Automattic Hit with Class Action over WP Engine Dispute
32 comments
·February 26, 2025karaterobot
cyral
> There's no deception involved as far as I can tell
155 pages of deception here: https://wpengine.com/wp-content/uploads/2024/11/51-2.pdf Page 32 "Defendants Conceal the Truth Regarding the WordPress Directory" and page 73 "Wrongfully Expropriate WPE’s Most Popular Plugin" are particularly related. (The part where Matt decides to take over WP Engine's popular plugin and rename it, taking all their customers and reviews is particularly egregious)
connicpu
When you file a lawsuit you initially make every argument you might possibly want to use in your initial filing, knowing some of them will be whittled down. Pretty much every lawsuit ever includes some claims that are a bit of a stretch, because the lawyers need to CYA. If you fail to make the argument you may be precluded from introducing it later, so it's just safer to include it now.
null
FireBeyond
> There's no deception involved as far as I can tell
Whether it is germane to the case or not, there was plenty of deception:
When the rights were transferred to the WPF, Matt didn't disclose that the Foundation was essentially just him, and the two other nominal members were effectively absent.
When the rights were transferred, and a big deal was made of this, "It now belongs to the WPF, which ensures that no commercial entity or interest can affect what should be a community project", there was no mention of how, on that same day the WPF silently granted a "irrevocable, non-expiring, exclusive universal commercial licence" to Automattic.
Matt repeatedly would refer to wp.org as a community resource and not his, until push came to shove, and "no, actually, it's exclusively mine and has nothing to do with Automattic or the WPF".
And several other examples. Apropos of anything else, there has been deception.
throwaway_22625
For whatever it's worth.
Having sat down to finally try and understand what on earth is going on, I was surprised to learn that WP Engine is a hosting service.
I legit thought (WP Engine is to WordPress) as (the Linux Kernel is to Ubuntu).
TIL it's more (WP Engine is to WordPress) as (DigitalOcean is to Ubuntu).
That alone makes me want to just fully side with the developers on this issue.
giancarlostoro
What you are missing is that this whole drama is costing peoples whose business model is to help companies adopt and maintain wordpress. I have friends who lost their leads and existing clients over this drama. So no, its not as easy as this.
rovr138
Can I ask based on what?
Just previous knowledge or by reading the claims here?
felizuno
I have to assume there is bright-line "swim at your own risk" language that protects Automattic from claims like this.
tyzoid
I'm not a lawyer, but the legal claim made appears to me to be on shaky ground. In my understanding, there has to be actual damages arising out of an action. "I could have been hacked, so I had to spend time/money on it" isn't actual damages unless they were _actually_ hacked.
lesuorac
Why aren't costs involved with a mitigation actual damages?
I'n not sure this is the correct lawsuit to demonstrate this.
So hypothetically, if say you lent a key to a handyman and then they posted a photo on it to twitter it seems pretty reasonable for them to cover the costs of replacing the locks. As opposed to having to wait for somebody to rob you and then trying to show that the robber did so from the photo.
null
that_guy_iain
> Why aren't costs involved with a mitigation actual damages?
They are. If you ever look at the damage caused by a hack it's in the millions and that's because they're including the time used to investigate and repair and mitigate further attacks is included.
ziddoap
>"I could have been hacked, so I had to spend time/money on it" isn't actual damages
Sure it is. Money was spent that wouldn't have been if the situation didn't happen.
velcrovan
I have received class action settlement payments from Verizon, Apple, and others for things I hardly noticed at the time. So maybe your idea of what precedent considers “damages” here is incomplete.
ordx
I imagine it would be sufficient to show that he had to spend time or money analyzing the security impact of the event.
chasing
Sounds like actual damages to me.
If you break my door lock I'm pretty sure I can't just leave my door wide open for months and then sue you for all of my stuff that got stolen. I need to fix the lock. And ask you to pay for that. Also not a lawyer, but pretty sure you've got to proactively mitigate your damages.
jeroenhd
Physical metaphors rarely work for software.
In your scenario, someone _could've_ broken the lock because you're renting a lock from a locking agency Lock Engine, who copied a lock design from LockPress, and LockPress decided not to mail them design flaws anymore.
In the real world, vulnerable locks don't ever get fixed. At worst, locks get recalled, and you get your money back. Lock designs don't get shared freely, and if they do, there is no expectation of informing people that may have copied designs of potential flaws.
If your house got broken into, you should sue Lock Engine, because they're not providing the service you're paying for. Suing LockPress for the lock design Lock Engine decided to copy wholesale is pure nonsense.
that_guy_iain
Realistically, this is just going to piggy back on WPEngine's lawsuit.
However, there were customers who migrated to other hosts because of the potential security risk. That is an actual damage. There are people who lost contracts because their potential client chose software other than WordPress. That is an actual damage. There are lots of actual damages that occurred.
josefritzishere
There is actually an important legal distinction between could and would. He just undermined his own case.
nostromo
The entitlement WP Engine has to other people’s work is staggering.
If they’ve been making so much money off of WordPress for so long, they should have either 1. entered into a formal agreement with the project’s maintainers or 2. forked the project and maintained it themselves.
Instead they’ve been reselling someone else’s work and when they objected sued the maintainers… a bold strategy to say the least.
okayishdefaults
Disclosure: I've worked at WPE.
Consider that WP Engine's business model revolves around WordPress being a problematic platform for their customers in one way or another. They support sites that would otherwise need to be replaced if it were to continue being scaled. This keeps those customers, the whales, in the WordPress ecosystem.
Plugin and theme developers, digital marketing agencies, and independent web developers continue to put food on the table because of a market that otherwise wouldn't exist. This is healthy for the ecosystem.
Conversely, Matt used that market, the users, as leverage against WP Engine. He caused a deep loss of trust in WordPress as a platform for any serious business. He acted in spite of the community.
I don't think WP Engine is particularly "good", but they don't weaponize users for business goals under the guise of altruism.
echelon
You're profiting off of Matt and the WordPress developers. It's scummy.
This is very much like Amazon and other hyperscalers making managed versions of Elasticsearch and Redis and cutting them out of the value chain entirely.
This is only going to result in less open source, more copyleft, "equitable source" / "source available", etc.
While you have every right to do what you're doing, it's ripping off the source of the people that put in the decades of hard work.
Matt should have conducted himself better in this, but his anger and frustration are palpable. You grifted his work (with his, in retrospect stupid, permission).
Maybe the time for permissive open source licenses is over. Big players and third parties come in and eat up all the value, leaving the original engineers and teams and companies out to dry.
jdub
WordPress is copyleft (GPL), and copyleft is open source.
And these are the consequences and indeed the intentions of open source. There's no "ripping off", this is what Open Source licenses permit. If contributors didn't want this to be possible, they shouldn't have licensed their software this way.
(Of course, WordPress itself is a fork of a GPL project, so didn't have the option, and you could equally say it's "ripping off" that project. But we don't. Because it's open source. And that's how it works.)
dylan604
Didn't Matt do the exact same thing with b2/cafelog?
https://en.wikipedia.org/wiki/WordPress#History
Your pro-Matt stance seems really strained with this argument
dmalik
Not the only WordPress host and they have no obligation to anything for an open source project.
This story isn't about them it's about their customers who chose to use their service and how Matt chose to make them collateral damage. That choice has consequences which is what this is.
buttercraft
Was WordPress not a fork of someone else's work? Why the double standard?
nostromo
WP could fork if that wanted to, that'd be fine. But they didn't. And then they sued to try and tell WordPress what they could and couldn't do with their own project.
jeroenhd
WP Engine is acting scummy and all, but this is the shadow side of releasing projects as open source. You can't force the people using the freedoms you're granting them to pay you or support you. If you don't like it when people take your code and build a competing business with it, pick a license that (effectively) prevents doing that. With some licenses you can at least get the additions they make out of them under the same license (AGPL and such).
WP Engine is ungrateful and generally kind of shit, but they did nothing that WordPress didn't allow. WordPress acted needlessly aggressive and conflated the business side of their operation with the non-profit side of their operation, which is why WP Engine has a legal basis to sue them over in the first place. WordPress has gathered a lot of good will for being open source and having a non-profit that maintains tooling, but if they don't respect the freedoms that made them popular, they're going to lose out in the end.
I don't have a horse in this race and I'd have to back WordPress if I had to make a decision, but neither party in this conflict is the good guy here.
All of that said, the true vultures here are the lawyers and companies organising the class action lawsuit. All of the customers they "represent" are doing it for a quick buck, and the lawyers are more than willing to blow up Automaticc and WordPress to get their pay day even if it means WordPress will no longer be maintained by anyone. Whatever side you're on, winning this class action lawsuit means everybody but the lawyers lose.
FireBeyond
There are several other issues with this, but "1. entered into a formal agreement with the project’s maintainers"
You are aware (well, maybe you're not, because the WPF certainly has never announced it) that this would be ... difficult, because the same day the WPF was granted ownership over the WP "entity", it granted an exclusive, irrevocable, universal sole commercial license to Automattic.
nostromo
Thank you, I didn't know that and it does complicate things dramatically.
> The lawsuit describes Automattic and Mullenweg’s conduct as an abuse of the open-source internet architecture, alleging that “a single individual (Matt Mullenweg) exercises apparent singular control over what they claim to be more than 40% of all websites in the world through his personal website (WordPress.org).” It calls this level of control “an appalling deception” that is “contrary to every conceivable public policy.”
That seems like a specious argument to me. There's no deception involved as far as I can tell, and I can't see how public policy has anything to do with this. It sucks for many reasons that Wordpress powers so much of the web, but it's pretty rich for someone whose business is built on Wordpress to claim its success is an existential threat. I will not comment on what I think about a cybersecurity business that is built on a Wordpress site, as it's simply not relevant.