The 404 Media Podcast (Premium Feed)
from 404 Media
Landlords Demand Your Workplace Logins to Scrape Paystubs
Episode Notes
/Transcript
YouTube version: https://youtu.be/OlzpAfucsyo
Hello, and welcome to the four zero four Media Podcast where we bring you unparalleled access in the world both online and IRL. Four zero four Media is a journalist founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co.
Joseph:I'm your host, Joseph, and with me are four zero four media cofounders, Sam Cole
Sam:Hello.
Joseph:Emmanuel Mayberg Hello. And Jason Kebler.
Jason:You sound clearer to me. You sound like you're coming in at high def.
Joseph:It's maybe because I'm standing up. I converted I have one of those converters where I can move the desk up if I want. Maybe now
Jason:Your windpipes are are different. They're not they're unconstricted.
Joseph:Exactly. Lungs, diaphragm, windpipe. It's I mean, I feel a lot better standing up. I spend so much time in front of this computer talking to all sorts of strange, unusual, fascinating people, but I'm usually cramped up in my chair for it. So, yeah, I think it's much better to be standing up now.
Joseph:Don't you have a standing desk, Jason?
Jason:Hi, dear. Should I stand? Are you standing?
Joseph:Yeah. Go for it. Well, Sam's gonna ask me
Jason:I'm gonna convert.
Sam:I will not be standing.
Emanuel:I'll be lying down.
Joseph:Sure. Well, Sam is gonna ask me the questions for this while Jason, for those that are watching on YouTube, can see his camera slowly moving up. Sam, do you wanna take the headline of this?
Sam:Yep. So the story headline is landlords demand tenants workplace logins to scrape their pay stubs. A lot happening in that headline and a lot of things to instantly get upset about in that headline, but we'll unpack it. I mean, I guess I'm curious if anybody else has ever had, like, a wild landlord experience. Like, if there's anything insane that landlords have had you do to get an apartment.
Sam:I mean, I feel like New York City landlords, it's, like, the most degrading experience in general.
Emanuel:The most expensive is what I was gonna say Yeah. That the poorest I've been was actually not when I was making the least money I've made, but when I was moving to an apartment in New York, and it's like, first security security deposit. I think it was also last, and then also the fee for the broker, and it's like The broker's
Jason:fees is like the fucking biggest scam out there, which I know they've tried to legislate away several times, but still exists as far as
Emanuel:we know. Every time you think it's gonna go away, and then they're like, psych, we're actually keeping it. But, yeah, that was like all our money. Me and my wife said it was all our money. I don't remember I don't know if Jason remembers, but there was like a month in the vice office where I was eating rice and beans, and that was because I literally had no money because I was moving.
Emanuel:And then also, I was gonna say like, first apartment I got, the most humiliating thing is I had to have my parents cosign because I was a child, and they're like, didn't trust me to pay the rent.
Joseph:I love how you're like, yes, the landlords or the brokers or whatever took all my money, so I had to eat rice and beans. And I'm like, that's just literally why I eat every single day.
Jason:Fair food. Yeah. I've I proudly have never had to pay a broker fee. Like, I always manage to somehow find one without. But I feel like if you're trying not to do a broker's fee in New York City, then you're very limited on, like, which places you can get.
Jason:My story is, like, I I haven't had any that crazy, but the, like, the situation in New York City with apartments is always that you go and you look at the apartment, and there's, like, the genre of apartment that's street easy disappointment where it's like, look. The pictures look nice, but they're all, like, taken from, like, point five zoom, and so they look a lot bigger than they actually are. And then it's, like, you know, in a weird basement with, like, weird lighting or something, or it's just, like, obviously going to be infested by rodents or something like that. But the situation in New York is, like, when you find a good apartment, you basically have to, like, commit to, one, living there, and then also, as Emmanuel said, giving, like, a ton of money kind of instantly. Like, I remember the longest that I've ever delegated or or deliberated on an apartment was, like, twenty minutes in New York.
Jason:Like, that's as long as you're allowed to, like, think about it. Otherwise, it's gone. And so when we moved into apartment in LA, like, I have a good rent controlled place here now. And when I was looking at this apartment, there was, like, 15 other people looking at it, and they were asking the broker, like, the person who was showing it things like, oh, like, are you gonna keep these cabinets? Or, like, does the refrigerator like, can you replace the refrigerator?
Jason:And I was like, there's no way. Like, you just you throw money at them immediately. And, like, we came with our application ready, like, checks ready because I had, like, learned from New York City. So just, like, immediately, there's no thinking. It's just like, we live here now.
Jason:Like, we're moving in right now. Like, here's all of our stuff.
Sam:Yeah. They don't even have to give you a fridge in LA, which is wild to me or a stove or any of that shit. It's very very crazy coming from New York where I think usually, if you see a fridge in an apartment, that's your fridge if you're viewing the apartment. I've definitely turned down apartments because of broker fees before because they didn't do anything. They didn't even unlock the apartment.
Sam:They were like, here's a lockbox. $900, please. So this story came to you, Joe, through a tip, which is how many of our best stories arise. What was the tip?
Joseph:Yeah. So, I mean, everything you just said, all of those, it totally sucks. But now landlords are being, like, even more invasive, it seems. Whereas before, maybe you just have to prove something about your income or show them, hey. I do have a full time job or even several part time jobs.
Joseph:I can pay the rent and you have to prove that. I got this tip that somebody in Georgia, they were a potential renter, a potential tenant, and they tried to rent an apartment and it was one of the most invasive things I believe they've seen and I've definitely heard about, which is that they were basically forced to hand over the login credentials, not for their own bank account, which you might do, you connect it with Plaid or whatever it's called, you can verify your income that way. They were told to you have to hand over the login credentials for your employer's sort of Workday instance, and Workday is this horrible tool. We're all very, very familiar with having to having worked at Vice. We don't have Workday for a full media.
Joseph:We don't have Concord. We don't have any of these big corporate tools. But they had to hand over those login details and these various companies and tools that we'll about in a minute, they just would scrape their pay stubs en masse. Even though to get the apartment, they were told, oh, you just need to show I think it was two months or something for pay stubs if you're being paid every two weeks or whatever it is. Right?
Joseph:The tip was these tools are scraping way, way more information than is actually required to get the apartment. The person doesn't really know what happens with that data, and they sent me a bunch of screenshots to prove it as well.
Sam:Yeah. The amount of, like, software as a service involved in getting an apartment is also increasing and egregious. So this the the software we're talking about here is called ApproveShield. What does ApproveShield actually do?
Joseph:Yeah. So ApproveShield is the first part, and they're basically like a tenant screening service. And I'm looking at their website now, and, of course, it's marketed to landlords. The idea is that you outsource verification of your potential tenants to us and we'll use various pieces of technology or whatever to do that. And ApproveShield says it can, again, just reading the website now, dramatically reduce eviction rates, transform tenant profiles within a year, which I presume means you change the sort of people renting your apartment.
Joseph:You don't change the profile of the person exactly. You reduce bad debt and delinquency, all of these sorts of promises. I almost I almost see it kind of like these anti fraud companies, almost like a KYC company as well, know your customer, but it's really for landlords who are trying to figure out who is this person who's trying to rent in my building or my apartment. Do they have enough money? And, you know, frankly, do I want them to be renting from me?
Joseph:And I'm definitely gonna look into these companies more. There there is a bunch more. Approved Shield is not unique whatsoever, but that's just the one that this tipster happened to be told, hey, you wanna rent this apartment in Georgia, you you have to you have to go through these steps.
Sam:Yeah. So what happened when they actually did go through the Approved Shield process?
Joseph:Yeah. So they go through it, and this little widget is how they described it. It starts to use another tool another tool called Argyle, and we'll talk about them in a minute. But Argyle, a r g y l e, the tipster said they watched Argyle hijack their workday session. Again, they they had to provide the login details for their employees' workday.
Joseph:It stayed hidden from view, and then it downloaded every pay stub plus all of their w fours back to 2024. They know this because in their email, they kept getting these notifications from Workday saying, hey, your pay stub from x y z date is ready to be printed. And, you know, when you export data out of Workday, you have to maybe wait a little bit or something like that. Same with Google Takeout. You get a little email notification telling you it's ready.
Joseph:And I saw this screenshot and there's like 14 at least 14 notifications there. Obviously, that is way, way more than the four pay stubs necessary to actually rent this apartment. Then they or their employer went through Workday audit logs as well, and they found that it was from two IP addresses that are not theirs, obviously, and also from a MAC address. And a MAC address is just, you know, a unique identifier for a device on a network. You can cycle MAC addresses.
Joseph:Sometimes iPhones do that as far as I know. But basically, the takeaway was he'd given these login details to Approve Shield because his landlord said he had to. Then this other company he's never heard of mass downloads all of his data in, you know, a pretty sketchy way. This is something you would usually associate with some sort of mass web scraper or something, but it went in and it it downloaded all of this data. So then they they contacted me.
Sam:Very crazy. I would be freaking out if Workday was just, like, downloading pay stubs through the years without my permission.
Joseph:Well, it looks like you've been hacked.
Sam:What is going on? Yeah. Exactly.
Emanuel:Right.
Sam:Yeah. I would be I would be panicking. Do we know of any other companies that are, like, doing something along the same lines? I'm scared to even ask Yeah. Or no to answer to that because I'm sure the answer is yes.
Joseph:Yeah. There's a few more. There's one called pay score, which someone else actually contacted me about, and I need to follow-up with them and look into what they showed me. There's Nova Credit, which judging by the name and my cursory look of the website and I'll look more into them, they're not just about tenant approval. And their leadership actually includes a cofounder of Argyle as well, so there's a connection there.
Joseph:And then another one called Snapped, with a t, not an e d, also use uses Argyle. So clearly, you have all of these different tenant screening companies selling their services to landlords or buildings or whatever. Then Argyle, which is the actual company in the tool doing this pretty unusual sketchy scraping, is working with a bunch of them. Well, you know, at least two of them, it seems, if if not more. Yeah.
Jason:Joseph, is Argyle different than Plaid? It's so weird that they are both clothing related companies that seemingly do very similar things.
Joseph:Yeah. That's a fair point. I think that Argyle would say, hey. We're no different from Plaid. And Plaid, for those who don't know, is basically, you know, an API and a tool for linking up lots of different payment systems at once.
Joseph:So let's say, I don't know, you use an accounting firm and they need to look at all of your different accounts. I think you can do it like that. I've I've used it to link up various different accounts before as well. So Argyle, I think, would say, hey, we're no different to them. What does make them a little bit different and I'll answer this question now since Jason brought it up.
Joseph:Argyle has done some pretty unusual stuff or is connected to some pretty unusual stuff. So I actually covered Argyle several years ago back when we were all motherboards, the tech section of Vice. And for that, there were all of these very weird phishing pages going around where they would send emails to people or there'd just be web pages. And they would say, hey, are you an employee of JPMorgan? Give us your Workday login details and we'll give you a $100 because we're trying to democratize financial data.
Joseph:I think there was also stuff around gig workers as well. And it was an organization called Workers Unite, very progressive, labor focused, lefty branding. A bunch of security researchers that I spoke to at the time found this very odd and I then went in as well and analyzed some of the web traffic and you could see that there were connections between Workers Unite's website and argyle.com, if I'm remembering correctly. And so what the hell is this financial company which was a startup? Why are they connected to this?
Joseph:They never responded. When I started to write about it and security researchers found out about it, the site suddenly went offline. So was Argyle running it and harvesting data? Was it one of their clients? I don't know.
Joseph:But they were really strongly connected to that sort of thing. If anyone knows Plaids doing something like that, let me know. Or if you know about another Argyle sort of operation connected to that doing similar, let let me know. But that was really unusual. They were straight up phishing pages, and I hadn't seen Plaid or any of the other companies do that.
Joseph:And that's why I was interested in this in the first place.
Sam:It's insane. I wonder if a lot of this is also these things are effective because people are just so used to having to, like, connect your accounts to do, like, literally anything online. It's like earlier today, I was, like, trying to connect to, like, a an app that compares Uber and Lyft prices, and it wanted me to connect my Uber login and my Lyft login. I was like, why the fuck do you need that? You that's information that is publicly available if you don't need have a login, but, like, they benefit from getting your your data that way.
Sam:So I wonder if people are just, like, used to, I don't know, their privacy being invaded basically constantly. I mean, ideally, these apps are not doing things without users consent when they connect that way, but, you know, there are, like, privacy gateways that are involved. But I don't know. It's why something like this is successful, I would think, or part of why.
Joseph:Yeah. I mean, once you give over those login details, you don't necessarily I mean, you don't. You don't know what Argyle or ApproveShield is going to do with them. Are they gonna log in once and just scrape all the data one time? They're already scraping more data than is necessary by the landlord.
Joseph:Handing over those creds could create all sorts of problems for you.
Sam:Crazy. So are there, like I mean, this sounds it sounds illegal to me, but, like and it sounds like it could also be something that could get people into legal trouble in both directions. What are the kind of the legal implications around something like this?
Joseph:Yeah. When I covered Argyle way back with those phishing pages, we included a couple of paragraphs that this sure looks like it could violate US hacking law, which is the computer fraud and abuse act, the CFAA, and very broadly, generally speaking, you can't share login credentials that you do not have authorization to to share, basically. So let's say it's your own Facebook profile and maybe you give your login creds to your partner or something because you wanna be locked out of your Facebook profile, seems pretty unlikely that anyone would prosecute that. Of course, there's two things. Is is it a crime, and is it a crime that anyone's gonna prosecute?
Joseph:I don't really think people super care about that. Now if you are an employer, and we'll just use Vice as the example, when we were back at Vice and we were logging into Workday, that contains all of this information, not just about us, but about the company as well. Right? There's org charts in there, all this corporate information. If any one of us took those credentials and then basically gave them to another company, I mean, at the minimum, you're gonna get yelled at.
Joseph:Maybe you're gonna get fired because that's just, like, a serious security concern. And also, potentially, there's a legal issue there as well. And, of course, I mean, since Argyle exists, I'll give them the slight benefit of the doubt and that they have probably got lawyers who said this is okay. But, you know, they've never responded to my request for comment, so I don't know. I would love to hear their argument on this if they're able to provide it.
Joseph:But if I'm Argyle and I'm using those login details to go into a workday, the vice or whoever the employer has has not given me authorization to do. Maybe Argyle is committing a crime there as well. So, yeah, there's there's this legal stuff, But really, I'm kinda worried about the workers that you give over your details, your security team is like, what the fuck is this? And what is this system logging into our workday? Yeah, that could cause real, real issues for it.
Joseph:To be clear, I haven't heard that happening, but the response to this article has been well, people are pissed because it's got landlords in there. It's got hacking in there. It's got a weird startup doing phishing pages as well or being connected to phishing pages as well. It's nuts all around.
Sam:Yeah. It's got a little something horrifying for everybody, which is a classic four four media blog. Yeah. Anything else on Argyle? I guess if you're Argyle, please hit up Joseph.
Sam:If you have gotten in trouble because of Argyle, please hit up Joseph. But, yeah, anything else to add on this, or should we move to the next horrifying story from April?
Joseph:Yeah. Nothing nothing to add. Plenty more horrors to come after the break when we're gonna talk about how lawyers well, rather, lawyers are now admitting it and saying why they've been using AI after they've been caught. We'll be right back after this. Alright.
Joseph:And we are back. I'll take the questions this time. Jason, this is one you wrote, I believe, with Jules as well. And the headline is 18 lawyers caught using AI explain why they did it. You and Sam as well have been all over lawyers, judges in some cases as well, using AI in lots of different ways.
Joseph:It seems to be maybe crisis is too strong, but it keeps coming up in the legal profession. Hold off the reasons from these 18 lawyers, first of all, but just what are lawyers actually using AI for? Is it writing briefs? Or like, what are they actually using it for, first of
Jason:Yeah. So I think we've talked about this at some point on the podcast. Sam has definitely written about this a few times. But back in, like, 2018, I wrote an article about how AI was going to revolutionize the legal profession, which is just to say that was eight years ago, like, eight years ago. And for a very long time, it's like everyone in law keeps sort of saying, like, LLMs are going to fundamentally change the job.
Jason:And the job, of course, like most of the job of a lawyer is researching and writing. You know, very little lawyering is actually like going to trial and arguing in front of a judge. It's a lot of writing briefs. It's a lot of researching arguments, things like that. If you're watching on YouTube, my camera keeps overheating.
Joseph:I just saw that in the show.
Jason:That. Yeah. It's very hot out here. So sorry about that, but I will be I will be back on. There I am.
Jason:So, I mean, there there's an entire industry or part of the industry that's paralegals, that's legal assistants, that are interns, people who are whose entire job is to research precedent and other cases and things like that. And AI sort of promises to do all of that for you. And, like, the entire currency of law firms is, like, billable hours. So it's, like, how long are you spending on any given thing? And so, like, nominally, if you can replace a lot of this work with AI, you can, like, maybe charge the same.
Jason:I mean, I've talked to a lot of lawyers, and so it's it's, like, really a big ethical question. It's like, are you charging people the same amount of money even if you're using AI? But then you also have, like, clients who are saying, why are you charging me so much money for all this research time? Like, just use AI to to find the case that you're citing, things like that. So it's a mix.
Jason:Like, lawyers are using it to do their research, but then they're also using it to write the briefs, and that is like the actual legal arguments that end up getting filed in court. And so what has happened is judges keep finding lawyers who have written briefs where they cite cases that don't exist, where they're basically just, like, hallucinating precedent, hallucinating laws, like, citing laws that don't exist, things like that. I don't know if I mentioned this ever, but I actually, like, had a landlord beef with my own apartment. But I needed to, like, file something. And so for the first really, this is the first time I ever tried to use ChatGPT, but I asked it to write me, like, a legal brief to, like, fight with the landlord.
Jason:And I got something back that looked like a legal letter, and I then cited like, I checked the citations that it it said, and almost none of them were real. And when they were real, they were referring to they were referring to real laws, but they were not, like, interpreting that law correctly. Like, they they were referring to real laws, but then they were saying that it said something, like, totally incorrect. So, anyways, a lot of lawyers have been doing this over the last few years, and there's a database now of lawyers who've been caught doing this, and it's over 400 worldwide. It's not just The US problem, but the vast majority of them have been in The US.
Joseph:And you presumably, you're in this database as well considering you just admitted that you used
Jason:I I never filed that. I never used anything.
Joseph:Oh, okay. Okay. Yeah. You you proofread it, and you were like, wow. This is complete garbage.
Joseph:I'm not even gonna
Jason:And I threw it in the trash. Yeah.
Joseph:Right. Okay. So there's this database which you referenced. I believe it's linked to in the story as well. Why was this useful?
Joseph:Because it it contains all these cases where lawyers have been caught, and if that and then what did you do after that?
Jason:Yeah. So the researcher's named Damian Charlatan. He's in Europe. I I forget exactly where, but I I spoke to him before doing this story. And he has been documenting all of the cases where a judge judge has basically been like, hey.
Jason:You used AI. You should not have used AI. You cited a case that didn't exist. And he has a really awesome database that sort of, like, explains what happened in each of these cases. But what Damian does is he summarizes, like, what the AI use was, and he pulls, like, one document from each of those court cases.
Jason:But what he doesn't do, and I understand why, is he doesn't pull the documents where the lawyers are forced to apologize and explain why they used AI because, basically, in each case, the judge is like, you filed a nonsense brief that, you know, hallucinated AI. Like, why did you do that? You have to correct it. You have to apologize. You have to sort of, like, say why you shouldn't be sanctioned, which means either, you know, you could be disbarred in some cases.
Jason:I don't think lawyers have been disbarred yet, but some have been suspended. Some have had fines, things like that. And so I went in and Jules. We sort of split them up, and we tried to find the document where the lawyers apologized and explained, like, why they used AI. And I thought that that was really eye opening because there has been quite a lot of reporting about the fact that lawyers are using AI, but not a lot about, like, the underlying impulses as to, like, why they're doing it.
Joseph:Yeah. And their reasons for doing it, which we'll go into next, are different from what they're using it for. You know what I mean? Like, what they're using it for, as you said, is writing briefs or doing research or apparently lighting their careers on fire when the AI fabricates case law or whatever. So what are what are some of these reasons?
Joseph:Because I was kind of surprised at how varied a lot. It's not as simple as, I don't know, I didn't feel like doing it. Like, there's a lot of actual different reasons going on here.
Jason:Yeah. I mean, I guess to summarize, it's like the reasons are almost uniformly very bad. Like, the vibe is like the dog ate my homework almost, like, entirely. Like, they all not all, but the vast majority of them try to come up with some really extenuating circumstances for why they used AI. Some of them said that they weren't they didn't know that AI could hallucinate.
Jason:Like, they were unclear that that this was even possible. Like, a lot of them sort of explain themselves to be not technical or, like, they've never like, they they thought that ChatGPT was doing something different than it actually was. A lot of them use LexisNexis products or Westlaw products, which are they are legal products. And so they're marketed to lawyers. And nominally, they're supposed to be, like, pretty good at not hallucinating, but in some cases, they do.
Jason:And then a lot of
Joseph:Sorry. Just on that. So the LexisNexis product, the legal product, that might have ChatGPT or some sort of AI integrated in it as well? Is is that what they're saying?
Jason:So LexisNexis well, it's not Nexus. It's like Lexis is a gigantic database company that has a bunch of different products for researchers, including some for lawyers. And they have several different legal products, and some of them are legal research tool products, and they have begun incorporating AI into those products. Westlaw, similarly, is a huge database that I believe is made by Thomson Reuters, like, just massive, massive company. And these these are, like, really, really expensive pieces of software.
Jason:And over the last few years, they have begun integrating AI and LLMs into their products. And so, you know, I can't speak specifically to these two products because I haven't used them, although I've talked to lawyers who use them. But they've started integrating like, hey. Use our products to do your research. I think they may have started saying, like, use these to help write your briefs.
Jason:Although, maybe we haven't gotten that far with Lexis and Westlaw. But there's definitely, like, a lot of software companies that are, like, heavily marketing their products to lawyers and saying, like, we use a bespoke AI that won't hallucinate or we use this bespoke AI that will, like, help you write the perfect brief, like, really quickly. So in some cases, have lawyers who are using ChatGPT. In some cases, you have them using Microsoft Copilot. There was one who used Grock, RIP to that guy.
Joseph:That's a good one. Yeah. You gotta fire your lawyer if they're using Grok.
Jason:If they're using Grok, yeah, it's not a good situation. That person was fined a lot of money, the one that used Grok. One person
Sam:hot anime girl Grock, or was it like
Jason:Yeah. Exactly. The Uruguay. Yeah. Was one that was also using Grammarly, which is like a grammar, you know Sure.
Jason:Tool that has started including AI stuff in it, I guess. And it's like, I don't know. If your lawyer is like using Grammarly to write their their briefs, Prabh should get a better lawyer.
Joseph:Yeah.
Jason:But anyways, the the the excuses that they make are all over the place. Like, one person said that they were suffering from vertigo. That was my favorite one.
Joseph:Well, head colds and malware as well.
Jason:Yes. So he apologized for his failure to identify the errors in his affirmation, but partly blames, quote, a serious health challenge since the beginning of this year, which has proven very persistent, which most of the time leaves me internally cold and unable to maintain a steady body temperature, which caused me to be dizzy and experience bouts of vertigo and confusion. The lawyer then goes on to say that he was, quote, affected by malware and unauthorized remote access. And so he blames both Vertigo and the fact that he was hacked.
Joseph:I I was I was with them up until the malware bit. Like, we're not gonna mock anybody's, like, legitimate medical condition. I have no idea whether it's real or not.
Jason:But I mean, I'm not mocking their medical condition, but having a medical condition doesn't mean
Joseph:You have to use AI. You
Jason:have to use AI.
Emanuel:I feel like, overall, you're being very generous to, like, the general tone of these. I read this. I I edited this piece before we published, and I was really laughing, like, actually laughing at the reasons. There's, like, only two categories of excuses, and it's like, one of them is apologies, your honor, I'm a moron. You know what I mean?
Emanuel:It's just like, I don't understand AI or I'm stupid, and I just like, I'm really, really sorry I fucked up. Like, that's literally, like
Jason:That's on your knees. Them.
Emanuel:Yeah. Apologizing. And then the other one is not better. It's just people throwing their paralegals and assistants under the bus. Like, literally just saying it's like, my assistant did it.
Emanuel:What a moron. And that's entirely unfair, and it's like still your responsibility. And like, don't you need to read the briefs before you file them? Don't you need to read like the the court documents you're you're presenting to a judge? The only thing I'll give them, and I think the thing it says about generative AI more generally, is some people are like, hey, man, it's like this was advertised as a thing that I can use, so I trusted that I can use it, and it turns out I can't.
Emanuel:And it's like, that's definitely not good enough, and you still have to read the stuff that you generate and make sure it's accurate, but I think it does say something about how generative AI is advertised and used. And we report about how bad it is all the time, but this is like a great reminder that some people are just taking that advertising for its word and using it and not even thinking that something could go wrong because, like, why would OpenAI, this gigantic company run by these geniuses, make tools that don't work and make up case law? It's like a lot of people don't know that.
Jason:And to be fair, like, I'm gonna do more articles on this. I was trying to, like, put it all in one article, but it was impossible. But one of the lawyers that was caught was forced to go to, like, an AI class with the Texas State Bar, and I was able to get a copy of the class that they had to go to. And that class is just like five AI companies being like, use our AI. Like, it's it is they are getting heavily marketed too.
Jason:And even since I published this, you know, this morning as we're recording this, lawyers have been forwarding me the, like, marketing emails that they're getting from not just, like, AI companies, but from, like, legal organization like, continuing education organizations within the law profession being like, you wanna be more efficient? Like, use AI. Another thing is, like, five different people blame Internet outages or, like, IT problems. And they're like, we are checking with IT at the office to see how this could have possibly happened. So, yeah, it I mean, it it really is, like, wasn't my fault, your honor, like, pass the buck situation in in There are criminals
Emanuel:at my computer.
Jason:Yeah. And then the other really notable one was someone who claimed that they created that they filed it as a, quote, legal experiment.
Joseph:Oh, right.
Jason:I'm testing you. Yeah. Yeah. Exactly. Exactly.
Jason:So, yeah, it it was a fun piece to do. It took forever. This took so long to do. Like, it took us months to put this together, like, off and on. And not because it was difficult, but because our court system is so fucked up that, like, finding the correct document to pull in any given case took a lot of things a lot of time.
Jason:And then a lot of them were at, like, state court. And so it's not just navigating PACER, which is like the expensive, shitty US federal court system records that is bad, but I at least know how to use. It's like figuring out, like, Michigan's system. It's like basically every little quote in here was, like, the fifteenth click on the worst website that you've ever used. And so that's why it took, like, a long time to put together.
Jason:But it it was very eye opening for me, I think, because in a lot of cases, like, straight up, these lawyers are just like, I don't know what I'm doing. Like, I am a giant dumbass. That's why I did this.
Joseph:Well, you answered what was gonna be my last question, which is like, do any take responsibility? And as Emmanuel said, a lot there's a lot of throwing under the bus, but it sounds like some of them just throw their hands up and be like, yeah. Whatever. I just want to ask, well, what has the reception reception been been like? You said more lawyers now send you this marketing material.
Joseph:Are you getting, like, even more emails from from lawyers who either their their coworkers done this or maybe they've done it themselves? Or, like, what's the reaction been?
Jason:Yeah. I mean, people have said it's interesting. Think, unfortunately, I was hoping that more lawyers would reach out with, like a lot of lawyers are like, I wanna talk to you on the phone, which is good and helpful, except it's hard when, like, 30 different people they're like, we should talk, but I won't tell you what about.
Joseph:Classic lawyer.
Jason:Classic lawyer. They're like, let's get on the phone, but, like, I can't tell you any details about what it what it is. But they're
Sam:gonna bill you after.
Jason:Exactly. And so, I mean, there there will be more to come, but, like, when I wrote about teachers using AI, a lot of them, like, follow-up with very well written, very honest and open, like, communications about AI in schools. Whereas, like, a lot of these lawyers, I wanna talk to you, but, like, let's let's do a briefing first. And so we'll see we'll see how this goes. But, yeah, if you're a lawyer, if you if you, like, are a paralegal, if you work in big law, like, if if you are being pushed AI or have used AI or have been asked to use AI, I would love to hear from you.
Jason:My signal is Jason dot four zero four. Email is jason@404media.co.
Joseph:Yeah. I definitely would be curious if there are more people who say, well, I used it, not from the advertising, but because we're being told by our law like, leadership, our law firm or something like that we're seeing in other companies or something like that. Really, really fascinating piece. People should go read really the full thing and go through and see some of the responses. We'll leave that there.
Joseph:If you're listening to the free version of the podcast, I'll now play us out. But if you are a paying four zero four media subscriber, we're going to talk about all of the drama surrounding the ruby programming ecosystem and why it's actually, you know, really, really important for the Internet, the web, and everything on it essentially, you can subscribe and gain access to that content at 404media.co. We'll be right back after this. Alright. We're back in the subscribers only section.
Joseph:Emmanuel, the headline, which is excellent. Usually, we have to, you know, figure out the headline. There'll be one that we start with, and then we'll get the vibe, and then we'll have three or four options. This is the one you put in the Google Doc, and the first comment I I did when I edited it was, great headline. That's it.
Joseph:And it is how Ruby went off the rails. Obviously, Ruby on rails, blah blah blah. Okay. So this is incredibly complicated. I'm not even sure where to even start, but I thought, how about before we get into specifics of the drama, the episodes, and even sort of who's involved, how about you give us the nut as in, like, why it matters up top so people can understand why we covered this?
Joseph:Like, what is important and what does this show us about the Internet? And then we'll get into the specifics.
Emanuel:We cover this because I'm a messy bitch who loves drama, but the actual answer is that the project that we're talking about is a couple of very popular tools in the Ruby ecosystem, Ruby being a programming language, that at this point are so widely used that a lot of really big companies rely on them very heavily. Two of them are Shopify, like the e commerce site that four four Media uses as well for its merch. And then another one is is funnily enough, is GitHub, which is a part of the story because that's the thing that developers use work to on projects, but GitHub also itself uses Ruby, and there's been a lot of chaos in this community and around the people who control upkeep and manage these tools. And so far, everything has gone smoothly, and there hasn't been any disturbance their service, but if there was, that at best can be very chaotic to like large parts of the internet, and worse can be like a security disaster were these tools to be compromised in some fashion. So it's like a lot of drama and a lot of personalities, but the reason it's important is because those personalities, this drama controls critical Internet infrastructure.
Joseph:Yes. That makes complete sense. And I've also learned I only learned this in the past couple of years maybe. I fucking love drama as well. Don't don't really need to know anything about it.
Joseph:There was some sort of drama with, I don't know, the knitting community, and then they went against Hank Green. I was like, oh, man. I was lapping up. I love that stuff. So I really enjoyed editing this as well.
Joseph:Can you define and just tell us about some of the parties involved here? This is very, again, very complicated. I won't even blame you if you just read from the article, but who is involved here? And then what happened with people getting locked out?
Emanuel:Yeah. So very technical. Forgive me if I get this wrong. I believe I got it wrong in the I got it right in the article, and people who are very very deep into the Ruby community were happy with it, so refer to that for the most accurate information. But let's talk first of all about, like, the landscape of Ruby as a language.
Emanuel:So there is this thing called rubygems.org, and basically, that allows you like, let's say you're working on a Ruby project, you can download different discrete modules built in Ruby and plug them into your Ruby project. So let's say you need like an RSS reader in your project, there is a gem that's one of these discrete units of code that you can download and plug in. And that's just useful thing for developers to have all these different modules that they could download and add to their projects.
Joseph:It also happens in Python. Python, you have PIP, and you'll do PIP install, whatever, and that'll grab this bundle of code so you don't have to, you know, make everything from scratch, basically. Yeah. I'm not familiar with Ruby, but the Ruby gems is basically the equivalent of that. Yeah.
Emanuel:And because Ruby is kind of a twee in its name, they they call them they call them gems. The the the issue with that is that there's all these different gems floating around, and they all work differently, and they have different teams developing them, and they get updated at different times, and then they might not necessarily not all versions are going to play well with all other versions. So there's like this big compatibility issue for which some people created a tool called Bundler, which basically automates and manages all of that. So you're working on a project, you want this gem and that gem and that gem, Bundler will pull the correct versions that play well with each other. And that's like, so those are two different tools that are obviously working in concert and are very important to the ecosystem of Ruby development.
Emanuel:The drama that we're talking about today is basically the group of open source developers who maintain both of these tools and a bunch of others, but like mainly these are like the really important ones. On September 19, they discovered that they were booted as contributors, and like, we don't need to get into the terminology of GitHub and who has what permissions, but all their permissions essentially were revoked, and they were no longer able to contribute, control, manage the project.
Joseph:Yeah. They they weren't able to access the GitHubs that holds the Ruby code base, and, you know, many of these people have been contributing to this open source project for years and years and years. And suddenly, it's like somebody's changed the locks on the doors Yes. And and they can't get in. So why do they why do the people who were locked out think they were locked out?
Emanuel:Yeah. So, again, this goes back a long time. Many years ago, Bundler and Gems, these two important tools that we talked about, they were separate projects. There were developers who contributed to both. There was a lot of overlap.
Emanuel:They had to work together a lot, but they were different projects. And the guy who ended up controlling, maintaining bundler named Andre Arco had an organization called Ruby Together, which controlled that code and raised funds to kind of pay developers to work on it. And separately, there was another organization called Ruby Central, which managed Ruby gems and then also a bunch of Ruby related conferences because there was a lot of overlap, because the funding for these different tools, like, benefited both projects. In 2022, they merged and became one entity. Basically, Ruby Central subsumed Ruby together and became the, like, the funder and manager of these projects.
Emanuel:The people who were kicked out believe that they were kicked out because Ruby Central, this organization, is under pressure from big companies that rely on these tools, namely Shopify, to exert more control over the code because of various reasons, but like petty reasons, such as these people don't like Andre. They have personality conflicts with Andre, they don't like how he manages the team despite his contributions, they think he's difficult to work with, they think he's unreliable, maybe they think that it's like not good for security to have him around, they think that the other maintainers are kind of, you know, socially connected to him and will do whatever he says, and they're just like, let's get rid of all of them at the request of Shopify. That's kind of their accusation of what happened.
Joseph:Yeah. So that's what the people who are locked out, that's what they think about the reason why. And what about Ruby Central itself? Or I guess it's not as simplistic as just one side versus the other. Is really messy and there's people in between.
Joseph:It's very much a spectrum. But for lack of a better way of putting it, what does the other side think? What what's the argument from Ruby Central about, well, this is why we had to do this?
Emanuel:Yeah. So I forgot if it was this year or last year, but Jason did a couple of stories about open source supply chain attacks, which is exploiting the very nature of the thing I was just describing, where there are these open source projects that a lot of the internet relies on, they're open source, so they're community run, and there have been cases where people, probably state actors, were able to insert themselves into that community as maintainers, and then insert malicious code that could be distributed very, very widely. And this has been a growing concern. Think, Joe, when you edited this, you flagged to me that there was a recent pretty bad supply chain attack on a tool called NPM, which is critical to the JavaScript ecosystem, and basically, Ruby Central, their case is, hey, we know this is an open source community project, we know that people have been working on this for a very long time, but this is like really serious internet infrastructure now. We have very big important clients with many users who rely on this, and also we are legally liable now for what happens with these tools, so we need to clean it up and make sure that we have the correct governance, meaning like how do we decide to make changes here to the code, and then also operating agreements, meaning contracts between Ruby Central, which claims it owns this stuff, and the people who contributing about like why they're able to contribute and at what capacity and what they're allowed to do, and yada yada yada.
Emanuel:And they were just like, we need to professionalize and clean up this thing that was, you know, over the years, and the community thing grew and grew and grew, and and now it's too serious to to keep going as it was going.
Joseph:Yeah. And maybe just to have fewer accounts with access to the code base that could potentially introduce something. I mean, almost putting aside who is behind each of those accounts. It's just like, if you have 15 accounts and you reduce it to five, you have reduced the attack surface
Emanuel:on that place. They don't bring up the number, but they do if you read their communications about this, they say that they did an audit, and they were like, wait, like, who are these people? Like, we haven't, like, verified or, like, we don't necessarily feel super good about, like, this person or that person having access. And and and their description of events, it's like cut everyone out, and then slowly bring them back in. Like a lot of the people who are most upset about being kicked out, Ruby Central maintains that they will regain access and be able to contribute as they were prior to this happening.
Joseph:Yeah. The attack the the the broad supply chain attacks are not just package managers, but individual packages as well. Like, that legit has kept me up at night where especially if you're trying to build something and you just grab this bundle of code and you you assume, and, you know, this is going back maybe a few years, you would always assume, well, it's safe. You know, it's coming from a validated repository. So many people install this or whatever.
Joseph:And then, you know, three, four, maybe five years ago, hackers started to target them. They would spearfish an individual developer, get access to some sort of Python package, push an update that way. And I agree with you that some of these are gonna be nation state. I think some of them definitely aren't as well. They're just like, let's find something that's, really popular and gets me a foothold in a ton of different, systems.
Joseph:I think some of them have just ended up being like crypto miners and stuff, which if you have that amount of access and you use it on a crypto miner, mean, I you're a fucking idiot because, like, you're you're hacking a bunch of computers which might not have a a fifty eighty graphics card or whatever. You know, mining isn't really where you're gonna make money as a cybercriminal anymore. But it's scary because it's not the same as, like, downloading an app from the App Store or downloading a validated piece of software. And maybe you've checked the hash sums, which sometimes I do that where you you make sure the package hasn't been manipulated. It's more you just type pip install whatever, npm install whatever, and you're putting this piece of code on your your system that you really don't know what's going on there.
Joseph:I know. It's scary. I can see the security arguments, so I'm trying say.
Emanuel:Absolutely. And I think I mean, what you're describing is basically how valuable the access to these GitHub repositories is, like the ability to to to to change them is. And it's mind blowing, and it's like one reason I wanted to write the story is, it's like when you think about security, they're like, don't open emails for random people, don't download apps from don't sideload them into your iPhone, just like don't work with like these random people on the Internet. It's like, okay, but then when you think about it, Shopify is like a big established company, surely they are secure, and it's like, cool, that seems to be the case, but if you really dig down, like a lot of the tech, even from the big companies, like whatever, like Microsoft, Apple, it's like at the very, very bottom of it, you're looking at open source projects that are maintained by like individual people. Sometimes they're paid by big companies, sometimes big companies like sponsor their time to work on the open source development of this stuff, but it's like the governance of the thing and deciding who gets to change the code, it's just dudes on the Internet, right?
Jason:And I mean, and often often, it's not just like often, the companies will then take open source developers, hire them, bring them in house, and then tell them what to work on. Like, it just it gets really it gets really complicated.
Emanuel:Yeah. And that's that's part of the that's part of the argument that people who are, like, mad about this decision, that's what they think is happening. They think that this community project became too important to Shopify for it to be community run, and they want to manage it, right? It's like they want to prioritize what gets developed, right, especially since they're sponsoring development, right? It's like my understanding of how Ruby Central gets funding at this point is that Shopify foots the bill.
Emanuel:They give them like hundreds of thousands of dollars to both like manage Ruby Central itself, pay advisors, the board, I think the board is voluntary actually, but like the development time, they're paying for it. So they're like, we're paying for it, we're relying on it, it's very important to us, we want to decide what happens here, and that's obviously like a slap in the face to the open source community, which is built entirely on the premise where it's like things are done by consensus or by democratic vote and it's community run, and it's like, this is the process to produce the tool that Shopify loves so much and thinks is so important, you know? So there's just this inherent conflict between open source development where money is not supposed to be like a big factor and not becoming so productive and so valuable that big money interest comes in and then wants to have influence. And that's just like, I think, like a fascinating thing about how the Internet works, and then, you know, you get a few personalities in the mix, and it it gets incredibly messy.
Joseph:Yeah. I think that's a great place to leave it. If anybody else knows about any more open source dramas.
Emanuel:Dude, people are telling me. Yeah. It's so funny. I just have to say one thing. Yeah.
Emanuel:A childhood friend of mine, most of his career has been Ruby on Rails development, so he was I was constantly, like, talking to him, checking stuff with him, and he was very invested. And at some point, he told me, you know, just just so you know, it's like Ruby drama is nothing. It's like Scala drama. Scala is the best drama and programming. I'm like, okay.
Emanuel:Scala, just get at me. Tell me what's happening. Please.
Jason:Can can I just say that I didn't I didn't read this article until it went on the Internet because I was traveling. It's so complicated. Like, this is a very good reporting manual. Like, very good. Very you got a lot of detail in there.
Jason:And I somehow was able to understand it, but I was like, there are many layers. There's a lot going on here. So so good job on this.
Joseph:Yeah. I I couldn't have written this. And when I was editing it, I was shocked at like, oh, yeah. I know. There's just a lot of names.
Joseph:But then once you read them, you're like, okay. I I understand what's happening, why, and why it's important. So people should definitely go check that out. And, of course, the link is in the show notes. And with that, I'm gonna play us out.
Joseph:As a reminder, four zero four Media is journalist founded and supported by subscribers. If you do wish to subscribe to four zero four Media and directly support our work, please go to 404media.co. You'll get unlimited access to our articles and an ad free version of this podcast. You'll also get to listen to the subscribers only section where we talk about a bonus story each week. This podcast is made in partnership with Kaleidoscope.
Joseph:Another way to support us is by leaving a five star rating and review for the podcast. Here is one of those. Some of the best in the game. This pod is the purest nourishment for this hungry brain. It's that simple.
Joseph:That is all. And then there's two brain emojis and the word feed me. That's from Rabble Rising RSA, zed a. Thank you so much. We'll see you again next week.