It's a widespread practice that companies provide laptops to contractors to compartmentalize the way they interact with the company's IT. But I'm really quite opposed to it.

At one point I had 3 sets of machines: Two different 14" laptops from two different clients and my own machines. At some point you simply run out of space on your desk and end up constantly either working on screens that are too small (14" really isn't enough to be productive), or plugging laptops in to and out of screens as you're context-switching. Carrying three laptops with you when you're travelling if you anticipate having to work for both clients during that timeframe is also not exactly my definition of great fun. And you end up duplicating a lot of effort around managing that IT, like tweaking settings the way you like them etc.

The argument "we own this laptop, so we can do with it whatever we want, including spying on you" is just not valid. They're either doing things that I'm okay with, in which case I'm okay doing it on my own hardware. Or they're doing things I'm opposed to, in which case I'm opposed to it no matter who owns the hardware.

Also: In many European countries, authorities are clamping down hard on practices whereby companies pass people off as contractors who really are employees. They usually work off of lists of criteria of what makes an employee, and if you fit too many of those criteria while, on paper, passing yourself off as a contractor, then you and your client can be in for a world of pain. One of the criteria that makes you look more like a contractor and less like an employee to the government is providing your own facilities like the computer you work with.

And, last but not least, it's just not a good way of dealing with the planet's resources.

I think there are absolutely a list of things that I don't want the company doing on my hardware, but I'm okay with on their hardware.

Off the top of my head, remote wipes/resets make sense. Frankly, I prefer the company has that option, just in case I lose my work laptop. Encryption should cover it, but I'll take the backup.

Compliance agents also have a legitimate reason to exist, but I don't want them on my personal PC. Some places maintain lists of allowed software (I think in part so they can track/inventory them for compliance stuff). I respect that they have the right to restrict what I install on my work laptop, but I reserve the right to install whatever I please on my own computer.

It would also not be insane for a company to do automated backups of company laptops to company servers. You want a way for Joe in marketing to get his data back when his cat pees on his laptop. I do not want all my personal documents on company servers.

This is really the thing people miss. It's a company laptop first and foremost and the right to privacy goes away.

The amount of compromising content we've seen and or found on investigations is mind blowing. No one needs that on a work computer. Keep your private life private from your employer.

The OP was about a contractor though. The way I think about somebody who is truly a contractor is that they are their own IT department, and their capabilities in the IT space should be at least on par with whatever the client's IT department enforces for in-house employees.

The above two comments however seem to be arguing from the viewpoint "this is just an individual person and any individual person surely needs babysitting by a big mighty corporate IT department because otherwise they can be expected to do stupid things like losing storage media with important data and not having backups, never doing updates, having their computers full of spyware, intermingling private stuff and work stuff from different clients in such a way that there's data leakage, etc. etc."

If you want to truly treat a contractor as a contractor, you should think about it as your IT needing to interface with their IT in such a way that it makes sense for both parties. And "here, use this laptop" is just frequently a bad solution from the point of view of the contractor's IT.

I also heavily object to the notion that any expectation of privacy goes away on a company laptop.

You can disagree with the expectation of privacy but it’s been held up in court multiple times that personal actions ok a corporate resource are not protected.

Ideologies and realties are different. If you care about personal data, don’t put it on the company. The company however has a huge liability with your personal data. I’ve mentioned else where I have dealt with issues of personal data becoming an issue for the company via blackmail, or in a couple cases, the company was legally required to report child pornography. So yeah, if you don’t want the company to know, don’t put it on their equipment. If you buy dedicated equipment for work, use it for work and work only. If you want to use your machine for Everything, that’s fine, but understand the risks and the lack of an expectation to privacy.

We're agreed that separation of work and private spheres is good practice.

But I'm not sure what country and what legal concept it is that you are referring to when you say "it's been held up in court multiple times that..." I'm based in Germany and have recently undergone GDPR-related training with a lawyer specializing in privacy law. In the training, the lawyer explained court cases that involved regrettable intermingling of work and private data in a company's IT. The result was that the law then started looking at that company's IT as being more akin to a telecommunication provider, with similar legal provisions coming into effect regarding telecommunication privacy.

Also: Anyone who lets their mind jump straight from "privacy" to "porn" is missing a big part of the picture of what privacy is all about. The way I think about it, it's a basic psychological need. Your psyche can be in a "public mode" where it assumes that any and all information flows emanating from you are out there for everyone to see and do with as they please. The result is that you have to put up huge amounts of self control which is psychologically exhausting. Therefore, the psyche seeks private spaces, where you don't need to control yourself as much because you know that nobody is watching.

The fight for privacy in the digital sphere is about ensuring that, just because our psyches are nowadays constantly linked to digital devices, this doesn't result in our psyches having to operate in "public mode" all the time.

It's about establishing clear delineations of who gets to receive what information flows relating to you and how they can potentially use that information against you.

For example: A company does time tracking through Excel sheets, but they also have IT security logs that keep track of people logging into and out of work machines. One day the company decides to run a project: They put the two data sources side by side and identify employees likely to be cheating on their time sheets. They fire the employees. ...this sets in motion a psychological effect in the remaining employees: They realize that they have a very poor understanding of what information the company's IT is collecting, and they don'T know how that information might one day be used against them. So all they can do is assume the worst. That means putting their psyches in "public mode" all the time, assuming the machine knows and sees everything, and the employer will use that information against employees at whatever time and in whatever manner suits them. The psychological damage done by this is precisely what we need to avoid!

And the GDPR will usually actually prohibit such things: The company's register of data processing activities will tie the security logs to the purpose of providing IT security. And it will tie the Excel timesheets to the purpose of time tracking. If you start using the security logs for time tracking purposes, you are using the data cross-purpose and are in violation of the GDPR and risk a hefty fine. This is a model usecase of what the GDPR is actually good for, and it clearly relates to protecting individuals' reasonable expectations of privacy in relation to their company's IT.

Very informative. Thanks.

I still have two lying around. One of them was a 15” dell brick.

I had informed the client that I will be disposing of them when I’m back if they don’t handle it and that any and all third party liability well fall on the direct supervisor if he can’t organize the transfer.

Needlessly to say even me connecting them directly to the courier was not enough.

My guess is that the OP depends on the money otherwise he wouldn’t be asking for help. So either but a cheap laptop and then control it with barrier[1] from your main driver and don’t ask(because whatever you ask they will probably say no). Or let them ship theirs to you, but I’m willing to bet that it be worse than whatever second machine you get.

In the meantime I would suggest you look for a new client because judging from experience there is a lot more pain to come. I didn’t do it in time and ended up paying dearly for my lack of initiative on that front.

[1] https://github.com/debauchee/barrier

I have a dedicated laptop for a client that is in a room of my basement. I remote into it from my personal machine whenever I do work for them. Works very well!

How comfortable would you be if you learned that your cloud provider allowed a contractor in a random overseas country to connect to your production servers from a laptop on which he also read his personal email?

Would you like them to have some controls in place to prevent that?

Would you like that to be enforced consistently and audited?

Would you like them to provide you with a certification that their procedures to ensure that doesn’t happen meet some minimal standard?

Congratulations, you have invented ‘demanding SOC2 compliance from vendors’.

And the upshot of it is that some contractors have to put up with jumping through some hoops.

"either working on screens that are too small (14" really isn't enough to be productive)"

I work primarily from a 13" xps. Given the high-res display + that I can switch desktops easily via i3, it's really a non issue for what I do.

You can also use a dock. For my work laptop, I use the Caldigit TS3+ thunderbolt and it's great.

If you can afford to spend a bit of money on the problem, it's possible to use something like PiKVM or KVM-over-IP to just leave a stack of client laptops or mini-PCs out of the way somewhere and connect to them remotely in a reliable way, so you can reset the machine if the remote desktop software fails.

No sane person would use their personal logins or private keys for customer work. Create ones for that project! Yes, it is a pain but having a bunch of expensive lawyers breathing down your neck is an even bigger one!

You want to separate your customer's work from your personal or other clients' data, even if they don't install any spyware on your computer. How are you supposed to ensure that you don't accidentally breach any NDAs (that you, no doubt, had to sign) if you are commingling the stuff?

I’d like to say no, but I’m not sure it’s an unreasonable request.

I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity.

Otherwise, I expected them to provide all hardware and software required to perform my role.

And likewise, for security purposes, that’s exactly what they wanted as well.

Tho I would note, they wanted to perform a background check prior to starting. And while i didn’t have a problem with the employer having those details (for the period of the contract) they performed this function through a 3rd party, who has stated they won’t delete my data (I will be following up post-contract). I was not happy for a 3rd party to have this data.

I would also not login to or install any apps, or certificates on my phone. Again, if that’s required, send me a phone.

The company I was working for had SOC2 / ISO2700 / what ever and I think this is exactly why they wanted all this. But it suited me to seperate things as well.

Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.

I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.

> Internet Explorer ActiveX plugin

Virtualized desktops have been solved. All the major players offer them. FFS, you can run Xbox One games in the cloud and play in your browser now.

That sound's like it is a looong time ago, todays VD's are extremely responsive just have a look at Shadow for example.

~6 years ago. I'd be surprised if such things weren't still deployed in places.

Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.

If you can pay 7500$/y for spyware you can surely pay for a VDI-Product.

The problem is rarely the monetary costs alone it's more about the need for handling an one-off situation that require special policies, and becomes an special item on the budget.

For large companies supplying VDI to consultants tend to be an standardized package that gets billed back to whatever project is hiring the consultants but for mid-sized organisation VDI is a big scary word that's going to require special handling.

Most desktop support teams are completely dependent on standardization to the point where they tend to turn into complete control freaks, that panic at the thought of anything that is not "by the book", so they often just apply the book without additional budgets to external consultants.

I am not interested in politics or humans when the problem is a technical one, i understand you but that's my stand ;)

why not spin up a VM dedicated to that client and confine all crapware to that VM?

Absolutely!

One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools.

It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.

But in that case I’d agree with the OP. I’m not installing what ever you want on my hardware.

I probably was more of a “temporary employee” than a contractor. But what’s the difference at that point? I was paid more than the value of entitlements as cash. It suited both parties, and was mutually agreed.

In hindsight, having them provide the hardware, and then handing it back at the end of the engagement would be my preference. It reduced any risks for them and me.

Tho I can easily imagine on/off or short infrequent contracting scenarios that this would not work for.

> I probably was more of a “temporary employee” than a contractor. But what’s the difference at that point?

If you’re a temporary employee, the employer is responsible for payroll taxes, and has additional obligations to you (depending on the state). You’re obligations— both to your employer and to the IRS—are different as well.

I’m addition to unlawfully skirting regulations, misclassifying an employee as a contractor is essentially stealing from the employee by reducing the company’s tax burden and increasing the employee’s.

You could reasonably invoice an upfront tooling cost ("isolated development workstation to meet customer IT policy requirements. Apple Macbook Foo, $BIGNUM")

If you want to be really cheeky, could get some value-added margin on it too, and as a bonus, AIUI it would be yours to keep after the engagement, rather than having to return hardware they've assigned to you.

Might be tough to get past finance though, unless they really want that certification :)

We've got a few machines we've inherited this way. For one client they needed confirmation that we had a sanitized infrastructure for our pentest and that we captured and logged all traffic to and fro. We billed them for the equipment and network link etc. Upon completion of the project we provided a certified copy of data destruction in accordance with their policies / guidelines and were left with a bunch of stuff. Scored two GPU cracking rigs, couple laptops, and some Cisco gear. I didn't complain. Granted now those rigs are a bit dated, but at the time 1080's were hard to get during the last mining rush so they definitely weren't cheap.

If they are sending a dedicated laptop, I'd recommend using dedicated accounts for that client. I don't use personal accounts on my work system even as a full-time employee.

I would strongly advise to not use personal accounts for customer.

Yeah like sending invoices arranging contracts I use my main mail account. For doing customer things I rather setup new email account or get one from the customer.

Login in GitHub/whatever on your other laptop. Then send via e-mail bits of code you need from one to the other. When asked why is taking longer vs. other clients point this as the culprit. And also charge this client more.

Between a) using my own machine, b) using a company machine and c) firing the client, option B is pretty sensible. Option C is for when the client won't compromise at all.

You can always make separate github accounts, SSH keys, and so on, specifically for the job.

Just compartmentalize your passwords and private keys. That said, private keys are generated on the dedicated hardware and always stay there - that's all you need to manage them.

+ 2fa + sensible rotation of keys and passwords (especially if you use say github for personal / work / multiple clients) - they can have the password at that point and it is of limited use.

I store all my keys in a yubikey (including ssh keys). The client can’t have the keys if I don’t have the keys.

I don't use my private accounts for anything related to this client.

> personal

Uh, hell no. You should have business accounts.

Personal and business never mix.

if only you could make a new set of those...

a lot of developers have separate everything

this can be bad when encountering the recruiters and hiring managers that still look at github activity as clout, but these days you still have to pass the technical interview no matter how much clout you have so I wouldn't worry about it