10 ms·

Automattic Hit with Class Action over WP Engine Dispute

129 points by rpgbr 2y ago

tyzoid 2y ago
I'm not a lawyer, but the legal claim made appears to me to be on shaky ground. In my understanding, there has to be actual damages arising out of an action. "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked.
- ordx 2y ago
  I imagine it would be sufficient to show that he had to spend time or money analyzing the security impact of the event.
- lesuorac 2y ago
  Why aren't costs involved with a mitigation actual damages? I'n not sure this is the correct lawsuit to demonstrate this. So hypothetically, if say you lent a key to a handyman and then they posted a photo on it to twitter it seems pretty reasonable for them to cover the costs of replacing the locks. As opposed to having to wait for somebody to rob you and then trying to show that the robber did so from the photo.
  - that_guy_iain 2y ago
    > Why aren't costs involved with a mitigation actual damages? They are. If you ever look at the damage caused by a hack it's in the millions and that's because they're including the time used to investigate and repair and mitigate further attacks is included.
  - deleted 2y ago
    [deleted]
- velcrovan 2y ago
  I have received class action settlement payments from Verizon, Apple, and others for things I hardly noticed at the time. So maybe your idea of what precedent considers “damages” here is incomplete.
- that_guy_iain 2y ago
  Realistically, this is just going to piggy back on WPEngine's lawsuit. However, there were customers who migrated to other hosts because of the potential security risk. That is an actual damage. There are people who lost contracts because their potential client chose software other than WordPress. That is an actual damage. There are lots of actual damages that occurred.
- ziddoap 2y ago
  >"I could have been hacked, so I had to spend time/money on it" isn't actual damages Sure it is. Money was spent that wouldn't have been if the situation didn't happen.
  - AnthonyMouse 2y ago
    > Sure it is. Money was spent that wouldn't have been if the situation didn't happen. There are two problems with this. First, for normal damages, there is some limitation on the costs. If someone breaks the lock on your door and does nothing else, you replace the lock, damages of maybe $40. If someone gets into your servers, you what? Spend ten minutes to check the logs and rotate keys? Wipe and rebuild all the servers? Does the reasonableness of that depend on whether that's an automated process or a manual one? Maybe you should delete your entire code repository and have it rewritten from scratch, in case knowledge of the code could have helped some attacker? There is no upper limit to the amount of resources you could spend investigating something, and then companies with unlimited resources would effectively get to use it as a cudgel against someone who embarrassed them, because $10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. Second, if doing the latter was in some way actually justifiable then the company should be periodically doing it anyway, because if a vulnerability existed then it could have been exploited whether anyone was detected or not, so if spending that level of resources could be justified "just in case" then it isn't money that was spent that wouldn't have been if the situation didn't happen. Unless they're full of crap that all of it was actually necessary.
    - ziddoap 2y ago
      >There is no upper limit to the amount of resources you could spend investigating something The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc. >$10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. Again, the courts make these determinations literally all the time. We don't need to figure out what "reasonable" and "damages" mean from first principles. >It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. This type of claim is not approved by the courts, because it is clearly unreasonable.
- josefritzishere 2y ago
  There is actually an important legal distinction between could and would. He just undermined his own case.
- chasing 2y ago
  Sounds like actual damages to me. If you break my door lock I'm pretty sure I can't just leave my door wide open for months and then sue you for all of my stuff that got stolen. I need to fix the lock. And ask you to pay for that. Also not a lawyer, but pretty sure you've got to proactively mitigate your damages.
  - jeroenhd 2y ago
    Physical metaphors rarely work for software. In your scenario, someone _could've_ broken the lock because you're renting a lock from a locking agency Lock Engine, who copied a lock design from LockPress, and LockPress decided not to mail them design flaws anymore. In the real world, vulnerable locks don't ever get fixed. At worst, locks get recalled, and you get your money back. Lock designs don't get shared freely, and if they do, there is no expectation of informing people that may have copied designs of potential flaws. If your house got broken into, you should sue Lock Engine, because they're not providing the service you're paying for. Suing LockPress for the lock design Lock Engine decided to copy wholesale is pure nonsense.
- sureIy 2y ago
  Imagine you open Spotify on your phone, only to (maybe?) realize it's streaming from Apple Music. Is that ok for you that Apple appropriated the app? They offered the platform, the ecosystem and the store. Is it within their right? That's what happened here.
- dragonwriter 2y ago
  > In my understanding, there has to be actual damages arising out of an action. Depends on the specific tort, but actual damages aren't the only thing for which there can be liability. Statutory damages, punitive damages, and non-damages based liability (unjust enrichment, disgorgement of profits, etc.) are all things that exist for various torts. > "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked. Why wouldn't reasonable costs incurred to determine or rule out adverse effects of a wrongful act be considered actual damages of that act?
karaterobot 2y ago
> The lawsuit describes Automattic and Mullenweg’s conduct as an abuse of the open-source internet architecture, alleging that “a single individual (Matt Mullenweg) exercises apparent singular control over what they claim to be more than 40% of all websites in the world through his personal website (WordPress.org).” It calls this level of control “an appalling deception” that is “contrary to every conceivable public policy.” That seems like a specious argument to me. There's no deception involved as far as I can tell, and I can't see how public policy has anything to do with this. It sucks for many reasons that Wordpress powers so much of the web, but it's pretty rich for someone whose business is built on Wordpress to claim its success is an existential threat. I will not comment on what I think about a cybersecurity business that is built on a Wordpress site, as it's simply not relevant.
- connicpu 2y ago
  When you file a lawsuit you initially make every argument you might possibly want to use in your initial filing, knowing some of them will be whittled down. Pretty much every lawsuit ever includes some claims that are a bit of a stretch, because the lawyers need to CYA. If you fail to make the argument you may be precluded from introducing it later, so it's just safer to include it now.
  - deleted 2y ago
    [deleted]
  - tothrowaway 2y ago
    I think it's more about running up the legal bill of the defendant. It costs virtually nothing to include a spurious claim in a complaint (it can literally be a sentence or two). The defense has the burden of getting the weak claim dismissed with pages and pages of arguments (because they don't want any chance of it slipping through). The bar for a "shotgun" complaint is way too high in the legal system.
    - deleted 2y ago
      [deleted]
nostromo 2y ago
[flagged]
- dmalik 2y ago
  Not the only WordPress host and they have no obligation to anything for an open source project. This story isn't about them it's about their customers who chose to use their service and how Matt chose to make them collateral damage. That choice has consequences which is what this is.
- okayishdefaults 2y ago
  Disclosure: I've worked at WPE. Consider that WP Engine's business model revolves around WordPress being a problematic platform for their customers in one way or another. They support sites that would otherwise need to be replaced if it were to continue being scaled. This keeps those customers, the whales, in the WordPress ecosystem. Plugin and theme developers, digital marketing agencies, and independent web developers continue to put food on the table because of a market that otherwise wouldn't exist. This is healthy for the ecosystem. Conversely, Matt used that market, the users, as leverage against WP Engine. He caused a deep loss of trust in WordPress as a platform for any serious business. He acted in spite of the community. I don't think WP Engine is particularly "good", but they don't weaponize users for business goals under the guise of altruism.
  - echelon 2y ago
    [flagged]
    - jdub 2y ago
      WordPress is copyleft (GPL), and copyleft is open source. And these are the consequences and indeed the intentions of open source. There's no "ripping off", this is what Open Source licenses permit. If contributors didn't want this to be possible, they shouldn't have licensed their software this way. (Of course, WordPress itself is a fork of a GPL project, so didn't have the option, and you could equally say it's "ripping off" that project. But we don't. Because it's open source. And that's how it works.)
felizuno 2y ago
I have to assume there is bright-line "swim at your own risk" language that protects Automattic from claims like this.
- joshbetz 2y ago
  > This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. https://github.com/WordPress/WordPress/blob/master/license.txt https://github.com/WordPress/WordPress/blob/master/license.t...
  - deleted 2y ago
    [deleted]
  - dragonwriter 2y ago
    Warranty disclaimers may (or may not, depending on the law of the effected jurisdiction) limit liability for claims on an implied warranty theory, but they certainly don't apply to tortious interference or unfair competition claims. I’m not saying the claims here are valid, but the warranty disclaimers don't seem at all relevant to the bases of liability asserted.
    - felizuno 2y ago
      thank you, now I'm learning the things I wanted to learn when I made my comment
  - wrs 2y ago
    I haven’t bothered to look at the actual filing, but none of the causes of action mentioned in the article were about warranty, merchantability, or fitness for purpose.
    - felizuno 2y ago
      yeah, this part is where I am confused - the dispute itself is about bad business to business behavior, but the class status of this lawsuit drills down to harm caused to end users. I'm trying to figure out what expectations end users are entitled to since it's obviously not the case that WP users can hold Automattic directly liable when they are hacked. I _think_ the argument is that WPE gave them the (at the time reasonable) expectation that risk mitigation was handled by them, and Automattic made that expectation impossible to meet retroactively hence tortious interference, but is there language that passes the liability up the chain from the end users? To me it seems like WPE has a case but the end users as a class might face headwinds. And for everybody angrily downvoting me I agree with you that Matt is an asshole but that doesn't mean I don't want to understand the nuance of a class claim in a case like this.
throwaway_22625 2y ago
[flagged]
- giancarlostoro 2y ago
  What you are missing is that this whole drama is costing peoples whose business model is to help companies adopt and maintain wordpress. I have friends who lost their leads and existing clients over this drama. So no, its not as easy as this.
  - tasuki 2y ago
    [flagged]
    - giancarlostoro 2y ago
      Its not a good thing for businesses with no better alternative really. You can give anyone wordpress and host it on any hosting provider on the planet. Cant say that about most alternatives, not really. Mind you I personally prefer to use all the alternatives, since I am more technically capable than most of the target customers. Cheering for the developers just means only wordpress gets to sell hosting for it, they arent starving developers.
- rovr138 2y ago
  Can I ask based on what? Just previous knowledge or by reading the claims here?
  - throwaway_22625 2y ago
    [flagged]
    - ookblah 2y ago
      then he basically successfully fooled you and rewrote history, mission accomplished. more like the director has beef with theater and attempts to burn the entire thing down while gaslighting the cast and crew. you may have no time for internet drama, but comments like this perpetuate the bad actors.
jcranmer 2y ago
Why do journalists so rarely link to the actual court documents when talking about a complaint? Anyways, here it is: https://storage.courtlistener.com/recap/gov.uscourts.cand.445022/gov.uscourts.cand.445022.1.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.44...
- saaaaaam 2y ago
  Often because they have paid for it via pacer so don’t want to give it away to competitors for free. Or because they’ve got it via a back door and don’t want to link to it and reveal that.
- nimish 2y ago
  Because it'd reveal they usually aren't much more than a summarizer run on the court doc. Middlemen hate to show you what they actually do.
  - jahsome 2y ago
    Many journalists do upload/link to documents, and add quite a bit of context to the documents. OC appears to confuse bloggers with journalists. Speaking from personal experience, the number of people who click on links for raw documents is an _extremely_ small subset. Most people don't even read past the headline let alone the lede.
- geoffeg 2y ago
  Because it links away from their site. They want to keep you on the site, clicking more links that can generate revenue for them.

129 points by rpgbr 2y ago

I'm not a lawyer, but the legal claim made appears to me to be on shaky ground. In my understanding, there has to be actual damages arising out of an action. "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked.

ordx 2y ago
I imagine it would be sufficient to show that he had to spend time or money analyzing the security impact of the event.
lesuorac 2y ago
Why aren't costs involved with a mitigation actual damages? I'n not sure this is the correct lawsuit to demonstrate this. So hypothetically, if say you lent a key to a handyman and then they posted a photo on it to twitter it seems pretty reasonable for them to cover the costs of replacing the locks. As opposed to having to wait for somebody to rob you and then trying to show that the robber did so from the photo.
- that_guy_iain 2y ago
  > Why aren't costs involved with a mitigation actual damages? They are. If you ever look at the damage caused by a hack it's in the millions and that's because they're including the time used to investigate and repair and mitigate further attacks is included.
- deleted 2y ago
  [deleted]
velcrovan 2y ago
I have received class action settlement payments from Verizon, Apple, and others for things I hardly noticed at the time. So maybe your idea of what precedent considers “damages” here is incomplete.
that_guy_iain 2y ago
Realistically, this is just going to piggy back on WPEngine's lawsuit. However, there were customers who migrated to other hosts because of the potential security risk. That is an actual damage. There are people who lost contracts because their potential client chose software other than WordPress. That is an actual damage. There are lots of actual damages that occurred.
ziddoap 2y ago
>"I could have been hacked, so I had to spend time/money on it" isn't actual damages Sure it is. Money was spent that wouldn't have been if the situation didn't happen.
- AnthonyMouse 2y ago
  > Sure it is. Money was spent that wouldn't have been if the situation didn't happen. There are two problems with this. First, for normal damages, there is some limitation on the costs. If someone breaks the lock on your door and does nothing else, you replace the lock, damages of maybe $40. If someone gets into your servers, you what? Spend ten minutes to check the logs and rotate keys? Wipe and rebuild all the servers? Does the reasonableness of that depend on whether that's an automated process or a manual one? Maybe you should delete your entire code repository and have it rewritten from scratch, in case knowledge of the code could have helped some attacker? There is no upper limit to the amount of resources you could spend investigating something, and then companies with unlimited resources would effectively get to use it as a cudgel against someone who embarrassed them, because $10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. Second, if doing the latter was in some way actually justifiable then the company should be periodically doing it anyway, because if a vulnerability existed then it could have been exploited whether anyone was detected or not, so if spending that level of resources could be justified "just in case" then it isn't money that was spent that wouldn't have been if the situation didn't happen. Unless they're full of crap that all of it was actually necessary.
  - ziddoap 2y ago
    >There is no upper limit to the amount of resources you could spend investigating something The upper limit is what the courts decide is reasonable, based on the factors of the case, your justification of the requested damages, precedent of similar cases, etc. >$10M is nothing to them but is a life-destroying amount of damages to some kid who made a mistake. Again, the courts make these determinations literally all the time. We don't need to figure out what "reasonable" and "damages" mean from first principles. >It's like claiming that someone broke the lock on your door so now you're not sure if someone might have been inside and you have to strip the whole building to the rafters to check if someone has planted a listening device or hidden some crypto mining hardware inside the walls, even though you're a company that sells tile and carpets. This type of claim is not approved by the courts, because it is clearly unreasonable.
josefritzishere 2y ago
There is actually an important legal distinction between could and would. He just undermined his own case.
chasing 2y ago
Sounds like actual damages to me. If you break my door lock I'm pretty sure I can't just leave my door wide open for months and then sue you for all of my stuff that got stolen. I need to fix the lock. And ask you to pay for that. Also not a lawyer, but pretty sure you've got to proactively mitigate your damages.
- jeroenhd 2y ago
  Physical metaphors rarely work for software. In your scenario, someone _could've_ broken the lock because you're renting a lock from a locking agency Lock Engine, who copied a lock design from LockPress, and LockPress decided not to mail them design flaws anymore. In the real world, vulnerable locks don't ever get fixed. At worst, locks get recalled, and you get your money back. Lock designs don't get shared freely, and if they do, there is no expectation of informing people that may have copied designs of potential flaws. If your house got broken into, you should sue Lock Engine, because they're not providing the service you're paying for. Suing LockPress for the lock design Lock Engine decided to copy wholesale is pure nonsense.
sureIy 2y ago
Imagine you open Spotify on your phone, only to (maybe?) realize it's streaming from Apple Music. Is that ok for you that Apple appropriated the app? They offered the platform, the ecosystem and the store. Is it within their right? That's what happened here.
dragonwriter 2y ago
> In my understanding, there has to be actual damages arising out of an action. Depends on the specific tort, but actual damages aren't the only thing for which there can be liability. Statutory damages, punitive damages, and non-damages based liability (unjust enrichment, disgorgement of profits, etc.) are all things that exist for various torts. > "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked. Why wouldn't reasonable costs incurred to determine or rule out adverse effects of a wrongful act be considered actual damages of that act?

karaterobot 2y ago

> The lawsuit describes Automattic and Mullenweg’s conduct as an abuse of the open-source internet architecture, alleging that “a single individual (Matt Mullenweg) exercises apparent singular control over what they claim to be more than 40% of all websites in the world through his personal website (WordPress.org).” It calls this level of control “an appalling deception” that is “contrary to every conceivable public policy.” That seems like a specious argument to me. There's no deception involved as far as I can tell, and I can't see how public policy has anything to do with this. It sucks for many reasons that Wordpress powers so much of the web, but it's pretty rich for someone whose business is built on Wordpress to claim its success is an existential threat. I will not comment on what I think about a cybersecurity business that is built on a Wordpress site, as it's simply not relevant.

connicpu 2y ago
When you file a lawsuit you initially make every argument you might possibly want to use in your initial filing, knowing some of them will be whittled down. Pretty much every lawsuit ever includes some claims that are a bit of a stretch, because the lawyers need to CYA. If you fail to make the argument you may be precluded from introducing it later, so it's just safer to include it now.
- deleted 2y ago
  [deleted]
- tothrowaway 2y ago
  I think it's more about running up the legal bill of the defendant. It costs virtually nothing to include a spurious claim in a complaint (it can literally be a sentence or two). The defense has the burden of getting the weak claim dismissed with pages and pages of arguments (because they don't want any chance of it slipping through). The bar for a "shotgun" complaint is way too high in the legal system.
  - deleted 2y ago
    [deleted]

nostromo 2y ago

[flagged]

dmalik 2y ago
Not the only WordPress host and they have no obligation to anything for an open source project. This story isn't about them it's about their customers who chose to use their service and how Matt chose to make them collateral damage. That choice has consequences which is what this is.
okayishdefaults 2y ago
Disclosure: I've worked at WPE. Consider that WP Engine's business model revolves around WordPress being a problematic platform for their customers in one way or another. They support sites that would otherwise need to be replaced if it were to continue being scaled. This keeps those customers, the whales, in the WordPress ecosystem. Plugin and theme developers, digital marketing agencies, and independent web developers continue to put food on the table because of a market that otherwise wouldn't exist. This is healthy for the ecosystem. Conversely, Matt used that market, the users, as leverage against WP Engine. He caused a deep loss of trust in WordPress as a platform for any serious business. He acted in spite of the community. I don't think WP Engine is particularly "good", but they don't weaponize users for business goals under the guise of altruism.
- echelon 2y ago
  [flagged]
  - jdub 2y ago
    WordPress is copyleft (GPL), and copyleft is open source. And these are the consequences and indeed the intentions of open source. There's no "ripping off", this is what Open Source licenses permit. If contributors didn't want this to be possible, they shouldn't have licensed their software this way. (Of course, WordPress itself is a fork of a GPL project, so didn't have the option, and you could equally say it's "ripping off" that project. But we don't. Because it's open source. And that's how it works.)

felizuno 2y ago

I have to assume there is bright-line "swim at your own risk" language that protects Automattic from claims like this.

joshbetz 2y ago
> This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. https://github.com/WordPress/WordPress/blob/master/license.txt https://github.com/WordPress/WordPress/blob/master/license.t...
- deleted 2y ago
  [deleted]
- dragonwriter 2y ago
  Warranty disclaimers may (or may not, depending on the law of the effected jurisdiction) limit liability for claims on an implied warranty theory, but they certainly don't apply to tortious interference or unfair competition claims. I’m not saying the claims here are valid, but the warranty disclaimers don't seem at all relevant to the bases of liability asserted.
  - felizuno 2y ago
    thank you, now I'm learning the things I wanted to learn when I made my comment
- wrs 2y ago
  I haven’t bothered to look at the actual filing, but none of the causes of action mentioned in the article were about warranty, merchantability, or fitness for purpose.
  - felizuno 2y ago
    yeah, this part is where I am confused - the dispute itself is about bad business to business behavior, but the class status of this lawsuit drills down to harm caused to end users. I'm trying to figure out what expectations end users are entitled to since it's obviously not the case that WP users can hold Automattic directly liable when they are hacked. I _think_ the argument is that WPE gave them the (at the time reasonable) expectation that risk mitigation was handled by them, and Automattic made that expectation impossible to meet retroactively hence tortious interference, but is there language that passes the liability up the chain from the end users? To me it seems like WPE has a case but the end users as a class might face headwinds. And for everybody angrily downvoting me I agree with you that Matt is an asshole but that doesn't mean I don't want to understand the nuance of a class claim in a case like this.

throwaway_22625 2y ago

[flagged]

giancarlostoro 2y ago
What you are missing is that this whole drama is costing peoples whose business model is to help companies adopt and maintain wordpress. I have friends who lost their leads and existing clients over this drama. So no, its not as easy as this.
- tasuki 2y ago
  [flagged]
  - giancarlostoro 2y ago
    Its not a good thing for businesses with no better alternative really. You can give anyone wordpress and host it on any hosting provider on the planet. Cant say that about most alternatives, not really. Mind you I personally prefer to use all the alternatives, since I am more technically capable than most of the target customers. Cheering for the developers just means only wordpress gets to sell hosting for it, they arent starving developers.
rovr138 2y ago
Can I ask based on what? Just previous knowledge or by reading the claims here?
- throwaway_22625 2y ago
  [flagged]
  - ookblah 2y ago
    then he basically successfully fooled you and rewrote history, mission accomplished. more like the director has beef with theater and attempts to burn the entire thing down while gaslighting the cast and crew. you may have no time for internet drama, but comments like this perpetuate the bad actors.

jcranmer 2y ago

Why do journalists so rarely link to the actual court documents when talking about a complaint? Anyways, here it is: https://storage.courtlistener.com/recap/gov.uscourts.cand.445022/gov.uscourts.cand.445022.1.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.44...

saaaaaam 2y ago
Often because they have paid for it via pacer so don’t want to give it away to competitors for free. Or because they’ve got it via a back door and don’t want to link to it and reveal that.
nimish 2y ago
Because it'd reveal they usually aren't much more than a summarizer run on the court doc. Middlemen hate to show you what they actually do.
- jahsome 2y ago
  Many journalists do upload/link to documents, and add quite a bit of context to the documents. OC appears to confuse bloggers with journalists. Speaking from personal experience, the number of people who click on links for raw documents is an _extremely_ small subset. Most people don't even read past the headline let alone the lede.
geoffeg 2y ago
Because it links away from their site. They want to keep you on the site, clicking more links that can generate revenue for them.