4 ms·

Doesn’t matter. No personal stuff on company devices. I just don’t understand any rational otherwise.

by _boffin_ 3y ago

babypuncher 3y ago
So you just don't listen to music at work?
- _boffin_ 3y ago
  Do you have a phone and headphones?
  - babypuncher 3y ago
    OK, so now I can't hear notifications on my computer, or control my music playback with my keyboard.
  - 2devnull 3y ago
    If you use your phone at work, doesn’t that then become discoverable in the legal sense?
    - DANmode 3y ago
      Having a cable or radiowaves coming out of your bag or pocket is considered "use", in nonsecured areas?
      - dghlsakjg 3y ago
        That’s very much up to the judge to decide…
- brobinson 3y ago
  There's a huge difference between using your personal Spotify account at work and using your personal Github account at work.
  - babypuncher 3y ago
    I agree, but GP was pretty explicit about "no personal stuff on company devices", and I'm poking a hole in their black-and-white logic.
    - brobinson 3y ago
      Fair enough.
cqqxo4zV46cp 3y ago
I have personal stuff on my work machine. I don’t need to say any more than that because in your eyes it’s inherently unjustifiable. So, would you care to more explicitly tell me what you think about my intelligence or ability to behave rationally compared to you? Or is there potentially some room for nuance here?
- _boffin_ 3y ago
  or if you take it another way... i currently don't understand any rational that has been presented that allows me that frame of thought, but i'm always wanting to learn more.
  - aenis 3y ago
    I'd propose the following line of reasoning: - people tend to use company devices for private stuff, even when its explicitly prohibited, - draconian policing leads to employee dissatisfaction; you won't be able to fire that great engineer you spent 3 months hiring because he logged in to Spotify running within Chrome, and if you can - and do - soon you will be unable to hire top talent, Thus, even with those policies in place, end user devices still need to be considered un-trusted. Specifically, that they can be key-logged and remote accessed by the attackers. Hence, (a) anything sensitive should involve transaction level validation, not just end user authentication, (b) for logging in an out, as well as for confirming sensitive operations, proper MFA needs to be in place (physical key + token on a mobile device, for instance), (c) apply lightweight, reasonable restrictions to reduce the chances of device compromise dramatically (e.g., no downloading of 3rd party apps or binaries - but do whitelist things like Skype or Spotify, force strong password for devices, etc). This means reasonable personal use is perfectly fine, employees happy, and you are safer vs. assuming local devices are clean.
Symbiote 3y ago
How about a PhD student working on open-source software? A more senior academic?
- _boffin_ 3y ago
  > How about a PhD student working on open-source software? - Is the open-source software something that the company is sponsoring? - If not, do you have permission to use company equipment for personal use? > A more senior academic? ? Do you do the above? If so, do you have a personal laptop? if yes, why utilize company property instead of personal, unless given permission to do so?
  - Symbiote 3y ago
    I'm not an academic, but I have worked with a lot of academics and I think most of them would have no concerns about accessing personal data on their work computer. I thought a university would be an example of a very 'friendly' employer. An example university policy [1] > 11.5 reasonable personal use of College IT resources is permitted provided such use does not disrupt the conduct of College business or other users. Recreational use of the Halls of Residence network is also permitted, subject to these conditions; We have a similar policy where I work. I have a personal laptop, but I don't take it to work. I am signed in to my personal GMail account on my work computer, along with many other accounts — like this HN account. If work needed to look at an employee's computer, we'd have someone from IT + someone from HR overseeing the process, and wouldn't look at anything clearly private, e.g. a personal email account. Doing otherwise would be a breach of the GDPR. [1] https://www.imperial.ac.uk/admin-services/ict/self-service/computers-printing/conditions-of-use-of-it-resources/ https://www.imperial.ac.uk/admin-services/ict/self-service/c...

Doesn’t matter. No personal stuff on company devices. I just don’t understand any rational otherwise.

babypuncher 3y ago

So you just don't listen to music at work?

_boffin_ 3y ago
Do you have a phone and headphones?
- babypuncher 3y ago
  OK, so now I can't hear notifications on my computer, or control my music playback with my keyboard.
- 2devnull 3y ago
  If you use your phone at work, doesn’t that then become discoverable in the legal sense?
  - DANmode 3y ago
    Having a cable or radiowaves coming out of your bag or pocket is considered "use", in nonsecured areas?
    - dghlsakjg 3y ago
      That’s very much up to the judge to decide…
brobinson 3y ago
There's a huge difference between using your personal Spotify account at work and using your personal Github account at work.
- babypuncher 3y ago
  I agree, but GP was pretty explicit about "no personal stuff on company devices", and I'm poking a hole in their black-and-white logic.
  - brobinson 3y ago
    Fair enough.

cqqxo4zV46cp 3y ago

I have personal stuff on my work machine. I don’t need to say any more than that because in your eyes it’s inherently unjustifiable. So, would you care to more explicitly tell me what you think about my intelligence or ability to behave rationally compared to you? Or is there potentially some room for nuance here?

_boffin_ 3y ago
or if you take it another way... i currently don't understand any rational that has been presented that allows me that frame of thought, but i'm always wanting to learn more.
- aenis 3y ago
  I'd propose the following line of reasoning: - people tend to use company devices for private stuff, even when its explicitly prohibited, - draconian policing leads to employee dissatisfaction; you won't be able to fire that great engineer you spent 3 months hiring because he logged in to Spotify running within Chrome, and if you can - and do - soon you will be unable to hire top talent, Thus, even with those policies in place, end user devices still need to be considered un-trusted. Specifically, that they can be key-logged and remote accessed by the attackers. Hence, (a) anything sensitive should involve transaction level validation, not just end user authentication, (b) for logging in an out, as well as for confirming sensitive operations, proper MFA needs to be in place (physical key + token on a mobile device, for instance), (c) apply lightweight, reasonable restrictions to reduce the chances of device compromise dramatically (e.g., no downloading of 3rd party apps or binaries - but do whitelist things like Skype or Spotify, force strong password for devices, etc). This means reasonable personal use is perfectly fine, employees happy, and you are safer vs. assuming local devices are clean.

Symbiote 3y ago

How about a PhD student working on open-source software? A more senior academic?

_boffin_ 3y ago
> How about a PhD student working on open-source software? - Is the open-source software something that the company is sponsoring? - If not, do you have permission to use company equipment for personal use? > A more senior academic? ? Do you do the above? If so, do you have a personal laptop? if yes, why utilize company property instead of personal, unless given permission to do so?
- Symbiote 3y ago
  I'm not an academic, but I have worked with a lot of academics and I think most of them would have no concerns about accessing personal data on their work computer. I thought a university would be an example of a very 'friendly' employer. An example university policy [1] > 11.5 reasonable personal use of College IT resources is permitted provided such use does not disrupt the conduct of College business or other users. Recreational use of the Halls of Residence network is also permitted, subject to these conditions; We have a similar policy where I work. I have a personal laptop, but I don't take it to work. I am signed in to my personal GMail account on my work computer, along with many other accounts — like this HN account. If work needed to look at an employee's computer, we'd have someone from IT + someone from HR overseeing the process, and wouldn't look at anything clearly private, e.g. a personal email account. Doing otherwise would be a breach of the GDPR. [1] https://www.imperial.ac.uk/admin-services/ict/self-service/computers-printing/conditions-of-use-of-it-resources/ https://www.imperial.ac.uk/admin-services/ict/self-service/c...