Hacker News Reader

Comment by bsza | Hacker News Reader

Except Copilot itself is not open source, so your only way to feed that proprietary code into it would be to upload it to github, which would make you an infringer.

View on HN

> your only way to feed that proprietary code into it would be to upload it to github, which would make you an infringer

Somebody has to do it. Someone ready to take one for the team (or better yet, already skilled in software piracy, so that it's not a big deal for them). Then, if this argument holds, everyone gets the result in public domain.

As I see it, the argument presented in this post essentially makes Copilot to be an universal copyright laundering machine. Not just for code, but for anything that can be represented digitally.

Obviously this won't stand. While I can see Github ending up protected from all liability, the only way for this to not kill copyright is for the users of Copilot to become at risk of copyright infringement. Which kills the whole value proposition of Copilot.

This seems like a good time to ask what the heck is the value proposition of a thing like this. Are people really going to use the output of this blindly? And if they're going to audit every line - is that really easier than just writing the code yourself? Honestly, at best it feels like a machine for introducing pernicious bugs that "look right" but are semantically wrong. (Which reminds me - were any of the Underhanded C Contest entries in the training data?)

That's a very good question. On the surface, the idea seems to be helping people write code faster - but as you observe, properly auditing generated code is more work than actually writing it from scratch.

Best I can think of in terms of real value delivered, is helping people with first drafts, breaking through the "staring at an empty page" problem. But even with this, I feel it's too risky compared to doing a StackOverflow search, where you can at least see some explanations, discussions, and other relevant context.

It's definitely an interesting vision demonstrator - despite not being quite there, it lets us see that a tool like this that actually worked well (in terms of generating correct, explainable, license-respecting code) would be very useful.

Assume GitHub designs a filter to detect similarities to the training set and displays an attribution link with the result, as a comment. It's no different from using a search engine to find the code and putting it in your project, especially that the code is public already and visible to multiple search engines. You are ultimately responsible, just like you are every day with Google.

But the model has on average just 1 regurgitation in 10 weeks per user, so you can just discard all of them.

Almost all the output of Copilot is not an exact copy of any code in the training set. You discard the 0.001% of generations that are similar to the training data and use the rest.

Can they afford it, though? The most important feature of DNN models is that they're orders of magnitude smaller and cheaper to run than training data; checking each output against the training set will make the model orders of magnitude more expensive to run.

As you type you send the code you're writing to Copilot's backend.

From the copilot telemetry docs [0]:

> The GitHub Copilot collects activity from the user’s Visual Studio Code editor, tied to a timestamp, and metadata.

[...]

> This data will only be used by GitHub for:

[...]

> - Improving the underlying code generation models, e.g. by providing positive and negative examples (but always so that your private code is not used as input to suggest code for other users of GitHub Copilot)

I'm inclined to believe this. After all, why would they taint the training data with code from a random guy who is asking for help when they have more than a hundred thousand repos with 100+ stars?

[0] [https://docs.github.com/en/github/copilot/about-github-copil...]

Sure, perhaps they won't use it for training, but the fear is they would use it for corporate espionage, market research, etc. Compared to training, this would be both more useful and much easier to keep deniable / under wraps.

I've had previous employers that were highly concerned about far more innocuous data leaking to competitors, e.g. autocomplete search terms. This means that a Copilot installation at any company that competes (or might compete) with MS should be considered a security breach, IMO. Given Microsoft's presence in so many markets, in general I think it would be foolish to risk this at any company.

You're still sending your intellectual property to Microsoft and hoping that they do only what they say they do with it, and that whatever they do with it will never change.

From context, I thought you were suggesting the strategy "just type pirated proprietary code into the IDE and the Copilot plugin will automatically include it in the training data", since my earlier comment was about the difficulty of training Copilot on such code. I don't believe they won't abuse your work in other ways either.

You're assuming Copilot is the only AI-powered autocomplete?

No, but parent comment did say, "feed all proprietary code into GitHub Copilot".

Reply on news.ycombinator.com