Zenefits has their users create an admin ADP user. Then zenefits uses those credentials to pull whatever data they want. They chose this route instead of working with ADP's third party system (without giving any justification as to why). I might sympathize if ADP's API access was severely limited or extremely expensive, but it appears as if Zenefits made no efforts to go this route.
I'm not speaking for or against Zenefits and their methods, but ADPs API is severely limited and extremely expensive. I worked with their Dealer Services division when I was at a startup in the automotive space and ADP had one of the worst crafted APIs I have ever seen. I made a comment about it on an earlier Zenefits post, but the gist was that the "stable, production API" was a constantly moving target that changed without notice or reason.
I believe we had incurred over $50,000.00 in fees before we ever reached the testing stage or purchased the right to use the API (that license is on a client by client basis, too). That $50M number was fees directly to ADP, and does not include our own payroll and expenses.
We were completely bootstrapped and started with about $70M in the bank, yet we were still able to complete that integration. I can't see how a company with over $500MM in funding[0] couldn't unless they were prohibited by ADP.
From having been there, ADP is a tin-plated nightmare to work with for third-party API access. I'd do the exact same thing in Zenefits' shoes; ADP knows that they are eternally your competitors and will screw you at the first opportunity.
Of course, ADP doing that is not doing right by their customers, but who cares, they're just cash cows.
How smart is it to build a business on unofficial, non-API access to a system maintained by someone who you know will try to screw you at the first opportunity? If I were ADP, I'd probably be intentionally breaking those types of integrations just to make it clear that they don't intend to hamstring themselves by supporting interfaces they never published. The fact that it's someone in a market they intend to enter is gravy.
The "right way" is hard, and more likely to be painful, certainly. But when you're done, you're done. The "forgiveness>permission" way has the added downside of your customers getting screwed too, and likely considering litigation.
By "worked" I meant building a large business. Sort of undeniable that Uber has done that. That lawsuit, despite its merits, isn't going to slow Uber's growth a whit.
Every U.S. business gets sued, it's the American way.
As a gratuitous side-note: despite the HN hatred of Uber (and I'm one of those who hate the company), the company wouldn't be growing if it's users didn't love it. Unlike the other most hated companies--mainly airlines, cable TV providers, and telecomms--users of Uber can very easily choose to use an alternative. Here in NYC, the alternative--flagging down a yellow cab--is probably actually easier to use than Uber, yet everyone I know uses Uber anyway. They're clearly doing something right.
I didn't say it was smart, but it's smarter than ADP's jokestore of an official API. If you want to talk to ADP customers--and, functionally, you very close to need to talk to ADP customers--those are your options.
I feel like maybe the point of my post was not completely clear, though: this would not be a problem, and Zenefits would not be doing this, if ADP was good (not good in the "not poor software" sense, but good in the moral sense). And we should be faulting ADP for not being good to its customers, not Zenefits for trying to bring good to ADP's customers.
ADP's customers are most definitely not the third party developers, though. Because of that, you can't really conflate the two into one argument. ADP can easily be "good" to their customers while still having shitty APIs. Hell, plenty of companies do this every day, why should we chastise ADP for running a business?
Furthermore, a profit-seeking corporation shouldn't really be on the moral scale to begin with. At best, they should be amoral, that is, not involved at all in morality. Their primary goal is, and should be, to earn more money, not to be good citizens of the world.
"At best, they should be amoral" companies are still run by people. So, your suggesting people should be amoral while at work, which is an unusual stance.
I would suggest it's much better for the laws and regulations to be setup so a profit seeking company would end up being a net benefit. But, suggesting company's should for example try and corrupt politicians in the name of profit seems rather dystopian.
Amoral != immoral. Amorality simply is the disconnection from morals, while immorality is doing something you know to be wrong. The people in charge would still be held by their own moral beliefs, but we should not be chastizing or congratulating companies for their moral contributions because, as an entity, their decisions should not be based on morals, but on profit.
You just contradicted yourself. If the CEO is unwilling to start a bio-weapons division duo to lack of profits or excessive risks etc then that's a amoral decision because morality did not come into play. However, if they decide it may be profitable, but it's immoral so there not willing to go there then the company was constrained by morality.
PS: It could even go the other way where a CEO feels it's his patriotic duty to aid his government so he wants to start a bio-weapons division. The point is not the choice the point is why it was made.
> Furthermore, a profit-seeking corporation shouldn't really be on the moral scale to begin with. At best, they should be amoral, that is, not involved at all in morality. Their primary goal is, and should be, to earn more money, not to be good citizens of the world.
You are very much mistaken. Society provides the corporation with legal protections and recourses as a fictive person with the understanding that the corporation's existence betters the society, betters the people within it. When this agreement is breached, the society can--though, unfortunately, rarely does, due to globally weird veneration of toxic behavior as "just business"--destroy it. (It has happened before. It should happen more often.)
And let's be really real for a sec: if you look at the stretch of history, neutrality is effectively tacit support for bad behavior. And from a practical perspective, a call for "amorality" is tacit support for immorality.
A public web app is an official API, thought primarily to be used by humans; but built using protocols such that it's possible to be used by programs on behalf of humans ..
You access HN by your browser, the same as Zenefits' customers accessed ADP services indirectly ..
The point is where to put the line between what's a good allowed access, and a bad too-much-indirection access
Ok, let's for the sake of argument grant you that a public web app is an official interface (I'm not saying API because it's not a "programming" interface). The implied contract is that humans will continue to be able to use the web app to access the functionality it's intended to provide. Anything in the HTML is an implementation detail, not part of the contract, and is subject to change at any time, so long as the contract (human usability) is still fulfilled. This is why web scraping is such a risky proposition: the structure of the page may change at any time without violating the implied contract of a human being able to use the web page.
The existence of a public interface usable by humans (a web app) does not in any way imply the existence of a machine-usable protocol for accessing that same functionality. If you infer one, you do so at your own risk. By the same token, the existence of a machine-usable interface that is not public does not imply a contract that it will continue to exist.
If you build your business on an imagined contract, be prepared to have a bad day when the other "party" to the non-contract "violates" it.
> The existence of a public interface usable by humans (a web app) does not in any way imply the existence of a machine-usable protocol for accessing that same functionality.
Is that non-implication better for consumers? For people?
If it makes money, it's smart. If you're filling a need, then it's smart. Sure it's risky but anything you do has some measure of risk. It might even be worth it because it's risky and therefore less competition.
Exactly. If I found a third-party company that was having users create accounts on my systems for the purposes of pulling data out, I would block it too, probably more quickly than ADP did.
Imagine if a company asked for your Google password instead of using the proper API channels. I don't know many users who would do that.
Imagine if a company asked for your Google password instead of using the proper API channels
This would be more like creating a new Google Apps email account for someone, and allowing them to use it to (e.g.) manage things on your Google Drive (by sharing a group folder with them).
How many companies hire a 3rd party accounting / HR firm (or person) to manage their bookkeeping? How many of them create an ADP admin account for these people so that they can manage payroll? How is this that much different than Zenefits?
Ironically, this is typical in the Google Apps reseller arena, where the reseller creates your domain for you under their Google account, and then also administer it using a superadmin account they create in your domain for that purpose.
Comments
Zenefits has their users create an admin ADP user. Then zenefits uses those credentials to pull whatever data they want. They chose this route instead of working with ADP's third party system (without giving any justification as to why). I might sympathize if ADP's API access was severely limited or extremely expensive, but it appears as if Zenefits made no efforts to go this route.
I'm not speaking for or against Zenefits and their methods, but ADPs API is severely limited and extremely expensive. I worked with their Dealer Services division when I was at a startup in the automotive space and ADP had one of the worst crafted APIs I have ever seen. I made a comment about it on an earlier Zenefits post, but the gist was that the "stable, production API" was a constantly moving target that changed without notice or reason.
I believe we had incurred over $50,000.00 in fees before we ever reached the testing stage or purchased the right to use the API (that license is on a client by client basis, too). That $50M number was fees directly to ADP, and does not include our own payroll and expenses.
We were completely bootstrapped and started with about $70M in the bank, yet we were still able to complete that integration. I can't see how a company with over $500MM in funding[0] couldn't unless they were prohibited by ADP.
https://www.crunchbase.com/organization/zenefits
From having been there, ADP is a tin-plated nightmare to work with for third-party API access. I'd do the exact same thing in Zenefits' shoes; ADP knows that they are eternally your competitors and will screw you at the first opportunity.
Of course, ADP doing that is not doing right by their customers, but who cares, they're just cash cows.
How smart is it to build a business on unofficial, non-API access to a system maintained by someone who you know will try to screw you at the first opportunity? If I were ADP, I'd probably be intentionally breaking those types of integrations just to make it clear that they don't intend to hamstring themselves by supporting interfaces they never published. The fact that it's someone in a market they intend to enter is gravy.
Asking for forgiveness rather than permission is a risky strategy, but one that pays off well when it works.
Where it seems to have worked: Uber, Paypal, et al.
Where it failed: Twitter clients, Craigslist front-ends, et al.
I'm not so sure it's worked for Uber, given this:
https://news.ycombinator.com/item?id=9694530
The "right way" is hard, and more likely to be painful, certainly. But when you're done, you're done. The "forgiveness>permission" way has the added downside of your customers getting screwed too, and likely considering litigation.
By "worked" I meant building a large business. Sort of undeniable that Uber has done that. That lawsuit, despite its merits, isn't going to slow Uber's growth a whit.
Every U.S. business gets sued, it's the American way.
As a gratuitous side-note: despite the HN hatred of Uber (and I'm one of those who hate the company), the company wouldn't be growing if it's users didn't love it. Unlike the other most hated companies--mainly airlines, cable TV providers, and telecomms--users of Uber can very easily choose to use an alternative. Here in NYC, the alternative--flagging down a yellow cab--is probably actually easier to use than Uber, yet everyone I know uses Uber anyway. They're clearly doing something right.
I didn't say it was smart, but it's smarter than ADP's jokestore of an official API. If you want to talk to ADP customers--and, functionally, you very close to need to talk to ADP customers--those are your options.
I feel like maybe the point of my post was not completely clear, though: this would not be a problem, and Zenefits would not be doing this, if ADP was good (not good in the "not poor software" sense, but good in the moral sense). And we should be faulting ADP for not being good to its customers, not Zenefits for trying to bring good to ADP's customers.
ADP's customers are most definitely not the third party developers, though. Because of that, you can't really conflate the two into one argument. ADP can easily be "good" to their customers while still having shitty APIs. Hell, plenty of companies do this every day, why should we chastise ADP for running a business?
Furthermore, a profit-seeking corporation shouldn't really be on the moral scale to begin with. At best, they should be amoral, that is, not involved at all in morality. Their primary goal is, and should be, to earn more money, not to be good citizens of the world.
"At best, they should be amoral" companies are still run by people. So, your suggesting people should be amoral while at work, which is an unusual stance.
I would suggest it's much better for the laws and regulations to be setup so a profit seeking company would end up being a net benefit. But, suggesting company's should for example try and corrupt politicians in the name of profit seems rather dystopian.
Amoral != immoral. Amorality simply is the disconnection from morals, while immorality is doing something you know to be wrong. The people in charge would still be held by their own moral beliefs, but we should not be chastizing or congratulating companies for their moral contributions because, as an entity, their decisions should not be based on morals, but on profit.
You just contradicted yourself. If the CEO is unwilling to start a bio-weapons division duo to lack of profits or excessive risks etc then that's a amoral decision because morality did not come into play. However, if they decide it may be profitable, but it's immoral so there not willing to go there then the company was constrained by morality.
PS: It could even go the other way where a CEO feels it's his patriotic duty to aid his government so he wants to start a bio-weapons division. The point is not the choice the point is why it was made.
> Furthermore, a profit-seeking corporation shouldn't really be on the moral scale to begin with. At best, they should be amoral, that is, not involved at all in morality. Their primary goal is, and should be, to earn more money, not to be good citizens of the world.
You are very much mistaken. Society provides the corporation with legal protections and recourses as a fictive person with the understanding that the corporation's existence betters the society, betters the people within it. When this agreement is breached, the society can--though, unfortunately, rarely does, due to globally weird veneration of toxic behavior as "just business"--destroy it. (It has happened before. It should happen more often.)
And let's be really real for a sec: if you look at the stretch of history, neutrality is effectively tacit support for bad behavior. And from a practical perspective, a call for "amorality" is tacit support for immorality.
A public web app is an official API, thought primarily to be used by humans; but built using protocols such that it's possible to be used by programs on behalf of humans ..
You access HN by your browser, the same as Zenefits' customers accessed ADP services indirectly ..
The point is where to put the line between what's a good allowed access, and a bad too-much-indirection access
Ok, let's for the sake of argument grant you that a public web app is an official interface (I'm not saying API because it's not a "programming" interface). The implied contract is that humans will continue to be able to use the web app to access the functionality it's intended to provide. Anything in the HTML is an implementation detail, not part of the contract, and is subject to change at any time, so long as the contract (human usability) is still fulfilled. This is why web scraping is such a risky proposition: the structure of the page may change at any time without violating the implied contract of a human being able to use the web page.
The existence of a public interface usable by humans (a web app) does not in any way imply the existence of a machine-usable protocol for accessing that same functionality. If you infer one, you do so at your own risk. By the same token, the existence of a machine-usable interface that is not public does not imply a contract that it will continue to exist.
If you build your business on an imagined contract, be prepared to have a bad day when the other "party" to the non-contract "violates" it.
> The existence of a public interface usable by humans (a web app) does not in any way imply the existence of a machine-usable protocol for accessing that same functionality.
Is that non-implication better for consumers? For people?
If not, why should it exist?
Isn't that all the way around?
Machine-usable protocols is what make possible to humans use public interfaces (web apps)
When was the last time that you injected electricity to a cable to send a HTTP request?
How is that relevant? Putting up a web site does not obligate you to then do more just because it would be even better.
If it makes money, it's smart. If you're filling a need, then it's smart. Sure it's risky but anything you do has some measure of risk. It might even be worth it because it's risky and therefore less competition.
Exactly. If I found a third-party company that was having users create accounts on my systems for the purposes of pulling data out, I would block it too, probably more quickly than ADP did.
Imagine if a company asked for your Google password instead of using the proper API channels. I don't know many users who would do that.
This would be more like creating a new Google Apps email account for someone, and allowing them to use it to (e.g.) manage things on your Google Drive (by sharing a group folder with them).
How many companies hire a 3rd party accounting / HR firm (or person) to manage their bookkeeping? How many of them create an ADP admin account for these people so that they can manage payroll? How is this that much different than Zenefits?
This is exactly how most resellers on Google Apps are set up, actually.
Ironically, this is typical in the Google Apps reseller arena, where the reseller creates your domain for you under their Google account, and then also administer it using a superadmin account they create in your domain for that purpose.
The Google password scenario actually used to be a pretty common thing before Google built an API.
As someone who is a customer of ADP [we use them for payroll, etc, etc]
I'd go the Zenefits route too [and we do for our automation in relation to ADP precisely because ADP's API is insufficient]