Comment by RileyJames | Hacker News Reader

Comment by RileyJames | Hacker News Reader

Parent Full thread

I’d like to say no, but I’m not sure it’s an unreasonable request.

I’ve recently been contracting and the only private account I used was GitHub, and that was a conscious decision to maintain a single public developer identity.

Otherwise, I expected them to provide all hardware and software required to perform my role.

And likewise, for security purposes, that’s exactly what they wanted as well.

Tho I would note, they wanted to perform a background check prior to starting. And while i didn’t have a problem with the employer having those details (for the period of the contract) they performed this function through a 3rd party, who has stated they won’t delete my data (I will be following up post-contract). I was not happy for a 3rd party to have this data.

I would also not login to or install any apps, or certificates on my phone. Again, if that’s required, send me a phone.

The company I was working for had SOC2 / ISO2700 / what ever and I think this is exactly why they wanted all this. But it suited me to seperate things as well.

Why not make a Virtual Desktop for your Developers instead of ~forcing them to install crap-ware.

Thats a solution thats used to be common for well run large shops(well sometimes using things like remotely accessed hardware prior to modern virtualization) but as this creates work and expenditure for the client many smaller outfit's kind of want it both ways and expect the contractor to fund hardware/software completely identical to what their IT is deploying for employee's.

If you can pay 7500$/y for spyware you can surely pay for a VDI-Product.

The problem is rarely the monetary costs alone it's more about the need for handling an one-off situation that require special policies, and becomes an special item on the budget.

For large companies supplying VDI to consultants tend to be an standardized package that gets billed back to whatever project is hiring the consultants but for mid-sized organisation VDI is a big scary word that's going to require special handling.

Most desktop support teams are completely dependent on standardization to the point where they tend to turn into complete control freaks, that panic at the thought of anything that is not "by the book", so they often just apply the book without additional budgets to external consultants.

I am not interested in politics or humans when the problem is a technical one, i understand you but that's my stand ;)

I have worked in such an environment. It was likely running on an overprovisioned server, that had to be accessed via an Internet Explorer ActiveX plugin. I'd rather be using a green-phosphor VT100 at that stage.

> Internet Explorer ActiveX plugin

Virtualized desktops have been solved. All the major players offer them. FFS, you can run Xbox One games in the cloud and play in your browser now.

That sound's like it is a looong time ago, todays VD's are extremely responsive just have a look at Shadow for example.

~6 years ago. I'd be surprised if such things weren't still deployed in places.

why not spin up a VM dedicated to that client and confine all crapware to that VM?

Absolutely!

One of the legal guidelines for whether or not someone is a contractor (vs an employee) is whether they provide their own tools.

It’s not a hard rule. It’s just one of a number of tests. But contractors are generally expected to provide their own tools.

You could reasonably invoice an upfront tooling cost ("isolated development workstation to meet customer IT policy requirements. Apple Macbook Foo, $BIGNUM")

If you want to be really cheeky, could get some value-added margin on it too, and as a bonus, AIUI it would be yours to keep after the engagement, rather than having to return hardware they've assigned to you.

Might be tough to get past finance though, unless they really want that certification :)

We've got a few machines we've inherited this way. For one client they needed confirmation that we had a sanitized infrastructure for our pentest and that we captured and logged all traffic to and fro. We billed them for the equipment and network link etc. Upon completion of the project we provided a certified copy of data destruction in accordance with their policies / guidelines and were left with a bunch of stuff. Scored two GPU cracking rigs, couple laptops, and some Cisco gear. I didn't complain. Granted now those rigs are a bit dated, but at the time 1080's were hard to get during the last mining rush so they definitely weren't cheap.

But in that case I’d agree with the OP. I’m not installing what ever you want on my hardware.

I probably was more of a “temporary employee” than a contractor. But what’s the difference at that point? I was paid more than the value of entitlements as cash. It suited both parties, and was mutually agreed.

In hindsight, having them provide the hardware, and then handing it back at the end of the engagement would be my preference. It reduced any risks for them and me.

Tho I can easily imagine on/off or short infrequent contracting scenarios that this would not work for.

> I probably was more of a “temporary employee” than a contractor. But what’s the difference at that point?

If you’re a temporary employee, the employer is responsible for payroll taxes, and has additional obligations to you (depending on the state). You’re obligations— both to your employer and to the IRS—are different as well.

I’m addition to unlawfully skirting regulations, misclassifying an employee as a contractor is essentially stealing from the employee by reducing the company’s tax burden and increasing the employee’s.

Reply on news.ycombinator.com