> The Drata agent does exactly what you are talking about
Does it also name and shame? ;)
401 karma · joined December 17, 2021
Does it also name and shame? ;)
What other kinds of personal information does it process or collect, locally or in it's server endpoint?
An external IP address is personal information. A UUID identifying a block device is personal information. A hostname is personal information. Anything in "/usr/home" is personal information.
And you can change that over night, without notice to anyone not actively monitoring your platform for such messages.
Why is that your policy.
You expect a high level of trust. And still you engage in dark anti-patterns that nukes any kind of trust for anyone who know how to read.
What I know is:
1) They collect mandatory private information. They already know my name and my email, and they used that information to ask me to complete some tasks on their website. I don't know what those tasks are, because I first have to accept their TOS, which contains clauses that is referred to, but not disclosed. I declined.
2) Their "webpage" is part of their service. This is where I supply personal information (presumably more than they already have). So unless they have another TOS, after I accept the publicly available one, that's the rules: I have to give them personal data, because my employer (well, in my case it's my customer, not my employer - Drata have no agreement with my employer) signed a contract with them.
3) They give themselves the right, in the websites TOS, to sell my data.
So: 1 + 2 + 3 = Drata collects private employee info and resells it.
The agent is not the only concern. Before you even get to install the agent, you have to provide personal information to their website (I believe - I don't now, because I rejected the TOS and don't have access to the non-public part of their website).
The thing is - Drata collects mandatory information from their customers employees and contractors trough their website. The TOS for the website is explicit about how they plan to use that information.
Is that the 100% honest answer?
From my understanding, your website is where you collect my mandatory personal information, if I agree with your TOS. It's not just a glossy brochure for your product - it is your product.
I cannot choose what I share with you. But you can choose with whom you share what information I provide. And from your websites TOS, you seem very eager to share it.
May be you should go over your user agreement documents and:
1) Make sure that all relevant information is available, so a user can make an informed decision.
2) Distinguish between the user roles, and have different agreements for the different roles. One role is your customer. A second role is the employee of your customer. A third role is the contractor for your customer. A potential fourth role is the person(s) working for the customer that is responsible for dealing with personal and confidential information related to you, employees and contractors.
As of today, your user agreement is a mess, appearing as something you have copied and pasted together without much thought, except for how to cover your own asses. Including the ridiculed clause Microsoft is infamous for, warning that your software is unfit and unusable for any purpose.
I am the OP. I am not your customer. My customer is your customer. My customer wants me to install your agent.
When I contacted Drata on email with some concerns before I accepted your terms and conditions (which I will never accept in its current form) and got any real information about your agent, your secretary responded: "Feel free to reach out to your Drata administrator internally with concerns. Do note, that when your company contracted with Drata, any edits or redlines they provided will prevail for all employees of your company."
That is not very reassuring for a company (Drata) that want me to accept undisclosed terms and conditions, wants to sell my personal data to targeted marketing, reserves the right to change the user agreement over night, and who exploits a loophole in GDPR so you can move my personal data out of EU and do things with it that would be a crime in EU.
I interperate that reply, from your secretary, as: "We already sold our thing to your company, so we don't care. Not about you. Not about your company. Bend over and take it like a good bitch!"
As others have suggested here; if you want people to trust your agent, you should open source it, have it audited, and publish the audit reports.
May be. May be not. I have not decompiled their client, so I don't know what it does. However, Dratas Terms Of Service states: "Drata will notify you of updates via an email or a notification on the platform. Unless the notice states otherwise, the updated terms of this Agreement will become effective and binding on the next business day after it is posted." I assume this is US business days. So I could be on Easter vacation in Romania, while they changed their contract.
Drata gives themselves the right to change what they call "the Agreement" virtually without notice. Unless I have a hook in my email client, and a bot looking for notifications on their "platform", and are ready to get up in the middle of the night to print out and read their new "Agreement" - they could fuck me any way they like. Including updating their client with one that does something entirely different than the one thy have today.
For a company with a mandatory service, they are surely engaging in a lot of dark anti-patterns. I don't believe for a second that they act in good faith. I don't trust them.
I have two qualities that makes customers willing to pay a premium. I am very good at what I do. I am honest. I don't want to compromise my integrity.
That is the easy solution. Problem is, I really like the projects I work on and the people I work with.
Economically, I could drop out at any time.
When a new manager I don't know send me an email to install some "agent" from a company I have never heard about, and that company turns out to have terms and conditions from hell (like references to undisclosed terms and conditions they want me to accept) - then I label that thing, in my mind, as a "hostile agent". It's not something that will ever get access to my lan. It's something I don't even want in a VM, because it may know how to escape from a VM.
That's not cynicism. That's risk assessment.
"We, our service providers and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes: ... Interest-based advertising. ... We may also share information about our users with these companies to facilitate interest-based advertising ... We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect ... and share it with third parties for our lawful business purposes"
Such "de-identified data" is often trivial to re-identify. There are research papers about that. It's well known in the security and privacy community.
Also, they use dark anti-patterns for opting out from them even using your personal data for their own advertising. "You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us at ..."
If Drata intended to be a nice, trustworthy security partner, use of any personal data for targeted marketing, or sale of any personal information would be opt in, not "out out if you can figure out how ...".
I have not read their terms of conditions or even their glossy information about the agent. I never got that far, as I declined to accept the terms and conditions for using their website. Already at that point, I saw red flags the size of Australia.
I don't believe for one second that Drata has any intention of showing any decency or that they act in good faith towards their customers or anyone else. If they did, they would have developed reasonable terms and conditions. What they have don't even distinguish clearly between the roles of a customer and an employee or contractor for their customers. Hell, they don't even define the term "Customer".
I read their Privacy Policy. They are quite explicit about what they plan to do to you. I raised the issue with them in an email (among 5 other issues). Their reply is in the header. Another issue I raised is that they expect me to accept undisclosed terms and conditions.
That said. I have worked with computer security at an advanced level, including consulting, training, penetration testing, design/implementation of x-platform server agents for monitoring and alerting, design/implementation of firewall. Once I designed an implemented a system to deal with NATO secrets (not very sensitive secrets, but still secrets) for a military subcontractor in EU. My computer is relatively secure. I follow best practices - and more. A hostile agent would decrease the security on my network. That was my first thought when I got that awful email.
Also, I don't get it why that need such a thing on my PC. I don't have credentials to production systems or production data. I am a software developer. I work with code and documentation. That's it. Anything I produce is reviewed by other developers and then tested independently by QA.
I am careful to be a freelancer, and not an employee, for several reasons. It means that legally I'm my own boss. That feels good (I have a great boss!) It also make it unproblematic to work on open source projects, without getting into discussions about who owns the intellectual rights to that work.
Not that I'm aware of.
I don't know the details. My interpretation is that some manager hired some company to help them with this certification that the sales people says that they need.
No. But it looks like a loophole to export whatever they have a legal basis to collect, to process it and share it in ways that GDPR was designed to prevent. In other words, to do what would be a crime in EU.
That is not going to happen. I'm a freelancer, and I am going to remain a freelancer. It that becomes too hard in EU, then bye bye EU :) I'm already an expat.
Thank you! That is the kind of experience I want a taste of :)
That would create a layer of cynicism between me and my work. I don't have that today, and I would rather avoid it.
It is.
Problem is, I like code. I don't like politics. I'm not good with people.
I work with code. Not data.
I don't have access to production systems. I do too many mistakes, and I admit it. Just last month I killed the wrong k8s cluster ;)
I don't know for a fact that it is spyware. For now I just think of it as an "hostile agent".
I object because a) I don't want frustrations at work. I want to focus on the problems I am there to solve (which are quite interesting), b) I don't want a hostile agent from a company selling data to "targeted marketing" in my network, c) I don't want such companies even to know my real name, d) I take security seriously - I hate security theater.
That's what I object to.
Because, until last week they didn't.
Now I have to figure out if I'm just an unreasonable, stubborn old guy, or if this requirement is out of band.
I don't. My clients usually find me via reputation or via open source projects I work on.
They have some lawyer speak in their "Data Processing Addendum" that is unclear to me. I suspect it is designed to enable a loop-hole in GDPR. I'm not an expert. It would cost me a fortune to get a law firm specializing in GDPR to dissect it. Drata declined to comment on my concerns about this.
That was one of the six concerns I raised with Drata. Their reply was: "Feel free to reach out to your Drata administrator internally with concerns. Do note, that when your company contracted with Drata, any edits or redlines they provided will prevail for all employees of your company."