Hacker News Reader

Comment by cddotdotslash | Hacker News Reader

I admittedly don't know a lot about this situation beyond what I've read in the news the past day or so. However, isn't it the case that Zenefits is simply building an interface on top of ADP's payroll data? And, from what I've read, it seems like they did this without following the proper procedures (did they write some kind of web scraper?). So if that is the case, ADP has every right to block them. If the situation was reversed and a large company was scraping a startup's data to integrate into their own platform, the outrage would be directed quite differently. So Zenefits is plugging into ADP's data, not paying them for access, not following the proper procedures to get access, and selling an interface on top of that data for a 10% fee, and then they complain that ADP blocked them?

EDIT: Also, all of their press releases sound very immature.

View on HN

ADP has for years, and still does, allow bookkeepers, accountants, and HR services firms similar to Zenefits to access client accounts via 3rd-party administrative logins that clients themselves set up in their payroll.

The way this works is that you, as an ADP client, call them up and says "hey, I've asked my HR firm, XYZ-HR, to manage my payroll. Can you create an account for them to access my payroll system?" ADP creates this account, and XYZ-HR then handles all the payroll admin work going forward -- adding employee, terming them, inputting hours worked, managing deductions, etc.

This is how this has worked for years, and it's how thousands of companies do this via ADP. Even today, as an ADP RUN client, you can call in and add any third-party person you want as an admin to your payroll system -- as long as it's not Zenefits. ADP has marketing materials that describe this feature, both for companies and HR / bookkeeping / accounting firms. This is how Zenefits was accessing client's payroll, and doing so in order to take on all the administrative work related to payroll that you don't want to handle. We weren't "hacking" anything. We were doing this at our customers' request, with their full knowledge of what we were doing, and ADP set up these accounts with @zenefits.com email addresses, knowing it was Zenefits.

There is nothing improper about how we were doing this.

> There is nothing improper about how we were doing this.

You were automating it, weren't you?

With bookkeepers, accountants, etc. the login and work done on the system was manual. It was an actual person doing it.

In your case, a computer is doing it instead.

Virtually every site out there, from Facebook to Twitter, prohibits the use of bots and scraping. Not surprising ADP isn't a fan.

What is surprising is that you feel you're entitled to access their system however you want? It's their system. If they want to prohibit bots and allow only people, that's their biz. If you think ADP is full of it, create your own system with a public API and put them out of business.

> you can call in and add any third-party person you want as an admin to your payroll system

So they will create an admin account for a person - a single, human individual.

> In addition, Zenefits’ method of extracting data from ADP’s RUN system via “screen-scraping” put excessive demands on ADP’s servers, potentially impacting service delivery to the entire client base.[1]

If you weren't using the API, and instead were having a machine log in to access the data, that is pretty much the definition of scraping. There is a difference between a person using an admin account setup for them to log in and perform a certain set of actions and hundreds of accounts setup for the purposes of continual automated logins.

How many requests did you make? Do you rate-limit your queries to the rate of a human-being (maybe 1 click every couple of seconds)? Do you only login to one or two accounts at a time?

I still don't see a valid reason why any company (big or small) should have to invest resources in supporting a third-party that wants to use its data in an unsupported manner. Of course you can argue that they allowed it in the past, but an entire business shouldn't rely on unsupported access to something without the assumption that it could disappear at any minute.

[1] http://techcrunch.com/2015/06/10/adp-sues-zenefits-for-defam...

Parker when are you going to do another ADP post on Zenefits blog that contains more information on the email that was forwarded to you? I think it could be helpful if you included the screen shots and additional materials the ADP sales rep mentioned. If that was not included in the email, than it seems like that rep knew you would get that email, and you were just baited.

Zenefits has their users create an admin ADP user. Then zenefits uses those credentials to pull whatever data they want. They chose this route instead of working with ADP's third party system (without giving any justification as to why). I might sympathize if ADP's API access was severely limited or extremely expensive, but it appears as if Zenefits made no efforts to go this route.

Exactly. If I found a third-party company that was having users create accounts on my systems for the purposes of pulling data out, I would block it too, probably more quickly than ADP did.

Imagine if a company asked for your Google password instead of using the proper API channels. I don't know many users who would do that.

> Imagine if a company asked for your Google password instead of using the proper API channels

This would be more like creating a new Google Apps email account for someone, and allowing them to use it to (e.g.) manage things on your Google Drive (by sharing a group folder with them).

How many companies hire a 3rd party accounting / HR firm (or person) to manage their bookkeeping? How many of them create an ADP admin account for these people so that they can manage payroll? How is this that much different than Zenefits?

Ironically, this is typical in the Google Apps reseller arena, where the reseller creates your domain for you under their Google account, and then also administer it using a superadmin account they create in your domain for that purpose.

This is exactly how most resellers on Google Apps are set up, actually.

The Google password scenario actually used to be a pretty common thing before Google built an API.

From having been there, ADP is a tin-plated nightmare to work with for third-party API access. I'd do the exact same thing in Zenefits' shoes; ADP knows that they are eternally your competitors and will screw you at the first opportunity.

Of course, ADP doing that is not doing right by their customers, but who cares, they're just cash cows.

How smart is it to build a business on unofficial, non-API access to a system maintained by someone who you know will try to screw you at the first opportunity? If I were ADP, I'd probably be intentionally breaking those types of integrations just to make it clear that they don't intend to hamstring themselves by supporting interfaces they never published. The fact that it's someone in a market they intend to enter is gravy.

I didn't say it was smart, but it's smarter than ADP's jokestore of an official API. If you want to talk to ADP customers--and, functionally, you very close to need to talk to ADP customers--those are your options.

I feel like maybe the point of my post was not completely clear, though: this would not be a problem, and Zenefits would not be doing this, if ADP was good (not good in the "not poor software" sense, but good in the moral sense). And we should be faulting ADP for not being good to its customers, not Zenefits for trying to bring good to ADP's customers.

ADP's customers are most definitely not the third party developers, though. Because of that, you can't really conflate the two into one argument. ADP can easily be "good" to their customers while still having shitty APIs. Hell, plenty of companies do this every day, why should we chastise ADP for running a business?

Furthermore, a profit-seeking corporation shouldn't really be on the moral scale to begin with. At best, they should be amoral, that is, not involved at all in morality. Their primary goal is, and should be, to earn more money, not to be good citizens of the world.

"At best, they should be amoral" companies are still run by people. So, your suggesting people should be amoral while at work, which is an unusual stance.

I would suggest it's much better for the laws and regulations to be setup so a profit seeking company would end up being a net benefit. But, suggesting company's should for example try and corrupt politicians in the name of profit seems rather dystopian.

Amoral != immoral. Amorality simply is the disconnection from morals, while immorality is doing something you know to be wrong. The people in charge would still be held by their own moral beliefs, but we should not be chastizing or congratulating companies for their moral contributions because, as an entity, their decisions should not be based on morals, but on profit.

You just contradicted yourself. If the CEO is unwilling to start a bio-weapons division duo to lack of profits or excessive risks etc then that's a amoral decision because morality did not come into play. However, if they decide it may be profitable, but it's immoral so there not willing to go there then the company was constrained by morality.

PS: It could even go the other way where a CEO feels it's his patriotic duty to aid his government so he wants to start a bio-weapons division. The point is not the choice the point is why it was made.

> Furthermore, a profit-seeking corporation shouldn't really be on the moral scale to begin with. At best, they should be amoral, that is, not involved at all in morality. Their primary goal is, and should be, to earn more money, not to be good citizens of the world.

You are very much mistaken. Society provides the corporation with legal protections and recourses as a fictive person with the understanding that the corporation's existence betters the society, betters the people within it. When this agreement is breached, the society can--though, unfortunately, rarely does, due to globally weird veneration of toxic behavior as "just business"--destroy it. (It has happened before. It should happen more often.)

And let's be really real for a sec: if you look at the stretch of history, neutrality is effectively tacit support for bad behavior. And from a practical perspective, a call for "amorality" is tacit support for immorality.

A public web app is an official API, thought primarily to be used by humans; but built using protocols such that it's possible to be used by programs on behalf of humans ..

You access HN by your browser, the same as Zenefits' customers accessed ADP services indirectly ..

The point is where to put the line between what's a good allowed access, and a bad too-much-indirection access

Ok, let's for the sake of argument grant you that a public web app is an official interface (I'm not saying API because it's not a "programming" interface). The implied contract is that humans will continue to be able to use the web app to access the functionality it's intended to provide. Anything in the HTML is an implementation detail, not part of the contract, and is subject to change at any time, so long as the contract (human usability) is still fulfilled. This is why web scraping is such a risky proposition: the structure of the page may change at any time without violating the implied contract of a human being able to use the web page.

The existence of a public interface usable by humans (a web app) does not in any way imply the existence of a machine-usable protocol for accessing that same functionality. If you infer one, you do so at your own risk. By the same token, the existence of a machine-usable interface that is not public does not imply a contract that it will continue to exist.

If you build your business on an imagined contract, be prepared to have a bad day when the other "party" to the non-contract "violates" it.

> The existence of a public interface usable by humans (a web app) does not in any way imply the existence of a machine-usable protocol for accessing that same functionality.

Is that non-implication better for consumers? For people?

If not, why should it exist?

Isn't that all the way around?

Machine-usable protocols is what make possible to humans use public interfaces (web apps)

When was the last time that you injected electricity to a cable to send a HTTP request?

> Is that non-implication better for consumers? For people?

How is that relevant? Putting up a web site does not obligate you to then do more just because it would be even better.

Asking for forgiveness rather than permission is a risky strategy, but one that pays off well when it works.

Where it seems to have worked: Uber, Paypal, et al.

Where it failed: Twitter clients, Craigslist front-ends, et al.

I'm not so sure it's worked for Uber, given this:

https://news.ycombinator.com/item?id=9694530

The "right way" is hard, and more likely to be painful, certainly. But when you're done, you're done. The "forgiveness>permission" way has the added downside of your customers getting screwed too, and likely considering litigation.

By "worked" I meant building a large business. Sort of undeniable that Uber has done that. That lawsuit, despite its merits, isn't going to slow Uber's growth a whit.

Every U.S. business gets sued, it's the American way.

As a gratuitous side-note: despite the HN hatred of Uber (and I'm one of those who hate the company), the company wouldn't be growing if it's users didn't love it. Unlike the other most hated companies--mainly airlines, cable TV providers, and telecomms--users of Uber can very easily choose to use an alternative. Here in NYC, the alternative--flagging down a yellow cab--is probably actually easier to use than Uber, yet everyone I know uses Uber anyway. They're clearly doing something right.

If it makes money, it's smart. If you're filling a need, then it's smart. Sure it's risky but anything you do has some measure of risk. It might even be worth it because it's risky and therefore less competition.

I'm not speaking for or against Zenefits and their methods, but ADPs API is severely limited and extremely expensive. I worked with their Dealer Services division when I was at a startup in the automotive space and ADP had one of the worst crafted APIs I have ever seen. I made a comment about it on an earlier Zenefits post, but the gist was that the "stable, production API" was a constantly moving target that changed without notice or reason.

I believe we had incurred over $50,000.00 in fees before we ever reached the testing stage or purchased the right to use the API (that license is on a client by client basis, too). That $50M number was fees directly to ADP, and does not include our own payroll and expenses.

We were completely bootstrapped and started with about $70M in the bank, yet we were still able to complete that integration. I can't see how a company with over $500MM in funding[0] couldn't unless they were prohibited by ADP.

https://www.crunchbase.com/organization/zenefits

As someone who is a customer of ADP [we use them for payroll, etc, etc]

I'd go the Zenefits route too [and we do for our automation in relation to ADP precisely because ADP's API is insufficient]

It actually works a bit differently; it's not all scraping. People enter data into Zenefits and then it populates that data into ADP.

I don't think the issue is as cut and dried as the typical web scraping situation and I wonder how HN readers feel about this kind of thing. The data belongs to the client. The client chooses to use both services. Should it matter how the client accesses their own information from the service? Are they required to use a web browser? Would you feel the same about them using their own wget script to automate interactions ADP? At what point does it become improper to access a service differently than that service wishes you to access it?

Generally, from an ethical perspective, it matters at the point when you choose to build a business on the method of accessing a 3rd party service.

From a legal perspective, the profit-making purpose is irrelevant. Improper access matters when you start using the service.

>it matters at the point when you choose to build a business on the method of accessing a 3rd party service.

Why? They are having to pay them and then buy your services for data entry. This is no more unethical than hiring someone to do your banking for you.

Violating an EULA by doing this may be unethical, but in that case, it is violating the EULA that is unethical, not the general practice of providing a new interface.

Are accountants who access ADP on behalf of their clients doing something unethical? Does it matter if that accountant uses their own scripts or wget to access ADP?

> Improper access matters when you start using the service.

I don't know what this means.

> Should it matter how the client accesses their own information from the service?

I don't think so either. Would people feel the same if a store banned wheelchairs? You can write a EULA however you want, but I don't think you should be able to enforce arbitrary provisions which harm customers and potentially violate the Americans with Disabilities Act. Probably this has nothing to do in practice with accessibility for disabled people, but it is related to accessibility and user experience for everyone.

(Disclosure: I write web scraping software... nothing related to this. Also I'm speculating about general circumstances, not individual companies, so please no libel lawsuits :)

Reply on news.ycombinator.com