Employees Describe an Environment of Paranoia and Fear Inside Automattic | Hacker News Reader

Employees Describe an Environment of Paranoia and Fear Inside Automattic

404media.co

200 pointsorangeteacups79 comments

> In July, before the latest WP Engine blowup, an Automattic employee wrote in Slack that they received a direct message from Mullenweg sending them an identification code for Blind, an anonymous workplace discussion platform, which was required to complete registration on the site. Blind requires employees to use their official workplace emails to sign up, as a way to authenticate that users actually work for the companies they are discussing. Mullenweg said on Slack that emails sent from Blind’s platform to employees’ email addresses were being forwarded to him. If employees wanted to log in or sign up for Blind, they’d need to ask Mullenweg for the two-factor identification code. The implication was that Automattic—and Mullenweg—could see who was trying to sign up for Blind, which is often a place where people anonymously vent or share criticism about their workplace.

> “We were unaware that Matt redirected sign-up emails until current Automattic employees contacted our support team,” a spokesperson for Blind told me, adding that they’d “never seen a CEO or executive try to limit their employees from signing up for Blind by redirecting emails.”

Redirecting the emails is crazy. I would assume, as an employee of any company, that they can monitor emails to corporate email accounts but outright redirecting emails is something I've never heard of

Sysadmins doing what they are told I imagine.

They're not Sysadmins as far as I'm concerned because they ought to be blackballed for implementing such a heinous process.

Redirecting, forwarding, copying and other email rules being set by system administrators is normal. "Heinous" is grossly disingenuous.

This sort of thing happens for a bunch of reasons, most typically as a result of legal action. I myself have all of my email being held for discovery in an ongoing case that I personally have nothing to do with, it says nothing about wrongdoing of anyone involved.

If CEO came to me and said "we need to archive all email to or from this recipient", the only unusual part of that ask would be the person requesting it.

Blackballed how and by whom and what downstream process, the cabal of principled sysadmins? I’m sympathetic to your philosophical bent but that world, outside self employment, got stomped hard some time ago.

We have The Work Number but no way to reasonably implement your suggestion. We’re cogs, just toast.

> never seen a CEO or executive try to limit their employees from signing up for Blind by redirecting emails

I get that it’s creepy that this is being done, but I highly doubt that nobody at Blind has “never seen” this. Blind sends spam using multiple different domain names trying to get people to sign up. The domains are rotated so they can get around blocking on the email server, and the fact they do it means they already know that companies try to block them.

Blocking, sure. But literally sending the emails to the CEO might very well be a new one.

There are loads of terrible companies around, so I'd be surprised if none of them had ever tried to intercept Blind sign-up messages before now, and if you're a tyrant CEO at one of said terrible companies, getting the emails forwarded to you is merely the next logical step.

The next paragraph in the text is a lot more interesting:

Some of the most commonly discussed topics on Blind are protected speech in the U.S.—pay, job terminations, critiques of workplace conditions—which we believe workers should be free to access and discuss.

What are the consequences (in the US) of a company blocking that?

Zero. Protected speech is protected from government intervention. You can run your own forum that bans people from discussing <thing you hate> without repercussions.

Eh, discussing salary is a right, guaranteed by the National Labor Relations Act.

You are totally right. Was knee jerk thinking of generic free speech protections from private companies.

That being said, blanket blocking access to a forum might still be ok? You do not know specifically what would be discussed there.

Blocking signups to a specific forum using company email is not blocking salary discussions.

You'd want to be very sure that at no point an email/text along the lines of "let's do this, because people are discussing salaries" was sent that might show up in discovery.

So what if it does? You are not prohibiting discussing of salaries - you are prohibiting discussing of salaries while using company property and company time. There is no problem here.

NLRB has ruled many times on companies "prohibiting discussing of salaries while using company property and company time", virtually always striking down the prohibitions and in many cases sanctioning companies for trying to impose them. Labor organizing activity is absolutely allowed to happen on company property and company time. It would be impossible otherwise at many workplaces. Think about auto factories, coal mines, offshore oil platforms, etc., especially before email.

You are misinformed.

The NLRB does not allow you to use company time and company property to do non-company things.

You can use your own break time to discuss salaries. There is nothing a company can do to prohibit that.

It's really that simple.

If work allows non-work conversations, discussing salaries can't be an exception to that. (Automattic definitely permits non-work conversations during the workday.)

https://www.nlrb.gov/about-nlrb/rights-we-protect/your-right...

> You may have discussions about wages when not at work, when you are on break, and even during work if employees are permitted to have other non-work conversations. You have these rights whether or not you are represented by a union.

If you consistently have - and consistently enforce! - a "no non-work conversations" policy, that can include salary discussions. Suddenly adding a new "no talking!" policy in response to people organizing wouldn't fly, either.

Does the employee handbook/contract/whatever say it's ok? Or is it just done?

There is no reality where any employer willfully enabled employees to literally not do work while being paid to work.

This is a silly discussion to be having.

> Does the employee handbook/contract/whatever say it's ok? Or is it just done?

It would have to say that there are to be no off-topic conversations during work of any kind, and it would have to have been demonstrably enforced. If it's a new policy that somehow is only ever invoked when someone talks about salaries, you're in for a world of hurt.

> There is no reality where any employer willfully enabled employees to literally not do work while being paid to work.

If it's like any other significantly sized tech company, there's probably a pool and ping-pong table somewhere. It's also possible to talk while working.

> are to be no off-topic conversations during work of any kind, and it would have to have been demonstrably enforced

This is silly.

Go read your contract. It most likely has something exactly like this in it, in addition to spelling out what you are allowed to use company property and time for. This is employer 101 level stuff folks.

> demonstrably enforced

Telling someone to get back to work once in a while is enforcement.

You can continue contorting this into some sort of pro-union/organization thing - but it is not.

These people literally:

1) Started their work day

2) Used their company-provided computer to browse the internet instead of working

3) Used their company-provided email address to sign up for a non-work-related website

4) If successful in creating the account, would proceed to spend company time gossiping about company policies.

On it's own that's a terminatable offense and a gross misuse of company time, money and property.

> You can continue contorting this into some sort of pro-union/organization thing - but it is not.

You previously posted "Unskilled labor probably shouldn't be livable", so you'll have to excuse my doubts about your pro-worker stance.

> These people literally:

There's actually no evidence that occurred. I have my work email on my personal phone, and I can receive a 2FA code outside of work hours; I could sign up for Blind without ever once using company hardware or time.

Again, if Automattic has a history of permitting occasional non-work browsing/emailing - which they almost certainly do - sudden specific targeting of payment discussions would be a violation of the NLRA.

> You previously posted "Unskilled labor probably shouldn't be livable", so you'll have to excuse my doubts about your pro-worker stance.

I'm glad you enjoy my work. No, unskilled labor should not be livable. It's literally, unskilled.

> Again, if Automattic has a history of permitting occasional non-work browsing/emailing - which they almost certainly do - sudden specific targeting of payment discussions would be a violation of the NLRA.

That's a HUGE leap and assumption you are making here, isn't it? Sudden targeting of payment discussions? Do you have any evidence to suggest that is the only non-work-related topic being targeted here?

> That's a HUGE leap and assumption you are making here, isn't it?

No. Scroll up. I started with this, for context:

"You'd want to be very sure that at no point an email/text along the lines of 'let's do this, because people are discussing salaries' was sent that might show up in discovery."

> Do you have any evidence to suggest that is the only non-work-related topic being targeted here?

https://www.teamblind.com/sign-up has the tagline "Real salary data from verified employees"; it's a pretty single-purpose site. Matt had Blind signup emails intercepted and sent to him instead.

What other possible purpose of targeting this specific site could there be, if not to impact disclosure/awareness of salaries within Automattic?

Blind is not just a website where people discuss salaries. It's an alternative LinkedIn.

Your entire premise and the assumptions it's built upon are absurdly false and sensationalist.

There was no wrong doing here by the company - no matter how slimey their leadership may currently be.

Spending time on a social media website is not protected by any law.

Is there some sort of "remind my in 6 months" thing? I'd love to come back so we can discuss how nothing came of this.

Hey, dude, you're wrong.

Discussing salary using company property (your provided email address and provided computer) on company time is not guaranteed nor protected.

You can discuss anything you want on your time using your own property.

I'm pretty sure the NLRA does protect that, and this specific behavior seems like it would fall afoul of CA 232.5 as well:

https://law.justia.com/codes/california/code-lab/division-2/...

It may not be so clear cut if the employer allows other non-work use of the email and computers, like sending and receiving personal emails, or visiting websites for personal reasons.

That's entirely false.

https://www.nlrb.gov/about-nlrb/rights-we-protect/your-right...

That's entirely false.

> > You may have discussions about wages when not at work, when you are on break, and even during work if employees are permitted to have other non-work conversations. You have these rights whether or not you are represented by a union.

So which employer expressly allows you to use company time and property to do non-company things? Oh, right... none.

So you clocking into work (figuratively or literally), logging into you company computer, browsing to a non-work-related website and gabbing all day is not protected.

> So which employer expressly allows you to use company time and property to do non-company things? Oh, right... none.

Virtually all companies permit non-disruptive non-work discussions during the work day. "How was your weekend?", for example. Unless you're something like a voice actor, they can even usually occur while you work.

"How was your weekend" is not the same as spending a couple hours on a non-work related website.

This is not a union/organization issue. This is a very simple case of employees goofing off on the clock and being surprised the company found out about it.

There wouldn't even be an article about this had any of this occurred after hours or on breaks. The fact that breaks aren't even part of the discussion tells you without ambiguity these people were stealing company time, money and resources instead of doing the thing they were hired to do.

> "How was your weekend" is not the same as spending a couple hours on a non-work related website.

If it takes you "a couple hours" to complete https://www.teamblind.com/sign-up, that's on you.

> There wouldn't even be an article about this had any of this occurred after hours or on breaks.

You can't just make shit up to win an argument; there's absolutely no way of telling whether or not these emails were generated during breaks. All we know is Matt intercepted them. They could've signed up outside of work hours, during breaks, on vacation, etc. and Matt would still have been receiving them.

If it's anything like most other tech companies, breaks aren't even formal, let alone tracked/timestamped.

Yeah, it's like the most obvious security problem with blind that anyone would think of. Maybe this is the only company that made it obvious that they are monitoring for blind but there are probably plenty of smaller companies monitoring blind in secret.

> Blind requires employees to use their official workplace emails to sign up, as a way to authenticate that users actually work for the companies they are discussing.

That’s a pretty bad design decision. It’s also not a good idea to access such forum from you work computer, even when not using the company email.

> That’s a pretty bad design decision

How would you design it?

Not parent but here's a couple of not fully thought out ideas:

1. Have the signer upper send a provided email from their own Gmail account to their own company account. Then show the message's DKIM headers to blind. Now Matt has to find emails from employees personal mailboxes to their corporate mailboxes but he can't tell what the content is about.

2. Employ a graph of email forwarders (humans) selected from existing blind users. Use them to forward challenge email payload to the signer upper. Now Matt has to find emails from anyone to anyone and still doesn't know what the content is about.

>Then show the message's DKIM headers to blind.

You realize that Blind isn't exclusively for software engineers right? Lol

> “New alignment offer: I guess some people were sad they missed the last window. Some have been leaking to the press and ex-employees. That's water under the bridge. Maybe the last offer needed to be higher. People have said they want a new window, so this is my attempt.

It's kind a funny, the whole point of the last offer was that you rip off the band-aid once and for all. But giving people a 4-hour window before you spend a week doing increasingly crazy things didn't really give people enough of a taste of things to come.

I'm also not sure why the CEO is being so pernicious with these tiny windows. Why only give your people 4 hours with no advance notice?

People want to draw obvious comparisons to the offers at Twitter and 37 Signals, but at least with those employees were a) given enough notice to discuss things with friends/family and b) knew what they were signing up for. I'm not sure if the Automattic employees who missed the window last week knew they were going to be engaging in supply chain attacks against their own ecosystem a few days later.

> Why only give your people 4 hours with no advance notice?

To be able to brag about how few took the offer.

He also seems to love the "Nobody expects the Spanish Inquisition!" type of surprise tactic. Like when they cut access to plugin updates for all WP Engine customers from one moment to the next. He probably thinks it's a power move. To me personally it looks mean, weak, and pathetic. It's what a bully would do.

> I'm also not sure why the CEO is being so pernicious with these tiny windows. Why only give your people 4 hours with no advance notice?

Especially since the company is proudly remote with employees all over the globe, and some of them might not even be awake to see this 4-hour window email.

This strikes me as performative and manipulative to show there are no more "dissenters".

> Mullenweg offered Automattic employees six months of pay or $30,000, whichever was higher, with the stipulation that they would lose access to their work logins that same evening and would not be eligible for rehire. One hundred and fifty-nine people took the offer and left.

I can't imagine what that does to a company's output. What happens to everything those 159 people were working on? Surely not everyone else had intimate knowledge of their work, unless they were just customer support staff or something.

Also, often the people who leave at the drop of a hat are the more talented ones because they're not (or less) worried about the financial repercussions of doing so knowing they can get work elsewhere.

Life is too short to work in such a toxic place. I've been in two of them; not having a job can be bad, but life goes on much more pleasantly when you get out.

So true. In the same boat with having two of them. Stole 7 years off my life, and took 3 to recover from. It's not worth it.

I quit my last job on the spot without a new job lined up. Place wa horrible, my manager made me feel horrible -- even when they had spent the previous 7 months praising me, they still had a way of making you feel absolutely miserable -- and I got to a place where I had to leave or very bad things would happen. I've been with my current employer for about 2 years now and I love it here, love the people, the work, the company. It was very hard to walk away from a job without secured income but it was absolutely the right decision.

Should I even bother asking why there isn't some kind of Board of Directors at WP?

They could act as a check against one person going absolutely insane and destroying a company and hundreds of jobs in the process. (except in obvious cases like Musk or Zuckerberg of course, where they basically run everything and the board never pushes back)

Automattic does have a board of directors, and it's squarely under Matt's control.

https://automattic.com/board/

Automattic is a VC funded startup that's taken close to a billion dollars in funding, over the years.

I wonder how much influence the VCs had in these decisions or if any of these decisions will cause them to step in and make changes.

This seems like really erratic behavior by one person. Hope he is ok.

He's listed as a BDFL, but perhaps without the Benevolent [1]?

https://en.wikipedia.org/wiki/Benevolent_dictator_for_life

I get that it rubs people the wrong way when private equity is taking competition and making money off your work. But such is open source. Burning the whole thing to the ground seems extreme.

The Board should step in.

I use wordpress at a non-profit and would go to some meetups and went to a word camp. Wordpress always seemed about people solving problems related to making a website. People were pretty nice, and Gutenberg while controversial was already done by the time I was using wordpress. Its pretty good for a in web layout tool. I think a lot of good will is being used up here. Wordpress survives on its community and plug ins, not on its technical merits.

Being open source it can always be forked. If only there was a company that has revenue that could take a fork and run with it...

Indeed, so much ink spilled on community drama but no one stepping up to fork the code.

I don't know about anyone else in this thread, but if I was offered a 9 months severance, I'd have to really, really LOVE my job to not take it.

More likely than not I'd find a job before 9 months.

I'd probably make screenshots and videos of the offer and me resigning just to make sure I get my $$.

> if I was offered a 9 months severance, I'd have to really, really LOVE my job to not take it

Agreed. The idea that people are staying for financial reasons or due to a tough job market doesn't really hold up when you've got a full 9 months of severence.

9 months sounds like plenty, but don't be hasty.

I've been unemployed for almost a year. I would not take a buyout in this engineering market. It is brutal.

Sure, but WP Engine will need to hire people to work on ForkPress. Or people can start a ForkPress foundation that actually includes stakeholders and get grants to work there. Someone will need to maintain the fork which is definitely coming.

After all, let’s say that WP Engine gives in and pays Matt 10% of their revenue. Then… who’s next? Can Automattic be trusted as a steward of the software, ever? I suppose if Matt sells the company it might be possible. Nope, the fork is inevitable and some company(s) will need to sponsor it.

So have I, and I would still be very tempted to take the 9 months severance.

Don't fool around with tyrants:

With something like this going down, I'd wonder if my employer will even be around in 9 months. I'd also worry that my employer could "go for broke" and just close its doors on me, leaving me with nothing.

So, yeah, I'd have to really love my job to stay.

Yeah this job market sucks, but as far as outside looks at Automattic go now, I have a feeling there is more trouble to come. Considering this, I would take the payout as a cushion to find something new, potentially in a new industry outright

I could see visa issues preventing some people from taking it too...

Quoting:

> In the “Alignment Offer,” Mullenweg offered Automattic employees six months of pay or $30,000, whichever was higher, with the stipulation that they would lose access to their work logins that same evening and would not be eligible for rehire.

> One hundred and fifty-nine people took the offer and left. “However now, I feel much lighter,” Mullenweg wrote in his blog.

Awesome. I'd love to see more offers like this.

If someone like Mullenweg grants you temporary economic freedom, take it.

>> One hundred and fifty-nine people took the offer and left.

Wonder how many of those that left were in the "six months of pay" bracket. I suspect most of them were in the $30,000 bracket. If you make less than $60k/year, it's significantly easier math to decide to take the payout and find another job.

I don't know why i keep popping into these WP related threads, gotta take a break... Apparently also just read that he used the .org to push a post promoting alternative WPEngine hosting to his affiliates. I have no clue what is going on anymore.

That's correct; https://wordpress.org/news/2024/10/wp-engine-promotions/

They are not even WP Engine alternatives. He listed 4 other hosts, of which 3 are owned by Automattic and the other is paying Automattic licensing rights.

It's a company town.

That would not be obvious based on a simple reading of the post!

>> “Overall, the environment is now full of people who unequivocally support Matt's actions, and people who couldn't leave because of financial reasons (and those are mostly silent),” one Automattic employee told me.

So if he keeps making the financial benefit of leaving more attractive, we should see significant uptick in people who accept? If you support Matt, Automattic is probably becoming an increasingly awesome place to work!

Maybe everyone will just leave and fork the project and run a company without this toxic brogrammer at the helm.

https://archive.ph/AKASQ

Hope these people are aware that your work computer, work phone, work vehicle, email account, slack, etc, and anything sent through an employers network (including personal devices/accounts connected to employer's wifi/vpn) can (and in many cases will) be snooped on, if you live in the US.

If you're in a toxic work environment, don't say shit on or near employer devices or over their networks. It will be used against you. I've heard too many stories of people getting screwed as a result of this at companies small and large, and I've experienced it firsthand. If you need to check something or log into a personal account, do it on your personally owned device and over a non-employer network. If you're at work, use your cell connection directly or through tethering. Employers can legally do this, so cya.

heh. Working there requires some level of trust in your employer. There is a bunch of shit you wouldn't expect on the Automattic infrastructure (NDA, so can't say much except I used to work there). For them to do this harms that trust and makes it a much worse work environment. If Automattic were to weaponize -- which this is the beginning of this slippery slope -- then any person's life could be destroyed. I really wish I could say more, but eroding that trust is very dangerous.

thats is why board is very important. this looks like one man show.

It's a show alright

That is seriously sad

For anyone working at Blind - PGP encryption on emails as an option please.

Not sure that would have solved the problem here as the company can just set up a catch-all redirect on emails from Blind’s domain(s). Blind doesn’t send out emails without someone signing up for them so it’s pretty obvious what the content would be even if it were encrypted.

Anyone can sign up as anyone. It's the email validation step that makes it 'proof' that you own the account. Just the first step in the email validation doesn't mean anything.

Like Amazon, continuing to work for Automattic is a choice.

Reply on news.ycombinator.com