Hacker News Reader

Comment by leipert | Hacker News Reader

> That’s why I have personal property that the company isn’t able to access so I can conduct personal activities with some level of privacy.

The problem right now is: due to Work from home, you basically have blurred the lines between the digital company and private assets. Either you have a company device; or even a personal device running this software in your private networks doing and telemetering you don’t know what.

This especially bad for the folks who aren’t able to properly put those devices in a separate subnet and protect themselves.

View on HN

Second laptop. I know it's expensive, but if your working from home, don't do it from your own computer. do it from a computer work provides. Or at least, create a second account called work and do everything from that. Also make the theme, colors and everything you can different so there's a context shift between the two activities.

We all know Synergy and for basic setups it gets the job done. I paid for the v2 Pro license to support them and will keep doing so.

I have moved over though to using Barrier, a synergy-core fork. You get ssl crypto for free, and it fixes some simple but long standing bugs that really annoyed me. Have only used on Mac + Linux for now.

https://github.com/debauchee/barrier

Same setup, except three laptops: personal, company-provided, client/project-provided.

You would think it would be unmanageable and you'd be right we're it not for Synergy (https://symless.com/synergy). I've got two laptops docked and connected to external monitors. Synergy lets me use just one keyboard and mouse for all three at the same time. Makes it feel like they're just three adjacent screens on one PC. But because they're not I can maintain strict separation between personal and work, and between internal/corporate and client data.

Then, like others have said, I have a fair amount of filtering on the network level.

I’ve thought about this but I assumed it would be too hard to get Synergy installed on employer or client-provided computers. It sounds like you’ve used this setup with multiple clients – is it normal in your field of work to get local admin rights on corporate devices?

It's not ideal, but you can run the Synergy client executable (synergyc.exe) without admin rights. You lose the conveniences of having it auto-start and using the GUI configuration, but you still get all the functionality. You also can't use the installer, but you can just copy the Synergy directory from a working machine. You also need a MS C++ runtime DLL, but you can copy that too. I'm not in front of my computer at the moment. I'll edit/reply to this comment with details

For example, on my client/project-specific machine (where I don't have admin rights), I have a batch file (start-synergy.bat) that lives on my desktop with:

  C:\Users\jdbernard\Synergy-1.12.0\synergyc.exe -name client-pc 192.168.1.120

https://answers.microsoft.com/en-us/windows/forum/windows_10...

Why not use the First party equivalent? Microsoft's Mouse Without Borders claims to do exactly this.

Because my personal machine runs Linux, my corporate machine runs macOS, and my client machine runs Windows.

If they were all Windows this might be nice as it claims to support some edge cases Synergy doesn't (primarily logon/UAC).

I imagine if the work laptop is 24/7 connected to a VPN, then this tool doesn't work.

Depends on the network filtering done by the company.

I have my router setup with port-forwarding for the Synergy protocol. Combined with stable IP addresses internally on my network and dynamic DNS pointing to my home network, I am able to use this tool even when the client machine is on VPN.

Of course, it's important to realize that by doing this you are sending keystrokes across the internet, so it's important to enable the option in Synergy to encrypt the traffic.

> your working from home, don't do it from your own computer. do it from a computer work provides

Wait, is this something that needs even saying?! Are people relly BYODing personal laptops too? Why? It would not even cross my mind to use personal computer to touch work stuff with ten foot pole.

This won't work at most companies of any size, because you need to use a VPN, and the VPN client enforces policies - checking you are using a company machine, that you have their AV installed and updated, that you have their DLP (Data Loss Prevention) installed, that you have their endpoint protection system installed...

I am using a second account, configured differently, like you recommend, as this is the simplest solution.

For even better isolation, a virtual machine could be used, instead of a second computer.

But that's a good strategy regardless of Corona, you don't want you kid to download stuff into your work environment or watch NSFW stuff on a work related computer.

Good advise - I know people who got fired because all of a sudden during a zoom session on their personal device some content showed up that would not have been on a work computer.

I wish there was a better solution to this. I tried creating a VM and joining that to the work "services" but HyperV, VirtualBox, etc. all add an audio delay making Teams unusable.

Also tried Barrier and dedicating one monitor to work, but I still can't share/mix the audio so have 2 separate headsets.

I know ideally I'd just use the work computer all the time when "working", but they're VPN-ing all traffic and I occasionally need to read a private email, or do some browsing and would prefer they don't see that traffic.

> I occasionally need to read a private email, or do some browsing and would prefer they don't see that traffic.

Low friction answer to that is a personal smartphone. Bonus points because it works in the office too!

So my plan for the audio problem is to use a set of raspberry pis with USB-gadget stuff enabled to be a webcam & soundcard then running them as a usb device. The webcam is going to be an RTSP feed (with the microphone audio) from the main system to push it through and pulseaudios network side of things to do speaker\headphone out.

it's a bit complex for what i need but it should work well.

You could buy a small desktop mixer with two sends, so you could connect a microphone to it and choose which computer it will send voice to and also mix sound from both computers.

> "due to Work from home, you basically have blurred the lines between the digital company and private assets"

I have a separate work computer and home computer on my desk; the work computer is on a guest wi-fi network and cannot see local traffic. A decent wi-fi router with guest network capabilities is a trivial expense these days.

Or you have both. For example, I have work equipment and personal equipment on my same home desk.

My home network blocks a lot of traffic, but I’d be really surprised if my personal device provided any telemetry to work.

> separate subnet

Why ? theoretically you have a point, but practically which company would spy on your network ? I totally understand, and agree to some degree, a company protecting its assets and tracking what their employees are doing but it's not the same as putting a general spyware.

It’s not about that I don’t trust my company. I just don’t necessarily trust the software I need to use for a job.

For example if it has some device management software, or some VPN clients or whatnot installed, this increases the attack surface.

Also „leipert“-private might be boring for targeted attacks. But „leipert“-corporate might be interesting, if someone owns my private network OR my work computer, it might have an impact on the other.

We just RDP into our in-office machines when we work from home.

From your personal machine? Do you ever check your email via a web interface on your own box? write a quick textfile or document? Log into a web app?

It's really easy to let your work bleed into your personal machine...

Sure, but the threat level of occasionally writing some notes on a personal box is nowhere near what it would be if I was writing code or connecting to production environments from it.

Reply on news.ycombinator.com