News for hackers. Stuff that matters.
Re:Ask HN: My client want an agent on my laptop. Is this the... by mindslight on Friday December 17, 2021 @10:50AM (#29593795)
> Do you have any evidence for this?? I've just been involved in selecting Drata as a vendor for SOC2 compliance planning for our company. If this is true it's a huge deal and totally against my understanding of their business model. It honestly sounds like bullshit to me! But if you have evidence that they do this, please let us know.

Unless their agent is Free Software, the reasonable end-user assumption is that they are doing malicious things. As we've seen time and time again, it's inevitable - either now, or in the future, they will come up with some bright idea for more features that involve being directly user-hostile. Your company may rely on their legal contract assurances, but I as an individual cannot.

My minimum policy for running sketchy binary blobs is in a VM on another machine. If you're adopting this type of software, it's incumbent upon you to make your corporate policy one of supplying computing equipment for everyone who is expected to run it. And also accept that employees will physically damage microphones and webcams to stop your supplied machines from acting as surveillance bugs of their personal dwellings.

Re:Ask HN: My client want an agent on my laptop. Is this the... by tptacek on Friday December 17, 2021 @02:19PM (#29597050)
This is just a way of saying that every mid-to-large-sized company in the world is doing malicious things, because all of them depend on closed-source agent software of one kind or another. And you might be right about that! Certainly, the industry has not taken the threat of agent-based management tools seriously enough.

But what the hell is your point? This is about as practical an argument as "the only reasonable software for your company to run is free software". Even if it were true, it's so far outside of industry norms that you might as well be asking them to ship all their products on BeOS.

Re:Ask HN: My client want an agent on my laptop. Is this the... by mindslight on Friday December 17, 2021 @03:39PM (#29598039)
My comment was not about what is reasonable for companies to run. In fact, I implied that it is reasonable for companies to run proprietary agents, because they have contracts and legal remedy through the courts if the products turn out to be malicious spyware.

My judgement is confined to what is reasonable for individuals to be asked to run in their own operating environments. Individuals lack recourse through the courts, barring some watershed law like a US GDPR with a provision for adequate liquidated damages.

I also pointed out a straightforward path if a company still wants their contractors/employees to run unaccountable proprietary crapware on the devices used to do work - purchase dedicated devices for contractors/employees to use for work, rather than expecting to get exclusive software installed on shared equipment. Coupled with an appropriate home network set up, this provides complete compartmentalization, assuming any sensors can be disabled.

(deliberate employee-hostile software, eg employee activity trackers, is out of the scope of this comment)