The Saga of Harassment by Way2Enjoy

Originally posted on 26 October, 2022.

Note: This document is written in third person as it was originally created for use in a legal cease and desist document. It is a longer, more comprehensive, version of the story told on this site in 2021, with details expanded upon for clarity and posterity.

The Saga of Harassment by Way2Enjoy:
Home | 2018 | 2019 | 2020 | 2021 | 2022 | 2023
(Last Updated 25 May 2023)

Summary

The company way2enjoy – owned by Ravi Shankar Tiwari (aka Ravi Shankar, or Ravi Tiwari believed to be born in 1982) – uploaded and promoted several plugins into the WordPress.org plugin repository, which led almost immediately to their carrying out multiple and repeated violations of the plugin guidelines, generally concerning harassment of users and spamming. Multiple ignored warnings from the volunteer plugin team, as well as a failure to correct their behavior, resulted in the relatively rare action of a ban from hosting their code on WordPress.org on November 26, 2018.

Developers are banned from hosting code on WordPress.org four to ten times a year, due to clear and documented infractions of the guidelines – https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/ 

Developers are notified of the WordPress Plugin Guidelines before they are permitted to host code, again after, and at least one time each year, when they receive an email reminder and a notice about new versions of WordPress. In addition, developers are cautioned whenever possible about their infractions and are directed to comply with the guidelines, or their hosting privileges will be revoked. In extremely rare occasions, a developer is banned without notice, although this requires egregious behaviour against the WordPress community.

Mr. Tiwari was warned multiple times and all warnings were discussed within the plugin team and documented. He did not correct his behaviour nor his company’s conduct. The company and all it’s employees were subsequently banned in November 2018. Since that date, Mr. Tiwari has emailed the plugins address multiple times per day, sometimes from multiple separate email addresses. At this early stage he attempted to bribe Mrs. Mika A. Epstein to restore their plugins, and cyber-stalked her to her personal email (which was never provided to them) in order to ‘beg’ that the plugins and account be restored.

When this was not successful, Mr. Tiwari threatened the whole plugin team with “the wrath of Krishna” [e.g. his God]. While no one views this as a credible threat (and yes, people have made those against the volunteer members of the plugins team), Mr. Tiwari’s threat suggested that his grievance was no longer grounded in rational behaviour. This conduct then escalated to legal threats and for the better part of 2 years there have only been a handful of days without either an attempt to contact, a threat, or both.

On January 17th, 2019, the plugins team took the decision to cease contact with Mr. Tiwari, nor would the plugins team reply to any further messages or threats. At this point, legal teams from both Automattic (who owns WordPress.com and represents Matt Mullenweg, their CEO, and Samuel “Otto” Wood) and DreamHost (whom Mrs. Epstein worked for at the beginning of this epic saga) had been included in Mr. Tiwari’s harassment.  In addition to those electronic communications, his contact attempts reportedly included an attempt to contact Mr. Mullenweg on the phone, as well as sending physical items in the mail to Mrs. Epstein’s employers at DreamHost.

As a result of these escalating actions, including threats to ‘destroy’ Mrs. Epstein, purported attempts to purchase airplane tickets to the US, and more threats which remain a law enforcement matter, the decision was taken by Ms Epstein, Automattic, and DreamHost to notify law enforcement about Mr Tiwari’s campaign of harassment. As Mr. Tiwari lives in India and has not taken direct, physical, harmful actions to Mrs. Epstein’s well being, there is very little US law enforcement will do. Conversely, contacts at the U.S Department of State took note of the situation and made their own documentation.

Involved Parties

• Mrs. Mika Epstein (aka Ipstenu) – representative of WordPress.org plugins team
• Mr. Samuel Wood (aka Otto) – member of the plugin review team
• Mr. Matt Mullenweg (aka photomatt) – CEO of Automattic/WordPress.com and co-creator of WordPress
• Mr. Ravi Tiwari (aka rstbiet, way2enjoy, etc) – owner and main contact for the company Way2Enjoy and their plugins

List of Infractions

Mr. Tiwari’s documented infractions of the WordPress.org plugin guidelines is the Way2Enjoy account, which resulted in their banning, included:

• Using the forums to support premium products
• Harassing users via email following a review they disagreed with
• Following users back to Facebook to harass them regarding reviews, and leaving defamatory claims against them
• Tracking users via illegal email collection
• Bribing users with free credits on his service for reviews.
• Mass emailing people they had no previous relationship with, asking for translation assistance (i.e. classic spam email) 
• Sockpuppeting reviews (they were cautioned about this three times)
• SEO spamming in their readmes via tags and keyword stuffing
• SEO spamming with plugin names like “image optimizer – WordPress compress image optimizer, jpg optimizer png optimizer resize image optimize image compressor by Way2enjoy” 
• Repeated harassment and abuse to forum moderators and people who left them poor reviews 
• Spamming reviews for similar plugins with “Try ours!”
• Asking users to contact them off of WordPress.org
• Spamming/Harassing users via @-messaging (this resulted in their accounts being flagged for moderation, which prevents the use of the @-message system)
• Demanding WordPress delete their plugin if they were not permitted to use @-messaging 

Steps Taken for Protection

• Emails and certain free email services banned from all domains owned by Mrs. Epstein
• Contact forms protected by blacklist (made dynamic and open sourced to manage the 60+ emails)
• Harassment reported to Gmail, PayPal, Gorilla Servers (their webhost), mailsac, mail.com, protonmail, etc.
• Bribery attempt reported to Paypal
• Blocked on all social media sites
• Blacklisting code built into WordPress’s systems for email communication with any official Wordpress.org team account
• Technical and physical measures taken to ensure protection of DreamHost offices and systems
• Scripted regex filters for helpdesk system to be used for plugin reviews (and other teams) at WordPress.org
• Scripted checks in the plugin review and certification tool
• Server level blocks based on behavioural patterns, data from all other attempted contact points, and referrer traffic monitoring

History of Events

Prior to November 2018

Mr. Tiwari, using one user account (Way2Enjoy) on Wordpress.org and multiple IPs (which implied multiple users of said developer account — a fact they later confirmed), conducted himself in an erratic deceptive, and manipulative manner from the time his first plugin was approved (July 2017).

He seemed simply unwilling to accept the possibility that his plugins weren’t worth 5 stars reviews all the time and mistreated users and the forum moderators because of that. The official Way2Enjoy company account, which was the only account known, was issued a final warning in June 2018, by the WordPress.org Plugin Review team (aka the Plugins Team, or Plugins). 

A FINAL WARNING is sent in the form of an email to the offending developer, wherein they are informed that any future guideline violations (forum or plugin) will result in a permanent ban, without any further warning or notifications.

Mr. Tiwari begged for another chance and, as the plugin guidelines had been updated since that time, was given one with a note that they were expected to behave accordingly. This is standard procedure. Any time the guidelines are significantly altered, we allow a grace period for infractions unless the violation is identical to one prior.

They received a second final warning in the beginning of November (5 months later). At that time, the Way2Enjoy account was flagged for moderation, which meant that a moderator had to manually approve all their posts. This was done because they used the @-reply feature to attack and harass anyone who failed to provide them them with a good review.

It is by design that accounts on moderation are not able to use @-messaging. This is so their behavior can be curtailed and reviewed. It also prevents abuse and offensive forum posts. While some posts that are objectionable will be approved, this is done so on a case-by-case basis in order to provide a public record of someone’s actions.

Mr. Tiwari decided that his way of handling that limitation was to email the plugin review team, pleading for the moderation hold to be removed.  Plugins denied this request and informed him that the forum moderators would remove the hold when Mr. Twari and his company demonstrated, via their own actions, they were able to act maturely and comply with the guidelines.  They were also told that if they persisted in asking Plugins to overrule the forums team and remove the moderation hold, then Plugins would ban them.

The final warning stood in place: either they would agree to and comply with the guidelines, or they would be banned.

Mr. Tiwari, or someone acting in his stead, replied to this and swore they would never violate the guidelines again.

Due to the unusually malicious nature of their actions (e.g. user stalking and accusations of accounts being ‘fake’), an internal note was placed in the Way2Enjoy account asking forums moderators to report anything untoward to the plugin team and to not engage any further with the individual. This is standard practice in place to protect the moderators from targeted abuse.

2018

The week of US Thanksgiving, it was reported that the Way2Enjoy account had once again been hostile to users in the forums. On a review of the post, it was noted that the behaviour had in fact been abusive, and that rather than offering the requested help to the user, the account had instead ranted at them about how they were being pre-moderated (i.e. all posts needing to be approved before being seen) due to abuse of the @-mention system. It was subsequently edited to appear as this comment, removing initial offensive content, which is why it had been reported:

It was determined at that time, based on the previous interactions, that Way2Enjoy as a company and Mr. Tiwari as an individual had absolutely no intention of complying with guidelines, nor did they understand why they’d been censured in the first place. Repeated behavioral issues are a drain on volunteer resources, and following the final warnings issued in June 2018 and November 2018, his plugins were closed and all related accounts suspended by the Plugins Team. Mr. Tiwari was emailed of this fact.

This set off the campaign of stalking and harassment towards Mrs. Epstein and, arguably, Mr. Mullenweg as well, though he has not spoken publicly regarding the matter.

Mr. Tiwari’s initial excuse was to claim that he had no idea any of his behavior was a violation, even though he had replied to the emails telling him expressly what behaviors needed to change. Furthermore he claimed that being banned meant his fiancé’s father had canceled their upcoming wedding and she was no longer talking to him. As his marriage and social status had allegedly been destroyed, by the plugins team (!), he needed his plugins back.

The following actions ensued quickly:

Summary of Events:

• Individual Bribery – sending $5 and then $10 via PayPal to have the plugins restored.
• Email – finding Mrs. Epstein’s personal emails (gmail, @ipstenu.org and so on, which were never provided to him) and sending multiple messages to garner sympathy.
• Confession – admitting to allowing multiple users to access the developer account without monitoring
• Religion – using religious doctrine to ‘curse’ all involved (“I request Lord balaji to take away your all name, fame, respect, wealth everything.“).
• Fake emails – using multiple separate emails to attempt to evade bans and blocks, as well as to pretend to be different people wanting to know the status on the plugin.
• Legal Claims – claiming to file for legal compensation in India.
• Forums – threatening to make a new post in the forum every day until restored.
• Company Bribery – offering $100 as ‘proof’ to the WordPress Foundation that the guidelines were now understood. This increased to a $500 ‘gaunrtee’.
• Legal Filing – threatening to file for $10million (presumed USD) in Los Angeles, and asking for personal details like an address to do so. 
• Harassment via personal websites – using contact forms on all personal sites managed by Mrs. Epstein to avoid previous censures.

Suffice to say, none of that requested information was provided. At this time, his email host (then mailsac) was contacted to attempt and find a resolution, pointing to the abusive nature of the emails and how they were a violation of the terms. Mailsac took what they felt to be appropriate action, and no more emails from their services came.

Since Mr. Tiwari was also using his webhost to script ways around the various blocks, it was believed this could be a violation of his hosting terms. However, when GorillaServers was contacted, they did not reply. Later Mr. Tiwari posted that his host had, in fact, told him about the situation and ‘laughed’ at Mrs. Epstein’s emails. While this is perfectly within their rights, their lack of a reply while in turn sharing the email calls into question their commitment to trust and safety..

Full documentation on the harassment in the year 2018.
Total Emails: 76
Email Addresses Used: 5

2019

While Mr. Tiwari claimed he would no longer email in December 2019, the emails resumed before the end of the month. As of January, his story changed to how he was now working backbreaking manual labor, in order to provide for his hitherto unmentioned 8 siblings.

Of note, Mrs. Epstein’s father passed away, unexpectedly, in February 2019.

Summary of Events in 2019:

• Monetary Demands – needing $10,000 USD to ‘provide’ for him.
• Political Threats – emailing multiple US senators and congressmen claiming to be a ‘law-abiding citizen’, raising the case of his plugins, and threatening legal action via them.
• Social Media – assuming all posts Mrs. Epstein made on social media were about him (including her new glasses).
• Illness – claiming his mother was ill from the stress of this, and asking for money to see her since she lived 400km away.
• Harassment via Work Systems – opening many tickets with DreamHost (Mrs. Epstein’s then-employer) about how she should be fired, but also he wanted to mail a card/flowers.
• Harassment via Personal Sites – abusing contact forms to beg for help from people who worked on those sites with Mrs. Epstein.
• Death Threats – telling Mrs. Epstein “u destroyed my life and i ll destroy urs.” as well as to “damage [her] maximum.”
• Circumventing Ban – making a new account and submitting a new version of the Way2Enjoy image plugin, as well as another account and a new and different plugin (Pushdaddy).
• Bribery – offering to donate $10,000 to charity only two months after begging for the same amount from Mrs. Epstein, as well as offering a Tesla to both Mrs. Epstein and Mr. Wood.
• Offers to Hire – asking Mrs. Epstein to come to Chicago for $1000 or $5000 to offer ‘advice’ for his new project.
• Legal Threats (International) – claiming WordPress violates EU monopoly laws and that he will get WordPress banned.
• SEO Spam – offering to send 100,000 people to Mrs. Epstein’s personal site
• Harassment re Death – making multiple claims that the death of Mrs. Epstein’s father was due to her actions
• Change.org – making a petition to have Mrs. Epstein removed from WordPress.org (this was shut down by ChangeOrg who sent an apology to Mrs. Epstein and banned Mr. Tiwari).
• Physical Gifts – sent books (and later a card) to Mrs. Epstein’s employer via Amazon, who declined to provide any assistance on the matter.
• Harassment at Work – opening 15+ tickets at DreamHost, most demanding Mrs. Epstein be fired, she is the cause of death, and god will revenge

Parts of his story changed rapidly in January, from manual labor to ‘working in a mall’ (which he claimed was beneath him). His sister now entered his stories as as well, with him claiming that he was responsible for her upcoming marriage, but no other siblings merited a mention. By mid-January (around a month and a half from the beginning of this particular story), the Plugins team collectively decided to block his email and stop replying as it was clear this was not working.

There were also multiple mentions of Mrs. Epstein’s ‘uncle’ dying (he meant her father) and how this was her fault for banning him:

u people disresepcted Tirupati Ballji, i was knowing something very bad will happen as i have experiene of 15 times.

Similar emails followed including one that expressly said this in his ‘condolences’:

I wish, u would have respected Tirupati Balaji. I went there 15 times and he will fulfill anything u wish but if u wont go once it is fulfilled he will damage like anything. its my personal experience.

That was when Mrs. Epstein began to look into better ways to block Mr. Tiwari. Emotional abuse of someone’s dead parents is inhumane.

In April 2019, a cease & desist notice was sent to Mr. Tiwari by Mrs. Epstein’s legal representatives, including her then-employer and Automattic. Suffice to say, he objected to its legitimacy, ignored it, and retorted with the following claims about Mrs. Epstein:

• That she told him it was okay to spam-email people (she did not)
• That she did not warn him about his previous infractions (he replied to those emails)
• That there was no plugin guideline prohibiting abuse (Guideline #9)
• That she banned him for reporting a bug (he was banned prior to his complaint that moderated users cannot use @-replies)
• That she is equivalent to Hitler or those who bombed Japan (Godwins Law)
• That she is a full time employee of WordPress.com/Automattic (never)

On May 23rd, he claimed that would be his final email, as legal experts had ‘confirmed’ he had a valid case, and all future contact would be from his legal representative. This was demonstrably untrue. By December, he claimed his sister’s husband died (presumably he did, in fact, pay for her wedding):

this is my last email to you.

you are responsible for my sister husband death.

lifetime i will take my revenge back

He replied a week later ‘apologizing’ and yet saying “I was in deep anger as you killed someone in your anger.”

Overall, the amount of mail and contact was astronomical.

Full documentation on the harassment in the year 2019
Total Emails: 638
Email Addresses Used: 119

2020

Regular emails continued. At this point, the Plugin Team stoped making note of the details of every email (40 separate chains were created), however subjects were recored. Around May, when COVID was running rampant through the world, emails slowed down, giving false hope that the situation was over.

More vexatious tickets were opened at DreamHost as well as continuing emails, and the following false claims were made about Mrs. Epstein:

• That she got him kicked off Google Ads (she did not contact Google Ads)
• That she blocked his site from WordPress (she has no ability to do so)
• That she was blocking all Corona related plugins (demonstrably untrue)

Other than that, most of the emails were about COVID, the US election, and death and do not bear repeating nor provide any additional context.

Full documentation on the harassment in the year 2020
Total Emails: 38
Email Addresses Used: 3

2021

Mr. Tiwari continued to send emails in 2021, but at a relatively lesser rate. In addition, there was a single attempt to submit a new plugin. This was caught and rejected without comment.

On February 24th, Mrs. Epstein posted a sanitized summary of the events, leaving out any and all personal or identifying information, on her tech site, as a means of informing the community about the situation (which had previously been confidential) as well as starting a dialogue within the project about trust and safety in volunteer open source communities: https://halfelf.org/2021/when-its-not-burnout/

While Mr. Tiwari made no direct response to this, on March 25th he emailed saying the following:

I wont be sending you frequent emails as it might irritate you further but i am waiting for your mercy.

i think sending one reminder in 30 days is ok.

Per usual, there was no response given to his email.

In April he claimed his mother had passed away.

The final email received for 2021 was on September 4th, with the subject “It’s 1025 days” and the content:

Mam,

Its more than 1000 days still angry??? 

It was not replied to.

No other contact of note was made in 2021.

Total Emails: 9
Email Addresses Used: 2

2022

Mr. Tiwari emailed twice in 2022 (Feb and May) before the block on his email was changed from ‘save and file’ to ‘auto delete’ on 6-May 2022. This extends to all WordPress.org emails managed by that system, which does prevent him from emailing any other teams. As it was clear he will not stop, this was determined to be the best course of action.

This document, which is a sanitized and privacy aware version of events (omitting IP addresses, email addresses, and other potentially sensitive information) was created.

As of autumn 2022 his method of harassment moved to social media, such as Twitter, where his list of complaints include:

• Disparaging and attempting to defame Mrs. Epstein to anyone who would listen (calling her ‘psycho’ and ‘devil’
• Homophobic rants about how WordPress is ‘only for lesbian and gay’
• Claiming Mr. Mullenweg is homosexual
• Claiming Tumblr is only for porn as they now permit nudity
• Accusing Tumblr of child porn
• WordPress is ‘dying’ and we should all use YouTube

By November he added these complaints:

• He was being sued by Automattic (who owns WordPress.com)

On October 29th, following threats made to other twitter accounts in relation to Mrs. Epstein, his account was locked for conducting hatefully. Mr. Tiwari was required to remove his posts in order to return, and henceforth be marked by Twitter. If he were to resume the behavior, he risks being suspended by Twitter. His account was restored not long after Twitter fell under new ownership and since then, all reports have been dismissed, however that speaks more to Twitter’s current ownership.

What this indicated is that after four years, his fixation on Mrs. Epstein is as unhinged and as vindictive as it was at the start.

Full documentation on the harassment in the year 2022
Total Emails: 3 (by May 6th)
Email Addresses Used: 1

2023

Since Mr. Tiwari’s email was blocked in 2022, and Mrs. Epstein departed Twitter in late 2022 (over disputes with the new ownership), it was relatively quiet, save some ranting about WordCamp Asia.

Full documentation on the harassment in the year 2023

Conclusion

It is our belief that Mr. Tiwari, owner of Way2Enjoy.com, is professionally uncredible, personally unstable, and unable to engage in good faith with any organisation, group, or individual. It is not for us to speculate why, or to take any responsibility for “fixing” him. We can only deal with the damage he has caused, and continues to inflict every day.

Mr. Tiwari does not understand how to take responsibility for his actions, alter his destructive behavior, or communicate professionally without taking things personally, and feels entitled to success. This demonstrated pattern of behavior was detrimental to the WordPress community, even before the personal harassment events detailed in this document began.

Nor, after multiple threats, reneging on promises, and widening his harassment as far as elected officials outside the project, is there any way back for him, period. His behavior – only a fraction of which has been made public here – has in fact been so deranged that the WordPress.org plugins team has had to contact its counterpart teams in other projects and software communities to warn them about his conduct, as he has threatened to take his work to them. 

It is the responsibility of open source communities to protect their contributors, its volunteers, and its users from abuse, wherever that abuse comes from. It is a credit to the volunteers of the WordPress.org ecosystem that they continue to safeguard the project community from his physical, legal, verbal, and emotional threats. They have been quietly and diligently doing so for over four years, and have done so in a professional and dignified manner, never once publicising the offensive behaviour to the wider community, or naming the individual, even as he has not hesitated to name them.

But enough is enough.

Mrs. Epstein, her family, her friends, her colleagues, her project teams, and her community did nothing to deserve the hell that Ravi Shankar Tiwari has put them all through, verbally, emotionally, mentally, and physically, since 2018.

Today is the beginning of the end, once and for all.