCI compliance. A PCI question asks if all outbound traffic is explicitly authorized. I took that to mean getting a list of all the IPs for the APIs of services we hit, and even constructed that entire list except for one, the payment processor itself. The payment processor did not have any stable IPs, and could not give me a list. Their official solution was to have our policy be that we explicitly allow _all_ outbound traffic. If such an option is allowed by PCI, what is even the point of making it a requirement?
bigbillheck 5y ago
> I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically That's not OP's problem.
- jcims 5y ago
  It is if OP loses work because of it.
citizenpaul 5y ago
Also as a freelancer you may end up with a farm of a dozen single purpose laptops....
- marcosdumay 5y ago
  All rented out? Seems like an easy win on the PaaS market (and make enough profit on them). Just remember to put some customized adhesives telling what laptop is rented to what customer.
  - citizenpaul 5y ago
    Sure but I think most corporate spyware prevents things like mining software, cause get real thats all it will be rented for.
tomxor 5y ago
> You should embrace this future and price it in. Should we though? what you and the parent outline is a most sensible way of accommodating it while minimising invasion of privacy, however I question the underlying reasoning, and therefore whether or not we should encourage it. What perceived gains are to be had beyond merely box checking for accreditations? and in those cases why is it part of those accreditations, what is the intended effect? I can think of a few but they are all flawed or attempting to enforce something impossible: 1. Preventing leaking code/IP (But if you can't trust them they could just as easily take a picture of the screen, capture the HDMI, copy the drive, even log their own keyboard... there are always side channels unless you physically control the environment). 2. Preventing them from doing something malicious... But if they are writing code for you and they are untrustworthy, isn't it already game over? 3. Bean counting, monitoring time spent at keyboard etc - which we all know is not an accurate metric of productivity for cognitive work. 4. Similarly to #1 and #2, unintentional breach or security issues, i.e you trust the person but not their device or their ability to secure their own device - In which case spyware seems wholly inadequate to cope with this situation, if you are serious about this, you should be controlling the hardware and OS (which lots of orgs with highly sensitive info do). In all these cases spyware is futile. Am I missing something?
- pheleven 5y ago
  Enforcing/auditing sane security settings on the device. Very much required for compliance, zero trust, protection of IP, and foundational to a reasonable security plan.
  - tomxor 5y ago
    I think I added #4 after your comment. Which is essentially my response. It seems like a very weak measure, at the cost of privacy considering it's the worker's personal device... If our solution is to require separate devices anyway, then spyware seems like a waste of time, they should be providing secured hardware/OS. On second thought, this _is_ the answer... they are making a compromise on security, it's an economic decision. Maybe it makes sense from a business perspective: check some boxes, get a bit of security (not much) for almost nothing - but as you can probably tell, I think it's both pretentious and disrespectful.
exikyut 5y ago
> Someday you will have an arm full of Apple Watches, one for each client. Noooo. Armfuls of watches are just for hilarious movies and such. It's not supposed to have a corporate elementttt. The cyberpunk vibes are too much with this.

by biztos 5y ago

selfhoster11 5y ago

Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.

twox2 5y ago
Or they reimburse the consultant when they procure their own dedicated laptop for the client's work.
- DnDGrognard 5y ago
  Plus the 25% management fee on top of the price :-)
- spookthesunset 5y ago
  And hey, when the gig is over you got a new laptop that just needs to be formatted and it's all yours!
  - _fat_santa 5y ago
    At my agency we have a client that always ships us locked down laptops (healthcare space so understandable). Thing is this client, while very good at getting the laptops out to you, is horrible at actually getting them back and pretty much lets you keep them....I have 4 Macbook Pro's sitting on a shelf behind me, all from this client.
    - ganoushoreilly 5y ago
      Are they all still locked to an MDM profile, if so while they're yours, at any point you could lose access to them and that sucks. There's a ton of laptops that have been up on Ebay that ended up having mdm. We bought a few on accident for our non-profit. Fortunately we were able to find the original owners and they were gracious to remove them. We were also lucky they hadn't been disabled. Thing is most people don't realize that when you restore / setup that laptop it will pull that profile regardless of how you wipe or clear it. TLDR; Make sure MDM profiles are gone and the laptops are cleared before doing anything personal :D
      - 2Gkashmiri 5y ago
        woo... linux and windows don't have that, at least not windows yet. you never know.... they might make uefi behind a subscription making mdm thing over to windows/linux side
        zamadatix 5y ago
        Used to work in Healthcare, we'd use Computrace which operated at the motherboard firmware level. It can remotely brick a device and also automatically manage installing additional payloads in Windows once an internet connection was formed.
    - eqvinox 5y ago
      Doesn't this put you in a position of potential liability, if, say, someone breaks into your home/agency, steals those 4 laptops, and leaks personal healthcare data off them?
mandelbrotwurst 5y ago
It also creates friction for the client, making it less likely that you get paid.
- swagasaurus-rex 5y ago
  Wouldn't the source of the friction be them asking to install spyware on your personal machine?
  - mandelbrotwurst 5y ago
    There are multiple points of friction in this scenario. Their asking you to install spyware is friction for you, your asking them to buy a laptop is friction for them.
    - _hcuq 5y ago
      Charge them for laptop rental. As another poster said. If you have other clients you are betraying their trust by installing the spyware.
- deleted 5y ago
  [deleted]

Juliate 5y ago

> procuring the laptop might be a difficult thing for them to do bureaucratically Not if they are at the point where they need SOC2 cert, and where they install agents on their employees computers (and want to extend that to their suppliers).

wombatpm 5y ago
My company is going through our SOC2 audit. We do not have such software and everyone is remote. I call BS as to the justification. This smells like a desire for corporate monitoring.
- Juliate 5y ago
  Definitely. My point is that if/when you get to need a SOC2 certification, you put the resources towards this, and you definitely have the financial/org means to procure hardware to suppliers if required.
- a2tech 5y ago
  A lot of it comes down to the agency thats doing your audit. Its supposed to be a fair process, but just like PCI compliance, there's a huge amount of variability. Most auditing houses are going to be pushing 'solutions' to problems they find so they can milk the company out of more money. Its all snake oil.
- learc83 5y ago
  SOC2 isn’t prescriptive. SOC2 is just a certification that you are following your own internal policies. If the company made the mistake of creating a policy that they use this software as one of their controls, then the auditor will ding them if they don’t use it. It’s an absurd system.
  - georgyo 5y ago
    Reminds me when I was doing PCI compliance. A PCI question asks if all outbound traffic is explicitly authorized. I took that to mean getting a list of all the IPs for the APIs of services we hit, and even constructed that entire list except for one, the payment processor itself. The payment processor did not have any stable IPs, and could not give me a list. Their official solution was to have our policy be that we explicitly allow _all_ outbound traffic. If such an option is allowed by PCI, what is even the point of making it a requirement?

bigbillheck 5y ago

> I think this is the correct advice, but keep in mind that procuring the laptop might be a difficult thing for them to do bureaucratically That's not OP's problem.

jcims 5y ago
It is if OP loses work because of it.

citizenpaul 5y ago

Also as a freelancer you may end up with a farm of a dozen single purpose laptops....

marcosdumay 5y ago
All rented out? Seems like an easy win on the PaaS market (and make enough profit on them). Just remember to put some customized adhesives telling what laptop is rented to what customer.
- citizenpaul 5y ago
  Sure but I think most corporate spyware prevents things like mining software, cause get real thats all it will be rented for.

tomxor 5y ago

> You should embrace this future and price it in. Should we though? what you and the parent outline is a most sensible way of accommodating it while minimising invasion of privacy, however I question the underlying reasoning, and therefore whether or not we should encourage it. What perceived gains are to be had beyond merely box checking for accreditations? and in those cases why is it part of those accreditations, what is the intended effect? I can think of a few but they are all flawed or attempting to enforce something impossible: 1. Preventing leaking code/IP (But if you can't trust them they could just as easily take a picture of the screen, capture the HDMI, copy the drive, even log their own keyboard... there are always side channels unless you physically control the environment). 2. Preventing them from doing something malicious... But if they are writing code for you and they are untrustworthy, isn't it already game over? 3. Bean counting, monitoring time spent at keyboard etc - which we all know is not an accurate metric of productivity for cognitive work. 4. Similarly to #1 and #2, unintentional breach or security issues, i.e you trust the person but not their device or their ability to secure their own device - In which case spyware seems wholly inadequate to cope with this situation, if you are serious about this, you should be controlling the hardware and OS (which lots of orgs with highly sensitive info do). In all these cases spyware is futile. Am I missing something?

pheleven 5y ago
Enforcing/auditing sane security settings on the device. Very much required for compliance, zero trust, protection of IP, and foundational to a reasonable security plan.
- tomxor 5y ago
  I think I added #4 after your comment. Which is essentially my response. It seems like a very weak measure, at the cost of privacy considering it's the worker's personal device... If our solution is to require separate devices anyway, then spyware seems like a waste of time, they should be providing secured hardware/OS. On second thought, this _is_ the answer... they are making a compromise on security, it's an economic decision. Maybe it makes sense from a business perspective: check some boxes, get a bit of security (not much) for almost nothing - but as you can probably tell, I think it's both pretentious and disrespectful.

exikyut 5y ago

> Someday you will have an arm full of Apple Watches, one for each client. Noooo. Armfuls of watches are just for hilarious movies and such. It's not supposed to have a corporate elementttt. The cyberpunk vibes are too much with this.