hckrnws

It feels like the recipient company did an awful lot of work in response to what was at best a fishing expedition. A serious complaint about licensing that demanded a real response would have been sent by post. It's not clear to me that scattershot LinkedIn messages deserve any response at all. The fact that the initial message lies about trying to contact him another way is another check in the "ignore this completely" column.

The same way that I wouldn't bother to fact-check a spam phone caller, why give any credence to this kind of thing?

The author explains this - initially, responding to the Mootype rep was not really given much thought or concern, for the same reasons you point out.

But then the rep started emailing EVERYONE, until eventually someone's manager started to panic about it. And when managers start to panic, it becomes everyone's problem.

So really this ended up being simply a successful scare tactic by Monotype.

But when it turns out to be a basically fraudulent report, now they suffer reputational damage both internally to this company (who I expect would now instruct any design agencies they use to not use any Monotype fonts in their projects), and now externally as this is reported on! So the 'scare tactic' might have been successful but the overall exercise actually seems pretty damaging to Monotype all in all...

I always assumed ppl deleted this sort of spam. It was kind of interesting to hear what happens if you indulge it.

I know how much fun it is to rag on lawyers, but this is pretty much exactly why companies have legal departments.

This should have been referred to the company’s legal department, who could have coordinated the response and/or investigation (if either were warranted), and then decided how to deal with something that sure looks a lot like invoice fraud.

This wasn’t a technical issue or a business issue; as soon as Monotype alleged a license violation, they made it a legal issue, and the lawyers should have been involved from that point on. It makes no sense for some random tech guy to be taking a meeting or handling the response on a licensing dispute.

> companies have legal departments

except that most don't, and the lawyers they can call are much more expensive than their internal employees

And quite likely more expensive than the spurious license fee. Lawyers and businesspeople might pay them to go away, it takes a (self-proclaimed) nerd scorned to go for justice here!

I very much doubt it would be more expensive, even for whatever the going rate is for a spray-and-pray license scheme. In a half hour phone call, a decent lawyer can learn the facts and assess this fact pattern and say “this is a fishing expedition, don’t respond, call me back when they send a demand letter (they won’t) or file a lawsuit (they won’t do that either).”

Allegations of copyright infringement where the person making the allegation hasn't done due diligence need to be illegal and subject to civil penalty. The penalties for actual copyright infringement can be so severe that we cannot allow all the copyright wolf-crying that happens.

I wonder if it’s possible to demand vendors send billing agreements before running an audit like this:

We’re reasonably sure your report is incorrect, and it doesn’t contain compelling evidence to back up its claims.

Our standard auditing fee for requests like this is $10,000, pre-paid to an escrow account and refundable if we find the use of an unlicensed font.

Or something. Not a lawyer.

Why would someone ever respond to unsolicited spam concerning a legal issue from an unverified contact via a third-party social media network.

Even the rather small company I work with would have sent a reminder to everyone to not interact with these messages.

Does sending a personal LinkedIn message to a random employee even count as "contacting the company" in the eyes of the law?

This reminds me of the Blue Jeans Cable / Monster Cable shakedown nonsense.

https://www.bluejeanscable.com/legal/mcp/index.htm

I wish I could find the original writeup from Blue Jeans, it was frickin' magnificent.

Wikipedia suggests:

Letter: https://www.bluejeanscable.com/legal/mcp/monsterletter.pdf

Exhibits: https://www.bluejeanscable.com/legal/mcp/exhibits.pdf

Response: https://www.bluejeanscable.com/legal/mcp/response041408.pdf

Paying for fonts is something I will never understand, I have a perfect vision but I'm nearly blind to fonts it makes nearly no difference to me (except for windings)

Wingdings isn't really a "font" in the same way that Times New Roman is a "font". Wingdings and and Webdings were basically proto-emojis, a vestige of the old "dingbats" publishers would put at the top of chapter pages to make them look nice.

https://youtu.be/JdKV1L1DJHc

Lucky for you the article makes it clearly understandable.

I'm not typically sensitive to AI-sounding text but those image captions leave me understanding others' issues with it.

It sounded like something a screen reader would say to help visually impaired visitors. But I don’t actually have a clue what screen readers do say.

Do these tactics ever work out for companies in the long term?

Over my 20 years in tech, I've seen a couple cases where someone installed something they shouldn't have and we got threatening emails from the companies who somehow caught wind.

It's always resulted on our side with a total corporate ban on using anything from that company, even things that are otherwise OK / open source.

For instance at a previous company I worked, Oracle came calling for "VirtualBox Tools" trying to charge us some asinine amount because like one user had it installed and they wanted us to pay seats for the entire company. This resulted in a swift and decisive total corporate ban on VirtualBox.

I've seen this at a couple companies and can't imagine we're alone in this. You're trading long-term business for short-term gains.

Oracle is still in business despite using these type of tactics for decades.

Oracle is, Rambus is still around, Qualcomm appears to be quite strong.

I feel for font foundries, it's hard work to make great fonts. People want great fonts. Actually paying for them is kind of an afterthought. It sort of seems like some of the big ones should put together an MPEG like group, get all the major foundaries to join and then have a couple licensing options. Some annual fee based upon your use and application and you get to use all the fonts. If it was like $120 or less for personal use, I think I'd buy the license for the family. I suspect they'll want 10x what I think is reasonable.

“But before responding, the digital team would do their own investigation into the fonts we use and the licences we own so we could verify everything was in compliance. […] messaged a dozen or so more people from different parts of the business, hoping to hook just one person who would reply to the scary message they were sending.”

Piece of advice for the future: if you receive a message like this, and don’t want the sender to reach out to other people in your organization — acknowledge the message.

…I would think the appropriate behavior would be for the security team to send an announcement stating they've seen an uptick of phishing emails, with an example screenshot, and to please not respond to phishers.

The business has no contract with Monotype, has conducted no business with Monotype, and has also (as they double checked) committed no infringement against Monotype. In short, the Monotype sales rep has no entitlement to any of the business' time.

And yet they managed to get quite a lot of it. It looks like double digit humans spent double digit hours, some of that totally in parallel to each other by accident.

In part, that's because all the people who got nerd-sniped by this didn't ever actually send a response back. In part, it's because several different business units decided to try to Handle It without doing the rational thing of centralizing to legal counsel.

> acknowledge the message

I think it is more nuanced than that -- they are sending a message via LinkedIn, is it really the company or a scam?

You should take time to respond appropriately and not be rushed in all cases. By acknowledging the message they'll want to continue the discussion. It's probably worth considering a standard response to approaches like this, along the lines of "Please contact us on generic-something@domain, I cannot discuss this on my personal social media account."

I thought the standard procedure is to forward the message to the appropriate department. Never give any acknowledgement.

By spamming multiple people at multiple departments, Monotype is probably relying on one department screwing up and responding with something that’d strengthen their (non-existent, apparently) case.

Since their behavior is indistinguishable from scammers, it probably makes sense to also ask procurement/design to additionally ban the vendor.

If they're following scam rules, they're not going to stop until they get someone hooked and engaged.

One can only hope some journalist is reading this and decides to turn it into a news story

Journalistic attention can be very helpful at getting companies to reform bad behaviour (at least temporarily)

This is like the old IBM shakedown playbook "we have thousands of patents, if we dig enough we'll find one you infringe upon, so better pay for peace of mind". I do assume that like in the case of IBM, some companies do pay...

Wow, perhaps Nintendo/Konami actually learned this tactic from IBM, threatening smaller game developers with patents when their case for copyright is too weak...

In the United States if someone makes a false statement about you, comminicates that statement to a third party, and that statement can or has caused financial harm, you can reocover damages in court. If there are similar laws in your country. it's probably worth sending a demand letter to cover the time wasted on investigation.

I think monotype would argue they only sent the message to the company they were shaking down.

Of course, LinkedIn’s ToS might beg to differ. I wonder if the bar is worded like a big and statement like you said, or if the disclosure to the third party has to be part of the chain of harm or something (and what precedent says).

There are multiple relevant elements to defamation in the US: https://www.thefire.org/research-learn/defamation-and-first-...

What 3rd party was involved here?

The author of this post wasted so many people's time on a self indulgent quest to prove an automated linkedin message wrong.

Do these people have no actual work to do? Refer to legal if you really feel compelled, and just move on...

Comments like this make me think that a "downvote" button at HN would be quite handy.

You need to have enough HM karma to see the downvote button. A long time back it used to be 100, no idea if it still is. Have an upvote to get you a step closer.

I never downvote. Used to, but stopped.

You'll get a downvote at 500 karma.