(And charging for a product which adds value to your developer experience and needs money to be run is not a bad thing)
Uploading it to Github does not transfer ownership or imply allowances for any use. If you upload it without a license it is a copyright violation to copy the code. Even with an MIT license it is a copyright violation to copy the code without attribution.
> I don't see the point of being pissy about Github using it, I'm saying this as someone who's written quite a lot of MIT code.
People are probably angry because this is yet another case of a big multinational corporation abusing unclear or difficult to enforce legislation for profit.
That was my take originally, but apparently this is not as cut and dry as you may think:
https://www.technollama.co.uk/is-githubs-copilot-potentially...
It sounds like this writer doesn't understand the point of the GPL or the distinction between free software and open source. Also quite a crude historical perspective given the increasing number of major projects licensed virally. Claiming that MITL's popularity justifies pirating GPL code makes no sense.
... less "problematic" for who, exactly?
That is conveniently left out.
more permissive for whom? because the GPL is the most permissive license for users of the code: GPL guarantees, they're permitted to see the source.
The proper term is "pushover"[0][1].
0: https://www.gnu.org/licenses/license-recommendations.html#sm...
Most Open Source code comes with a requirement to carry over license note, which Copilot does not do. Additionally, ethics dictate you attribute the source when copying directly, something the Copilot also doesn't do.
It's already been demonstrated that Copilot - like all tools in the GPT family - frequently output large chunks of their training dataset verbatim. It's not hard to trigger this behavior, even unintentionally. To me, this is much closer to "reusing". But I'm not a lawyer.
It's also worth remembering that there are two parties potentially open to liability here - GitHub, with the way the code was used with the Copilot, and the user, who may be unwittingly including licensed code in their codebase. Given the well-known behavior of the GPT family I mentioned above, it might be hard to argue that Copilot "just chanced" into generating code that's identical to existing, non-public-domain code.
Ah, that then is extremely problematic.
I really like the idea of Copilot to speed development-- basically code completion taken to an extreme-- but this seems like a very bad way to go about it.
Pretty much anyone can scrape GitHub and train their model.
What exactly is the legal implications of this has yet to be tested.
Pretty much every model is susceptible to some sort of model inversion or set inclusion attack.
By their own admissions Co-Pilot sometimes outputs PII that part of the code and code snippets verbatim, even if it’s rare iirc around 0.1% it’s still a huge legal liability for anyone who uses the tool, especially since it’s unclear how these inclusions are spread out and what triggers them. For example it could be that a particular coding / usage of Co-Pilot style or working on a specific subset of problems increases the likelihood of this occurring.
ML is too new to have been tested in court this has more ramifications beyond just licensing, for example if you use PII to train a dataset and receive a GDPR deletion request do you need to throw away and retrain your model?
I don’t think people should be angry however I also think that this needs to be test in court and multiple times before this can be “safe to use”.
But I also don’t think that the ML model is necessarily a derivative work.
For example if you use copyleft material to construct a CS course someone would be hard pressed to argue that the course now needs to be released freely yet alone that anything that the students would write after attending the course would fall under derivative work too.
why is it different if a slightly more complicated data structure is used?
All I’m saying that you don’t need to be a huge corporation to do it, and that others are doing similar things as well.
I passed on Snyk code due to similar concerns especially since they pull out examples from FOSS projects directly and even had a “fix me” option where they push pull requests into your repo with fixes.
On ML in general the current policy I’m working on for my org is that we do not use any pre-trained models trained on public data and pushed the legal team to actually start figuring out how we should deal with these issues properly in the future.
ML currently is a Wild West it’s too new to have been tested and defended in court regardless of how to chips would or should fall.
As far as your specific example it would really depend on what data is actually preserved.
Since they do parrot whole code snippets comments and all it seems that they don’t have a generalized model at least for every problem.
However it’s also my personal legal opinion (ANAL) that if you can prove that the model holds nothing but a generalized solution for a given problem the code it outputs isn’t a derivative work anymore than a the code of a person learning from copyleft code.
However then there is the whole issue of “allowed use” none of the existing licenses specify if the code can be used to train a model, this also means that we probably need to update all existing licenses to include a clause that explicitly states the limitations for this use case.
For code under existing licenses the fair use needs a proper judgement.
My gut feeling would be that it would count as fair use just as using code in a course or a book would be. GitHub definitely needs to make a page with attributions tho for that to happen and make sure their model doesn’t output anything but a generalized solution.
it's worse than that: it's Microsoft trying to completely undermine the concept of open source
meanwhile: they're unaffected as their high-value proprietary code remains private and doesn't train the model
They need developer mindshare and they lost a lot of developers in the 2000s. Buying GitHub (and being involved in 100s of projects) brings this mindset of Microsoft as a developer company back to developers. Like as an advertisement platform/branding for some novel technology like this CoPilot.
More explicitly, how would a license that gives everyone the right to copy, modify and redistribute source code for any purpose without compensation or attribution have prevented Github from building a tool that copies, modifies and redistributes source code without compensation or attribution?
Does anyone have the numbers before they bought github, I saw them once, don't remember the values, just remember being shocked at what percentage of the total github code base was Microsoft. I had no idea they were using it at all.
If you upload code to GitHub, you grant them (and every GitHub user) a license to do exactly what Copilot does.
This ToS change happened 2017, and I actually had to get approval from all contributors of my projects to accept to the changed ToS: https://github.com/justjanne/QuasselDroid-ng/issues/5
What GitHub’s doing is shady, but it’s been obvious it was going to happen for years.
Is not that reproduction?
This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video.
This license does not grant GitHub the right to sell Your Content. [...]
So, it's not clear if they could charge for Copilot, given that last line, but indexing, analysis, and sharing with other users are all included.
To be clear, a piece of code that creates a copy of some GPL code is not a problem by itself. However, it's misrepresented as something the tool "generated" rather than code belonging to an existing human actor, without appropriate attribution and licensing info.
Does this mean that if you picked up GPL code from gnu.org and put it in your public repo, you're in violation of the GPL for illegitimately licensing that code to gihub under a non-GPL-compatible license? Maybe!
Even if said code was licensed to Github for sharing with other users (e.g. displaying it when another user browses the page), that doesn't mean that the same permission is given to all other users under the same conditions. Or allows them extra liberties, like using said code for purposes other than "sharing with other github service users".
You can upload code to GitHub without the ability to grant such a license, or is github now only for primary copyright holders?
That is how I interpreted the 2017 ToS change: You can only upload code to GitHub if you’re the primary copyright holder, or the code was already on GitHub to begin with (which is only an issue if the primary repository of some project is another git host, e.g. gitlab).
Probably a copyright violation. There are surely circumstances in which copying a small portion would either fall under fair use, or for other reasons not constitute a violation. The question then is whether or not codepilot is causing a violation. I don't think it's as clear cut as most commenters are making out.
All in all though, it's probably going to take a few court cases to figure out. In the mean time, I'd expect most companies to steer clear of codepilot.
I believe that gives me the right to be mad and to demand they fix their violations, one way or another.
"The above copyright notice and this permission notice shall be included in all COPIES OR SUBSTANTIAL PORTIONS of the Software."
Reusing a snippet doesn't require reproducing the MIT license. People who publish MIT software know they're basically giving their code out with basically no strings attached.
However, GitHub should be careful with the GPL variety.
This does not relieve the person using the code of the responsibility to make that determination, so anyone who is re-using code shown to them by this automated tool is doing it without having fulfilled their responsibility under the license. The fact that they don't know they are doing this, because the tool is not telling them, doesn't change that.
> People who publish MIT software know they're basically giving their code out with basically no strings attached.
No, they aren't. The license has terms. Using an automated tool that doesn't tell you when you are re-using existing licensed code, or whether your re-use is within the terms of the license, doesn't mean you can just ignore the license. It means you're re-using code without knowing whether or not you're violating a license.
In light of Google v. Oracle going as far as the Supreme Court I find your confidence in this quite astonishing.
I'm pretty sure every court will instead interpret the word "substantial" in the MIT license as referring to the concept of "substantial similarity", which must be demonstrated in any copyright infringement case - https://en.wikipedia.org/wiki/Substantial_similarity
I distribute software under the MIT. "Basically no strings" != "no strings". I expect attribution for any derived program which has substantial similarity to my software.
I regard the presence of the word 'substantial' to indicate that the license applies to even modified forms of the software. As that Wikipedia link points out:
> Under the doctrine of substantial similarity, a work can be found to infringe copyright even if the wording of text has been changed or visual or audible elements are altered
Innovation should push boundaries.
We shall see, by Googling some of the code it spits out.
FWIW GPT-3 doesn't really tend to spit out verbatim reproductions of copyrighted books.
HN discussion: https://news.ycombinator.com/item?id=27710287
What is happening here is we’re running into exactly what modern ML is NOT capable of: deductive reasoning. It does not think “I need to query the Twitter API for some posts, then filter them. Right, the API works like this…” No. It doesn’t think at all. It is a regression machine. “This sequence begins/looks like something I have seen before, here’s the corresponding output modulo adaptations.”
ML does not self-reflect, question motives and analyse causes. It’s just a complete lie to suggest otherwise, and to call this “pair programming”? What an absolute joke. It’s a lot like Tesla calling its glorified lane keeping an autopilot.
But it does spit out whole paragraphs at a time. This is easy to test by going to any of the GPT-2/3 playgrounds on-line (e.g. AI Dungeon), and playing with prompts. Very specific prompts work best, but sometimes even with a generic prompt, if you let the model continue on its own past the first output, it might just shunt itself into a path where following the most probable continuations happens to reproduce a substantial portion of some work verbatim.
You would sue.
And then Github would argue that their algorithms did not spit out verbatim the code by copying but rather it generated code that looked exactly like the other code based on learning from millions of codebases. ¨
And then there would be lots of lawyers.
And then a judge would have to decide.
GitHub really needs to clarify which code was allowed for inclusion here. Until then we're can only speculate And enumerate potential scenarios.
So the judge would look at two pages of exactly the same code and then decide whether the "not really copied" part is big enough to be considered an original work or not. If it is big enough it is a copyright violation. Nobody cares that you used an algorithm in between, you took the original as an input and ended up with exactly the same thing as an output, copyright violation, case closed...
The Apache 2 license allows for commercial use, but has implications for the way you can enforce your software patents. It also requires distributing the license file along with your application.
Complaining that companies use the software you told the world was free to use without restriction is dumb. However, not everyone gives away their software for free without restrictions. The fact that Github isn't respecting those licenses is a much bigger problem.
The tool autocompleting some random guy's personal information because he uploaded his blog to Github is highly problematic. The idea of using permissively licensed code to train an AI is not bad, but some human with knowledge of software licenses would need to pre-select those projects.
If all code came from one of those "do whatever the fuck you want" licenses, then there wouldn't be a problem. I'd consider it to be a great product and have no issue paying a fee. There's a huge market for a Copilot product, but this iteration just.. isn't it.
The GPL is completely compatible with commercial use. You just need to share modifications to the source with anyone you share the binary with. Many tech companies make extensive use of GPL software, and since they are not providing binaries to their end users they don't even have to share their changes to the source.
Even the AGPL, which does require you to share the source with users, still completely allows commercial use (though not compatible with as many business models).
True, the web loophole is a way around this, assuming the GPL'd code isn't part of the compiled/minified/integrated frontend Javascript libraries that gets sent to the client (because then you have the exact same problem).
It's not that commercial use is prohibited by GPL3, it's more that most businesses do not want to risk accidentally releasing a version of their software that requires them to share all source code to that version. And even if you're producing open source software, GPL3 might still be a problem because of incompatible licenses (see ZFS for an example) if you don't own _all_ the copyright so you can dual-license your software.
But what's bothering me about this is that it's not a small company doing this. It's a company that's got crazy amounts of cash, who has been trying to trade on a "we're nice now and we love open source" image in the last few years, now taking all the open source code and balling it up in a closed-source app they will charge us for.
I'd be fine if I got to use it for free, extend it to whatever editing platform I like through its open API, and it was a part of an open project.
But right now it looks like they'll charge, and that bugs me.
I think this situation is slightly more complex but that sentiment is at the heart of a lot of pushback against things like this.
The MIT license doesn't require attribution for small snippets, only for full copies or substantial portions.
$BigCorp: "I want to use to use Dev's code for commercial purposes as he has explicitly granted me the right to do so."
Dev: "Wait, no not like that."
As much as I am a proponent of permissive licenses (my favorite is the wtfpl), you have to pick your license wisely especially if you're going to be picky about usage (Be it by $BigCorp, government agencies, or other companies that you might not be fond of).
If you really want "full control" over your code you have to make it proprietary.
Github/Microsoft is going to take your code, and then cut off your access to it. This is what the GPL was designed to fight, so they're going to try it this way instead.
Those who do not learn history yadda yadda.
Remember, the GPL isn't fundamentally about "enforcing licenses," it's a tool that reverses the usual power of copyright for a higher goal of "software freedom."
If so then what about private repositories with a permissible license but not been made public for what ever reason.
What about those projects whose dependencies has permissible license but main repo doesn't? Can GitHub just go oops!
I think the point that so much confusion exists regarding their product & possible violation of user's trust is a valid reason to be pissy about.
But we didn't.
Where is this MIT licensed codes of yours, because it definitely is not on your github.