5 ms·

Our system is pretty straightforward. We are 100% WFH. Whatever you do on the virtual/cloud work desktop is considered entirely property of our company. Your in

Our system is pretty straightforward. We are 100% WFH. Whatever you do on the virtual/cloud work desktop is considered entirely property of our company. Your incidental Spotify, Youtube and 4chan visits are included in this scope. We actively encourage our employees to minimize their cloud desktop and use their thin client/MacBook/2nd computer/whatever for non-work things. To go even further - the physical hardware we provide to our employees is no longer enrolled into IT policies. If someone uses the actual work machine to play counterstrike, we literally don't care about this anymore. It wouldn't show up on any report. We seriously don't give a shit if someone is listening to music, having Netflix playing, etc. The only thing that matters is the work product at the end of the day. Some people are incredibly productive while listening to death metal at reference volume. Others are not. Who are we to judge? Even though we have access to deep digital forensics on our employee's virtual desktops, we would only ever use them if there were some criminal or civil proceedings brought forth. If you feel like you have to use the digital panopticon to micromanage your tech/knowledge employees, you are potentially a really shitty manager.

jonnycomputer 3y ago
Ok, for these employees, do you also consume audio and video? My biggest concern is that WFH bringing company hardware home is inviting employers the opportunity to monitor employee home-life, recording private conversations, for example. It might be one thing to have that sort of monitoring go on at the work place, but WFH own their office, and pay for it too. Incidentally, I feel the same way about kids bringing laptops home from school.
- reaperman 3y ago
  > Ok, for these employees, do you also consume audio and video? Clearly GP's firm doesn't run a webcam and microphone capture on the thin client. They could potentially monitor audio/video I/O from the cloud workstation that the thin client logs into.
- pc86 3y ago
  If you're concerned about this isn't the simple answer just to shut down at the end of the day? While I'm sure there are exceptions, thinking about the IT departments I've worked with in the past and how cost-conscious they were, the last thing any of them would want to do is waste the time and money to record non-work related employee conversations at their home.
  - vladvasiliu 3y ago
    Well, what's to say that the PC is actually off? Many "enterprise" laptops nowadays can't have their battery pulled out easily. My HP laptop needs to have the back panel removed. If I do that, it'll trip the intrusion sensor and wipe the TPM. IT can know about this and ask you why you're taking apart the laptop. If it's windows, and you don't have the BitLocker key, you won't even be able to turn it back on.
    - andsoitis 3y ago
      Put it in a drawer. This isn’t rocket science.
    - mwigdahl 3y ago
      Then close it and wrap it in a couple layers of towels or something, stick it in your refrigerator under the leftover pizza, and/or block its access to wifi through your home router config. Physical controls trump whatever secret monitoring you fear it's doing.
    - delaynomore 3y ago
      Spoken like a true over-engineer. >Put it in a drawer. This isn’t rocket science. Yup
  - jonnycomputer 3y ago
    Who says family life only starts "at the end of the day"? And who says that it would be the IT department that would want this capability, instead of, say the employee's manager?
- Hamuko 3y ago
  I've taped the webcam on my work laptop. If my employer wants me to use a webcam as part of my job, I'll ask them to buy me one with a physical shutter. Thankfully no one gives half a shit about webcams at our workplace.
  - sarchertech 3y ago
    I bought a little physical shutter that sticks onto mine.
    - Hamuko 3y ago
      I think I've seen people report their MacBook displays getting shattered because of those shutters so I've opted for tape instead.
  - dylan604 3y ago
    Where do you place the tape to cover the mic? No? Why are you only partially paranoid?
    - Hamuko 3y ago
      A couple of reasons. First of all, I kinda need the microphone for work whereas I don't need a webcam. I also live alone, so it's not like I am having that many private conversations at home. However, I do for example spend time naked at home, and I'd prefer that to not be visible to any cameras. There is thankfully a physical cutoff switch for the microphone whenever the laptop lid is closed in case I need to have a private conversation and ensure that there's no employee-provided microphones nearby.
- bob1029 3y ago
  The interface for the virtual desktop in many circumstances is by way of a simple browser tab. Due to browser security standards, every time you access your work desktop via web, a warning pops up asking if you want to provide camera/audio/location services. You can decline to consent and there won't be any problems, other than Teams won't be able to use your webcam/audio for a meeting.
- j45 3y ago
  The simplest way to treat any employer device at home (and work) is that they should be assumed to be hostile. It could be default settings, best practices of Microsoft for adoption, etc. How to treat a hostile device in your home network is the same as home automation - isolate it. - Separate vlaned network that can’t see anything on your home network. Separate SSID. Don’t like the microphone? Find an adapter that mutes it. - Create a separate vlan and SSID that can’t see anything on your network. The ideal way to do this is configure a travel router behind your regular router. Then extra nat hop is worth it. - Bonus points for a vpn at home that your travel router can connect to, making your work setup a little more mobile.
- andsoitis 3y ago
  > inviting employers the opportunity to monitor employee home-life, recording private conversations, for example. Employers have bigger things to worry about than some minor employee’s bickering with their family. I think you can safely worry about bigger things.
  - jonnycomputer 3y ago
    No, no, it doesn't happen ever at all. https://www.businessinsider.com/work-from-home-sneek-webcam-picture-5-minutes-monitor-video-2020-3 https://www.businessinsider.com/work-from-home-sneek-webcam-... https://remotedesk.com/solutions/webcam-monitoring https://remotedesk.com/solutions/webcam-monitoring https://www.cbsnews.com/news/remote-workers-monitoring-spyware-employers-tracking-video-pandemic/ https://www.cbsnews.com/news/remote-workers-monitoring-spywa...
    - andsoitis 3y ago
      I think it is dumb for employers to do this. However, these examples don’t seem to have anything to do with spying on your private life, i.e. outside typical work hours.
time0ut 3y ago
We are still in the dark ages of no root, all kinds of agents and spyware, multiple layers of TLS intercepting proxies, etc. I still surf HN and listen to questionable and obscure genres of metal while I code. If they ever complain I'll explain that is what I need to get my work done.
- snarfy 3y ago
  I assume programming related websites are ok which I include HN in that category.
pc86 3y ago
Person who is productive while listening to death metal checking in. I have two jobs currently - one is regular 40h/wk salaried day job, another is part-time, nights and weekends, hourly pay. I only need to work 15-18 hours a week at the part-time one to exceed my full-time pay, but the part-time one is: - Windows - internet routed through a hardware appliance that I'm sure logs every bit and packet - forced to run an invasive full-system virus/malware scan on start-up and at 5AM every morning (takes 4-4.5 hours) forcing me to leave the thing runnings for days or weeks at a time and preventing any early morning work - random things that were fine for years suddenly blocked, e.g. spotify/youtube - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary" - Once had trouble working during an active malware scan so did non-sensitive but time critical work on a personal machine and got an email the next day why I was clocked in when the computer was off Compare to my full-time job - Not windows - VPN is off by default and IT makes a conscious effort to move things *off* of VPN instead of the opposite - No tracking of any sort - We literally play Steam games for work events sometimes so it has Steam installed Now clearly there are some big culture differences between the two as well, but needless to say it's rare the side gig beats my full-time paycheck, precisely because it's such a horrible work environment.
- vladvasiliu 3y ago
  I hate this full-system (anti-)malware crap as much as the next guy. But this: > - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary" The issue is that policies have to be fairly general and can't just count on all employees actually knowing what they're doing. And sometimes people actually do shady things, even if it's not intentional. And if IT is understanding, then I think it's OK. The other day, there was a story on the HN front page [0] about some innocuous looking app that got bought and converted to some kind of shady proxy. If I was responsible for my company's staff machines, I sure as hell wouldn't want that kind of crap running on them. What's to say that your random app won't be siphoning up ~\Documents\top_secret.doc? [0] https://news.ycombinator.com/item?id=37052508 https://news.ycombinator.com/item?id=37052508
tomrod 3y ago
As someone who is growing a business and who looks to make the jump from "here is a laptop, GSD*" to "here is a laptop with security, GSD", how does one go about setting up this sort of system of cloud desktop? * GSD: get shit done (because I literally can't be arsed if you watch Netflix, play TOTK, or whatever so long as clients are happy and you are satisfied with your work)
- bob1029 3y ago
  > how does one go about setting up this sort of system of cloud desktop? Check out Windows 365 Enterprise. We have it configured for multiple regions in order to minimize latency. One AD security group per US state. Then, we set up an intune provisioning profile per region to map them through. You can push custom images or take the default 10/11 builds. It seems to be working out really well for us. I run a heavy VS2022 workload all day and have no issues (4vCPU, 16gb, 128gb). Build times are definitely slower than my 32 core battleship, but that's to be expected. I just checked my RTT stats in MS endpoint management and I am seeing ~18ms between my desktop and the actual desktop. The worst case we have right now is S Florida to N Virginia (US East) @ ~60ms, but they are adding a new region soon so hopefully we will have every employee well under 50ms over time.
zaggynl 3y ago
Do you enforce any security for the PC used to connect to the virtual desktop? Thinking of possible keylogging, possible mitm when connecting to the virtual desktop, a RAT on the PC used.
- bob1029 3y ago
  No. We aren't this paranoid. Keylogging could be as far up the stack as the employee's brain.
RobotToaster 3y ago
>Whatever you do on the virtual/cloud work desktop is considered entirely property of our company. Your incidental Spotify, Youtube and 4chan visits are included in this scope. "Not only are you fired, the 400gb of futa hentai you downloaded is our property"
harry8 3y ago
>Even though we have access to deep digital forensics on our employee's virtual desktops Yeah you say that and I believe you just like I believed Sergey, Larry and don't be evil. Don't collect it at all. Collecting anything private is like having to handle toxic waste. Just don't. You can't control it, you can't guarantee security and you don't know what could happen if you're bought out etc etc. You just can't possibly trust all possible future managers about which you know nothing. Just say no.
deleted 3y ago
[deleted]
jsiepkes 3y ago
So how do you manage the risk of a user connecting to a remote desktop with an un-updated machine full of malware? In the end if the client machine is breached the remote virtual one will also fall?
gochi 3y ago
Not enrolling work devices into IT policies actually goes against your encouragement to separate your work/cloud client and a 2nd computer/non-work things. Having rigid boundaries encourages this separation, and I don't mean overly strict IT policies. I think you can easily allow people to listen to their music apps and watch netflix, without opening the floodgates for games that require kernel level anticheat. IT policies should be as simple as possible, even an app whitelist coupled with preconfigured browser is plenty. You wouldn't even need to monitor them at all this way.
cryptonector 3y ago
> If you feel like you have to use the digital panopticon to micromanage your tech/knowledge employees, you are potentially a really shitty manager. The higher up the management chain you go, the lower your visibility into developer productivity. It is natural that executives and owners should want that visibility, it's just that it's too fuzzy -- it can't be had with the kind of resolution that they want. Hence we have all these faddish metrics that get gamed and never end up being useful. We should have empathy for management's need to know even if we don't think they can really get a clear picture. What to do? Two things: - Manage better. Companies need managers who can get a good sense for their direct reports' abilities, skills, and productivity. And those managers need to have good BS detectors too. And managers need these skills up and down the management chain. - Look for outcomes. Teams and employees that never deliver enough value should be looked at with some care -- maybe they are, but the value they deliver is not very visible, or maybe they're expert bullshitters. Regarding outcomes, long delivery delays need to be investigated because one of the many problems we have as an industry is in estimating time and effort needed to deliver. This happens for reasons, but mainly that software development is harder than we tend to think. (Also, investigate your software development lifecycles. Maybe your change management schemes are wasteful and delay-inducing.) I say software development is hard, but I think management is probably much harder. The business school metrics fads that lead managers astray don't help.

jonnycomputer 3y ago

Ok, for these employees, do you also consume audio and video? My biggest concern is that WFH bringing company hardware home is inviting employers the opportunity to monitor employee home-life, recording private conversations, for example. It might be one thing to have that sort of monitoring go on at the work place, but WFH own their office, and pay for it too. Incidentally, I feel the same way about kids bringing laptops home from school.

reaperman 3y ago
> Ok, for these employees, do you also consume audio and video? Clearly GP's firm doesn't run a webcam and microphone capture on the thin client. They could potentially monitor audio/video I/O from the cloud workstation that the thin client logs into.
pc86 3y ago
If you're concerned about this isn't the simple answer just to shut down at the end of the day? While I'm sure there are exceptions, thinking about the IT departments I've worked with in the past and how cost-conscious they were, the last thing any of them would want to do is waste the time and money to record non-work related employee conversations at their home.
- vladvasiliu 3y ago
  Well, what's to say that the PC is actually off? Many "enterprise" laptops nowadays can't have their battery pulled out easily. My HP laptop needs to have the back panel removed. If I do that, it'll trip the intrusion sensor and wipe the TPM. IT can know about this and ask you why you're taking apart the laptop. If it's windows, and you don't have the BitLocker key, you won't even be able to turn it back on.
  - andsoitis 3y ago
    Put it in a drawer. This isn’t rocket science.
  - mwigdahl 3y ago
    Then close it and wrap it in a couple layers of towels or something, stick it in your refrigerator under the leftover pizza, and/or block its access to wifi through your home router config. Physical controls trump whatever secret monitoring you fear it's doing.
  - delaynomore 3y ago
    Spoken like a true over-engineer. >Put it in a drawer. This isn’t rocket science. Yup
- jonnycomputer 3y ago
  Who says family life only starts "at the end of the day"? And who says that it would be the IT department that would want this capability, instead of, say the employee's manager?
Hamuko 3y ago
I've taped the webcam on my work laptop. If my employer wants me to use a webcam as part of my job, I'll ask them to buy me one with a physical shutter. Thankfully no one gives half a shit about webcams at our workplace.
- sarchertech 3y ago
  I bought a little physical shutter that sticks onto mine.
  - Hamuko 3y ago
    I think I've seen people report their MacBook displays getting shattered because of those shutters so I've opted for tape instead.
- dylan604 3y ago
  Where do you place the tape to cover the mic? No? Why are you only partially paranoid?
  - Hamuko 3y ago
    A couple of reasons. First of all, I kinda need the microphone for work whereas I don't need a webcam. I also live alone, so it's not like I am having that many private conversations at home. However, I do for example spend time naked at home, and I'd prefer that to not be visible to any cameras. There is thankfully a physical cutoff switch for the microphone whenever the laptop lid is closed in case I need to have a private conversation and ensure that there's no employee-provided microphones nearby.
bob1029 3y ago
The interface for the virtual desktop in many circumstances is by way of a simple browser tab. Due to browser security standards, every time you access your work desktop via web, a warning pops up asking if you want to provide camera/audio/location services. You can decline to consent and there won't be any problems, other than Teams won't be able to use your webcam/audio for a meeting.
j45 3y ago
The simplest way to treat any employer device at home (and work) is that they should be assumed to be hostile. It could be default settings, best practices of Microsoft for adoption, etc. How to treat a hostile device in your home network is the same as home automation - isolate it. - Separate vlaned network that can’t see anything on your home network. Separate SSID. Don’t like the microphone? Find an adapter that mutes it. - Create a separate vlan and SSID that can’t see anything on your network. The ideal way to do this is configure a travel router behind your regular router. Then extra nat hop is worth it. - Bonus points for a vpn at home that your travel router can connect to, making your work setup a little more mobile.
andsoitis 3y ago
> inviting employers the opportunity to monitor employee home-life, recording private conversations, for example. Employers have bigger things to worry about than some minor employee’s bickering with their family. I think you can safely worry about bigger things.
- jonnycomputer 3y ago
  No, no, it doesn't happen ever at all. https://www.businessinsider.com/work-from-home-sneek-webcam-picture-5-minutes-monitor-video-2020-3 https://www.businessinsider.com/work-from-home-sneek-webcam-... https://remotedesk.com/solutions/webcam-monitoring https://remotedesk.com/solutions/webcam-monitoring https://www.cbsnews.com/news/remote-workers-monitoring-spyware-employers-tracking-video-pandemic/ https://www.cbsnews.com/news/remote-workers-monitoring-spywa...
  - andsoitis 3y ago
    I think it is dumb for employers to do this. However, these examples don’t seem to have anything to do with spying on your private life, i.e. outside typical work hours.

time0ut 3y ago

We are still in the dark ages of no root, all kinds of agents and spyware, multiple layers of TLS intercepting proxies, etc. I still surf HN and listen to questionable and obscure genres of metal while I code. If they ever complain I'll explain that is what I need to get my work done.

snarfy 3y ago
I assume programming related websites are ok which I include HN in that category.

pc86 3y ago

Person who is productive while listening to death metal checking in. I have two jobs currently - one is regular 40h/wk salaried day job, another is part-time, nights and weekends, hourly pay. I only need to work 15-18 hours a week at the part-time one to exceed my full-time pay, but the part-time one is: - Windows - internet routed through a hardware appliance that I'm sure logs every bit and packet - forced to run an invasive full-system virus/malware scan on start-up and at 5AM every morning (takes 4-4.5 hours) forcing me to leave the thing runnings for days or weeks at a time and preventing any early morning work - random things that were fine for years suddenly blocked, e.g. spotify/youtube - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary" - Once had trouble working during an active malware scan so did non-sensitive but time critical work on a personal machine and got an email the next day why I was clocked in when the computer was off Compare to my full-time job - Not windows - VPN is off by default and IT makes a conscious effort to move things *off* of VPN instead of the opposite - No tracking of any sort - We literally play Steam games for work events sometimes so it has Steam installed Now clearly there are some big culture differences between the two as well, but needless to say it's rare the side gig beats my full-time paycheck, precisely because it's such a horrible work environment.

vladvasiliu 3y ago
I hate this full-system (anti-)malware crap as much as the next guy. But this: > - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary" The issue is that policies have to be fairly general and can't just count on all employees actually knowing what they're doing. And sometimes people actually do shady things, even if it's not intentional. And if IT is understanding, then I think it's OK. The other day, there was a story on the HN front page [0] about some innocuous looking app that got bought and converted to some kind of shady proxy. If I was responsible for my company's staff machines, I sure as hell wouldn't want that kind of crap running on them. What's to say that your random app won't be siphoning up ~\Documents\top_secret.doc? [0] https://news.ycombinator.com/item?id=37052508 https://news.ycombinator.com/item?id=37052508

tomrod 3y ago

As someone who is growing a business and who looks to make the jump from "here is a laptop, GSD*" to "here is a laptop with security, GSD", how does one go about setting up this sort of system of cloud desktop? * GSD: get shit done (because I literally can't be arsed if you watch Netflix, play TOTK, or whatever so long as clients are happy and you are satisfied with your work)

bob1029 3y ago
> how does one go about setting up this sort of system of cloud desktop? Check out Windows 365 Enterprise. We have it configured for multiple regions in order to minimize latency. One AD security group per US state. Then, we set up an intune provisioning profile per region to map them through. You can push custom images or take the default 10/11 builds. It seems to be working out really well for us. I run a heavy VS2022 workload all day and have no issues (4vCPU, 16gb, 128gb). Build times are definitely slower than my 32 core battleship, but that's to be expected. I just checked my RTT stats in MS endpoint management and I am seeing ~18ms between my desktop and the actual desktop. The worst case we have right now is S Florida to N Virginia (US East) @ ~60ms, but they are adding a new region soon so hopefully we will have every employee well under 50ms over time.

zaggynl 3y ago

Do you enforce any security for the PC used to connect to the virtual desktop? Thinking of possible keylogging, possible mitm when connecting to the virtual desktop, a RAT on the PC used.

bob1029 3y ago
No. We aren't this paranoid. Keylogging could be as far up the stack as the employee's brain.

RobotToaster 3y ago

>Whatever you do on the virtual/cloud work desktop is considered entirely property of our company. Your incidental Spotify, Youtube and 4chan visits are included in this scope. "Not only are you fired, the 400gb of futa hentai you downloaded is our property"

harry8 3y ago

>Even though we have access to deep digital forensics on our employee's virtual desktops Yeah you say that and I believe you just like I believed Sergey, Larry and don't be evil. Don't collect it at all. Collecting anything private is like having to handle toxic waste. Just don't. You can't control it, you can't guarantee security and you don't know what could happen if you're bought out etc etc. You just can't possibly trust all possible future managers about which you know nothing. Just say no.

deleted 3y ago

[deleted]

jsiepkes 3y ago

So how do you manage the risk of a user connecting to a remote desktop with an un-updated machine full of malware? In the end if the client machine is breached the remote virtual one will also fall?

gochi 3y ago

Not enrolling work devices into IT policies actually goes against your encouragement to separate your work/cloud client and a 2nd computer/non-work things. Having rigid boundaries encourages this separation, and I don't mean overly strict IT policies. I think you can easily allow people to listen to their music apps and watch netflix, without opening the floodgates for games that require kernel level anticheat. IT policies should be as simple as possible, even an app whitelist coupled with preconfigured browser is plenty. You wouldn't even need to monitor them at all this way.

cryptonector 3y ago

> If you feel like you have to use the digital panopticon to micromanage your tech/knowledge employees, you are potentially a really shitty manager. The higher up the management chain you go, the lower your visibility into developer productivity. It is natural that executives and owners should want that visibility, it's just that it's too fuzzy -- it can't be had with the kind of resolution that they want. Hence we have all these faddish metrics that get gamed and never end up being useful. We should have empathy for management's need to know even if we don't think they can really get a clear picture. What to do? Two things: - Manage better. Companies need managers who can get a good sense for their direct reports' abilities, skills, and productivity. And those managers need to have good BS detectors too. And managers need these skills up and down the management chain. - Look for outcomes. Teams and employees that never deliver enough value should be looked at with some care -- maybe they are, but the value they deliver is not very visible, or maybe they're expert bullshitters. Regarding outcomes, long delivery delays need to be investigated because one of the many problems we have as an industry is in estimating time and effort needed to deliver. This happens for reasons, but mainly that software development is harder than we tend to think. (Also, investigate your software development lifecycles. Maybe your change management schemes are wasteful and delay-inducing.) I say software development is hard, but I think management is probably much harder. The business school metrics fads that lead managers astray don't help.