There was a problem company.
Among other infractions, they’d sockpuppeted a few years back but calmed down. Or so we thought. Then the forums team pinged Plugins with a list of 415 separate user accounts. You read that correctly. But it was worse than it seemed. Using l33t DNS skills, we traced the sock puppets to not one, not two, but three separate accounts!
Three. Separate. Plugin developer. Accounts. No, it’s not a return of Zorro!
Let’s call them Shemp, Moe, and Curly!
The Three Stooges
When I got reports about fake accounts, I always pull up the plugins to see if I’d left notes. One of the things the notes includes is adding and removing people with commit or support access, and via that I was able to see they’d been trading plugins between the three accounts. The same 6 or 7 (I forget the exact number) plugins would add one of the other people to the plugin, remove themselves, and then repeat it a few months later.
People like this actually why we now track when people are added to plugins and when the ownership is transferred. It’s generally a bad-faith move to swap around that much, and honestly I’ve never understood why people would bother.
So I did what I do and checked the submission IPs. Lo, Shemp had used multiple IPs to submit their plugins, and two of those were used by Moe and Curly. That of course isn’t rock solid proof, so I sent three slightly different emails to each one.
- Moe had their plugin closed and was told that for the sin of egregious sockpuppeting (most of the fake reviews had to do with their plugins) they were banned. Also since Moe had been warned before, they weren’t getting back in. This was strike three for the same offence.
- Curly was told that their plugins were closed because account was connected back to another which had seriously violated the guidelines, and could they please explain the connection so their plugin could possibly be restored.
- Shemp was told that DUDE WHAT THE HELL? Banned for super spamming, making multiple accounts, etc etc. I told him there were over 500 accounts, though.
Only Shemp replied.
Confessions of a Stooge
Shemp’s reply was …. interesting. First he argued they’d had no violations for a month (which is confirming the previous issues), he then admitted that Moe was indeed his other account, and asked for another chance. After all, he had hired a marketing company and it was all their fault. Oh and by the way, Shemp was partners with Curly.
So I pointed out Curly had been emailed separately and if they were indeed a separate company, Curly should reply to that email. (Narrator: they did not and have not). Then I explained that when you hire someone to do a job and they fuck up, it’s your responsibility. Especially when you hire a company that does that level of spamming after you’d been warned specifically about it three separate times.
Shemp replied, saying he understood how serious the matter was (doubtful) and was accepting responsibility. Please have mercy for people who did honest work. Except the part about the sockpuppeting and multiple accounts. Please give Shemp and his company a second chance.
Technically it was their fourth. And frankly after you’ve been warned once to not make fake accounts, a business should have the sense to stop. Or, as I said:
Making the same mistake three more times after you were warned means you either didn’t care enough to monitor your consultants or you didn’t think we were serious when we told you the last time that repeat offenses will result in being banned.
Me to Shemp via email
This was followed with a reminder of how one can host code outside of wp.org, have a nice day.
Time for Eye Poking
Shemp said he was shocked to know it was this bad. Shemp had also gotten and opened (and I presume read) an email with the subject FINAL WARNING RE BEHAVIOUR ON WORDPRESS.ORG. In all caps. It detailed out everything with fake accounts. Shemp was stunned this ended with the ban I said it would. I know he opened it because we track that.
This means that Shemp was warned about sock puppets three times, but he continued to hire the companies that made the fake accounts, and he was surprised there are consequences? The ‘reason’ for the mistake is probably that the separate teams that used the separate accounts were unmonitored and unmanaged, allowing them to do whatever they wanted. And see, this is why multiple accounts like that is stupid.
Then came the best bribe I ever got!
I have an offer for you. 50% of revenue lifetime, not the income but revenue for you!
Shemp via email to Plugins
Admittedly, his revenue was probably pretty slim, but it was way better than the $10 and $50 bribes I usually got. Oh and Shemp promised to never tell anyone I accepted a bribe.
How does that saying go? Two can keep a secret if one is dead?
Declined. Banned harder. Curly and Moe (being probably all Shemp) never replied.
PS…
A week later, Shemp slacked me and offered to ‘fund’ LezWatch.TV for me. Which led to him getting banned on Slack when I mentioned it to the admins.
Later I told my forum sock-puppet-hunter friend about this, and he asked why I told them fake numbers for the amount of sock puppets. I like to give them wrong numbers on purpose. Once I told someone he had 20 sock puppets and he argued he only made 10.
It’s like working with toddlers some times.
