Hacker News Reader

Comment by glitchc | Hacker News Reader

I disagree with this article. GitHub Copilot is indeed infringing copyright and not only in a grey zone, but in a very clear black and white fashion that our corporate taskmasters (Microsoft included) have defended as infringement.

The legal debate around copyright infringement has always centered around the rights granted by the owner vs the rights appropriated by the user, with the owner's wants superseding user needs/wants. Any open-source code available on Github is controlled by the copyright notice of the owner granting specific rights to users. Copilot is a commercial product, therefore, Github can only use code that the owners make available for commercial use. Every other instance of code used is a case of copyright infringement, a clear case by Microsoft's own definition of copyright infringement [1][2].

Github (and by extension Microsoft) is gambling on the fact that their license agreement granting them a license to the code in exchange for access to the platform supersedes the individual copyright notices attached to each repo. This is a fine line to walk and will likely not survive in a court of law. They are betting on deep lawyer pockets to see them through this, but are more likely than not to lose this battle. I suspect we will see how this plays out in the coming months.

[1] https://www.microsoft.com/info/Cloud.html

[2] https://github.com/contact/dmca

View on HN

The part that feels really obvious to me is that, if I made an AI that could generate music by looking through the entire (copyrighted) back catalog of the Beatles for example, and it would output music that I could control to be very much or even exactly like the original recordings, or I could accidentally do it, that it wouldn’t really be a way to launder the original licenses/copyright into the public domain.

Or maybe it is, but if so it essentially means the end of licensing because it would be trivial to make an AI that can take an input and produce the same output. Or maybe even cp is good enough to strip the source of its original license in that case.

Open source licenses are worth protecting or you break the cycle that helps more software be open.

You're giving AI too much credit, it's just a tool, it does not have it's own intentions.

I.e. if you buy a piano or a guitar, you could play and record copyrighted music on it. That's not piano's or guitar's fault though, it's yours.

It sounds like you might be the one giving it too much credit. AI is a glorified markov chain, which is essentially a compression algorithm. I agree that it can be an instrument (I've done it: https://soundcloud.com/theshawwn/sets/ai-generated-videogame...) but it's almost trivial to train a model that memorizes by rote.

Suppose a model was trained solely on a single Beatles album. It could only spit out that album. That would be clear infringement, wouldn't it?

It’s funny that people say it’s a glorified Markov chain.

No. It’s not. A Markov chain has some very specific properties that are absolutely not fulfilled by GPT-3 models.

Just say “stochastic” if you want a buzzword. Stop appropriating Markov chains.

“It’s a stochastic” doesn’t flow, though I guess I could use "stochastic random walk."

What properties does a gpt-3 model have that a Markov chain doesn’t? (Other than effectiveness.)

ANNs aren't Markov chains

Well, yes. And apples aren't oranges, but they share a lot of similar traits.

"Given a prompt, provide a completion" is what a Markov chain does. GPT-3 is exactly the same, in the sense that apples and oranges both satisfy your hunger.

Is calculator.exe the equivalent to TI-84?

I would say that a TI-84 is a glorified calculator.exe. The TI-84 is usually more effective, but they’re both calculators.

Willfully misunderstanding your interlocutor seems ungracious, you apparently know stochastic is an adjective, so why did you try to use it as a noun?

GPT-3 is conditioned on the entire input sequence as well as its own output, which is strictly NON-MARKOVIAN. In fact, the point in saying something is Markovian is exactly that: the state transition probability only depends on the current state.

But the current state could include all of the last N output tokens.

Actually GPT-3 is a Markov chain. A Markov chain is a very general term. Just because the simplest ones are stupid, doesn't mean there aren't smarter ones.

A Markov chain is a model where: (1) there is a state, (2) the probabilities of the next state depend only on the current state.

That could describe anything from a wet fart to a deterministic computer to GPT-3 to the human mind to quantum mechanics (the real one, not a simulation).

If I unplug the Internet and all USB devices, my computer is a Markov chain with at least several trillion bits of state, so 2^(several trillion) possible states. And there is one next state, which has a probability of 1, and all other possible states have a probability of 0. That's a Markov chain.

GPT models choose the next word probabilistically, with the probabilities chosen by feeding the previous N words into a neural network. That sounds like a Markov chain to me!

A typewriter vs. a machnine that recites paragraphs of shakespeare are two different things.

Neither of them unbind the content from the original license, though.

When I press 1 key and it plays copyrighted music, that is the piano's fault.

Even if hypothetically there was such a strange bug in your piano and you decided to exploit it by recording copyrighted music and redistributing it, you would be accountable for it, not a piano.

This analogy train went too far, don't you think? All examples that I've seen on Twitter require quite an intentional manipulation by human for Copilot to produce something copyrighted. It does not recite Linux code by pressing 1 key.

If you have an electronic piano that requires a complex series of button pushes to produce copyrighted music - that's still a copyright violation. Copyright law has no notion that the difficulty of reproducing copyrighted content effects the fact of a violation.

> an electronic piano that requires a complex series of button pushes to produce copyrighted music

Surely a judge presented with the "complex series of button pushes," otherwise known as playing an instrument, would hold the player accountable for any infringement and not the piano?

These analogies have gone so far off the rails that I can't tell which side this thread is arguing for by now ;)

I think the whole swirling discussion is a little confused because there are potentially two "ends" where infringement could happen, and different people are talking about each. And the article covers both.

One end is GitHub's, at the input: Copilot's "database" was initialized from code that GitHub does not have copyright to. The contention at this end is that they are ignoring the licenses that would grant them the right to use that code.* The article, GitHub, and others assert that there's no copyright issue for creating a database of this kind (a machine learning model).

The other end is the the developer taking Copilot's output. The article seems to take the (absurd IMO) position that there's also no copyright implications here, because the output is not copyrightable at all.

*And personally this is the side that concerns me most.

If you have a piano that plays copyrighted music when you press a single key, isn’t that the piano maker’s fault?

Edit - googling, the history of player pianos vs copyright is interesting

https://slate.com/technology/2014/05/white-smith-music-case-...

https://www.techdirt.com/articles/20100712/18325210185.shtml

It could end up being tried as being both the piano maker’s and player’s fault.

The former for making and selling it, the latter for buying and using it.

Just like counterfeit goods.

No?

Depends, I think. Generally, I think accidental copyright infringement by an unsuspecting person who plays the song believing they bought it legally would not be held accountable. But if they knew the song was copyrighted and not legally licensed by the piano manufacturer, and they assembled a bunch of friends to listen to the songs, or resold them for money, then yeah perhaps. Most importantly in context, though, the piano will almost certainly not be fined or taken to court. ;)

Funny you should say that, as there is a direct line connecting player pianos in the 19th century to copyright law in the 21st:

https://en.m.wikipedia.org/wiki/Mechanical_license

I think the main point that the article makes is that for copyright to work you need some notion of a creative work, and so far it's generally accepted that snippets like

  i = i + 1

aren't creative enough to be covered by copyright. The interesting point is where you draw the line between what's boilerplate and what's creative, and legally it will presumably come down to showing that copilot crosses that line egregiously enough for someone to think they've got a successful chance at legal action.

Since that article was written people have shown it will generate quite long coherent sections. It will even generate someone’s private about me page: https://twitter.com/kylpeacock/status/1410749018183933952?s=...

But that about me page is the very definition of boilerplate text, so really it only gives weight to the argument that it's not producing original work.

You got downvoted, but I kind of like this argument. There are a million "about me" pages, but Copilot did a good job of picking one for "generic software engineer". If it could just have changed a word or two to a synonym, it would be great.

That page was so generic that I could fully believe it was originally written by a GPT bot.

Bullshit.

That not an existing aboutme page. You can go to davidcelis' website and verify that it's completely different.

Copilot just picked a random person and linked to their social media accounts. You can search any large quote within that about me on Google and not find a match, it is unique.

The only two examples of generating large sections of copyrighted work are the quake floating point hack and the zen of python. Both those examples are commonly known and copied and talked about, to the point that they have wikipedia pages.

Sure, but GitHub's own promotional pages (pretty much any of the gifs on https://copilot.github.com/ as well as other articles, e.g. https://docs.github.com/en/github/copilot/research-recitatio...) show it producing much more elaborate segments than that.

In fact, that's a crucial selling point for the product.

But as I understand it, copilot can generate much longer snippets, even entire functions.

I think the big question is, if copilot ends up copying significant portions a GPL work, not just tiny snippets, is the resulting work infringing, and if so, who is liable?

If a tree falls in the forest and no one is around to hear it, does it make a noise? If it is infringing and someone is liable, what proportion of the infringing cases would be found and what proportion of those found instances be brought to the courts?

I have almost no sense of how often code is infringed currently and how often anyone does anything about it. I have a feeling that we live in a world with constant infringement, basically no one cares, and no one does anything about it. And I would assume, the status quo will maintain its current course with this new tool. But again, I'm giving zero factual evidence, it's just a feeling from not seeing our hearing almost any news about open source code infringment.

If you use copilot and it generates a substantial amount of code, you don't know if that might be a replica of code from another project with an incompatible license. If you are law abiding and/or want to respect open aource licenses, then it is on you to figure out what if any license that code would fall under. Which means copilot would only be useful to developers who don't care about FOSS licenses or only use it for snippets that couldn't possibly be considered original enough to be covered by copyright.

> and it would output music that I could control to be very much or even exactly like the original recordings, or I could accidentally do it, that it wouldn’t really be a way to launder the original licenses/copyright into the public domain.

The test for non-literal copyright infringement is "substantial similarity." If, after filtering out irrelevant and non-copyrightable elements, the allegedly-infringing work is substantially the same as the original work, then it infringes. If it infringes, then two common defenses are independent creation and fair use.

In your hypothetical, the AI-generated work would infringe the original because you stated it would be substantially the same as the copyrighted work. You can't claim independent creation because the algorithm was dependent on the original work and you controlled the output of the algorithm to be exactly like the original work. Fair use is pretty much a non-starter, so I'll skip that analysis.

So, no, you couldn't use an AI to launder copyrighted works into the public domain.

Unless you are Github, in which case having your AI copy code vertabim is ok?

> Unless you are Github, in which case having your AI copy code vertabim is ok?

You have to filter out any non-copyrightable elements before you do the substantial similarity analysis. For code, that means removing non-expressive elements like arithmetic or boolean expressions, looping, recursion, conditionals, etc. APIs are not copyrightable under the recent Supreme Court holding in Google v. Oracle.

How much of your code is actually left after filtration?

I’d wager you’d get rid of over 90% of most codebases by removing all that.

But perhaps there could be a way to make something that automatically converts these "non-expressive elements" into copyrightable elements?

Output would probably be maddening to figure out though.

That's nonsense though. If we filter out the non-copyrightable parts of music we'd remove all the pitches, eighth notes, quarter notes, half notes...

We could remove the non-copyrightable parts of text works too. Just take out all the basic building blocks of language like verbs, nouns, stop words...

Individual notes, like individual words, are not copyrightable. Longer sequences, however, can be if they are original.

You’re basically arguing that whole books aren’t copyrightable because after you filter out all the words which aren’t individually copyrightable there isn’t anything left to copyright. Which obviously doesn’t make any sense.

The tests exist as a way of determining if someone did the action of copying which is the important thing at the core of it. And in this case the facts aren’t really in dispute, it’s whether what GH is doing counts as copying.

If you had a really really good memory and remembered almost exactly how your former company implemented something and when faced with a similar problem unknowingly produced similar code. It’s iffy as to whether this is copying. Because it really probably isn’t — you’re allowed to learn from copyrighted works — but the courts aren’t omniscient and when presented with the code they very well may rule that copying was more likely than not.

But we are omniscient in this case so we don’t really need the tests. Is what GH does more like copying or learning? This isn’t something that can be determined purely from the output of the tool.

Code elements like conditionals, loops, arithmetic or Boolean expressions, assignment statements, etc. are not copyrightable, but not because they’re insignificant (like individual words in a novel), but because they’re useful articles. Copyright protects expression, not utility, which is the domain of patent law.

The problem of API copyrightability was not resolved by Google v. Oracle, the ruling was that no matter whether or not APIs are copyrightable, copying APIs is fair use (which is a concept in the USA but not in many other countries around the world).

The way I see it, if you would use Copilot to completely (or largely) reproduce an existing work (software), then you would be infringing copyright. This is similar to using an AI to largely replicate a piece of music.

If you are using it to mix a snippet of code (from a sufficiently large code base) into a large code base of your own, then you are just remixing. That is not infringement. In music, there are entire genres based on remixing. You could even take it a step further and ask yourself: what is not a remix?

Sisqó had to settle with Ricky Martin for quoting "Living the vida loca", then there's the debacle around Katy Perry's Dark Horse...

Point is songwriters absolutely get litigious over reproducing small portions of their IP.

complex.com/music/majority-sisqo-thong-song-publishing-owned-by-writer-livin-la-vida-loca

huffpost.com/entry/katy-perry-dark-horse-lawsuit-payment_n_5d43d825e4b0acb57fca3ff2

factmag.com/2016/06/25/sampling-hip-hop-copyright/

Yeah, I've heard about some of those cases. It's surprising how far copyright can be stretched sometimes.

What's more surprising is to see copyleft advocates positioned so strongly in favour of giving copyright that kind of reach. I think that in a different context, some of the cases you refer to would be used by these same copyleft supporters as examples of why copyright needs to be more weakly enforced, not more strongly.

If I don't need your permission to do something with your work, then the conditions under which that permission is granted lose their force.

At the very least it should be consistent. If Microsoft can sue me for something trivial that probably shouldn't be illegal but is, then I can sue them for something trivial that probably shouldn't be illegal but is.

And in any case I think at the point where the AI (yes I considered scare quotes but decided not to) copies the code verbatim including swear words it is kind of obvious what happens:

The AI part isn't about independent creation but about figuring out what to copy.

Wouldn't the parallel be closer to having an ai remix a bunch of songs together?

"Or maybe it is, but if so it essentially means the end of licensing because it would be trivial to make an AI that can take an input and produce the same output."

Yes, this is what is pretty interesting to me. I said in a previous comment that I have a really good OS generating AI. It asks you your favorite color and outputs a disk image you can use as an installer.

Right now it just happens to output a cracked version of Windows if you answer "blue". Who can know how that happened? It's a black box after all. Seems useful though, since Microsoft is loudly saying that if I distributed this it would have no license problems at all.

I think this is peak programmer logic. You can’t just declare something a black box or declare something an AI — the courts, people, aren’t that stupid. Lawyer words aren’t that magic.

If when you crack open Copilot it’s determined that it’s not actually learning and boils down to storing and regurgitating snippets of code no matter how few or many layers of indirection it’s still infringement.

What your AI actually does is underneath all the indirection is what’s important.

> [..] not actually learning and boils down to storing and regurgitating [...]

Some would say that pretty much _all_ learning involves "storing" and "regurgitating".

Aside: my daughter started writing out her name at kindergarten a couple of years ago. One of the staff seemed a bit dismissive of this, and claimed what was happening wasn't really "writing" it was "merely memorising the shapes of letters and then reproducing them in the right order". <rolls eyes>

I didn't bother to argue...

Yeah ... that was my point. What copilot does underneath the indirection is steal GPL code and derive "new" stuff from it in a way that launders the licenses.

We know what it's doing, it's doing very well understood statistical inference techniques to derive outputs.

Also, it's trivially easy to teach a real neural network to output a specific binary stream in response to a specific input. My OS AI could use the exact same technology as Copilot, I'd just train it very specifically.

The Beatles are the farthest thing from public domain possible and would never be included in such an exercise.

Valid point - most hilariously poor example to back that point up in recent memory.

Can put Beatles lyrics as comments. Copilot do look to copy those as well. People can bomb search results, some will certainly bomb Copilot.

Unlike patents, for cooyright, independently created work is not infringing. So, if you build a model that really does actually model music, this could be argued to be independent creation.

But there is also caselaw (involving George Harrison IIRC) on "unconscious copying", where having heard a piece is suggestive that it was not an independent creation, despite not being deliberately copied. So, training on a corpus that includes a specific piece is arguably a case of that.

There"s an interesting question of whether a model is just a sophisticated statistical compression of a corpus, or whether it is a thing in itself. I would say, if it finds patterns that are disproportionately simpler than the corpus, it has found "something".

But another view is of creation as involving a side-channel or one-time pad, in that music is created by a human and heard by a human, who have common information that has never been present in music before (e.g. specific aspects of common neurophysiology, auditory anatomy, exact heartbeat waveform, new sounds/rhythms in the world, new speech patterns, associations between existing melodic fragments and words/emotions/visuals/status etc). In this sense, truly new music is discovery of the Human Music Processing System, which ultimately involves the whole human and their social and physical experience.

You say AI, but this is just a database with a weird query language. The fact that it has to be trained on massive amounts of code and can only regurgitate variations of snippets of the training database back makes it quite clear that there is no intelligence in this thing.

If it were intelligent, it’d be given the Lagrange specifications and then I’d be able to say “Write me an open world video game based around gang culture and I’d like it to run on the raspberry pie zero.”

Oddly enough there's an Adam Neely video I saw some time ago that may address your points:

https://youtube.com/watch?v=sfXn_ecH5Rw

"Copilot is a commercial product, therefore, Github can only use code that the owners make available for commercial use."

IANAL, but this doesn't sound quite right. There is a difference between "using" code (running it in a commercial product) and manipulating it as arbitrary data within a commercial product.

It definitely can be a gray area, but let's say I use Amazon's service where I email a PDF to my Kindle - is it Amazon's responsibility to know the copyright status of the PDF, or mine? In both cases a commercial product is manipulating copywritten data for the benefit of a user.

Even if it's legal for Copilot to do what it does, does it not violate GPL to take pieces of GPL'ed code and use them in a commercial product?

Yes.

The basis of the GPL is copyright, so what you're really asking is whether you can use part of a copyrighted work in another work without infringing.

And the answer as always is "it depends".

If I use Copilot and it suggests a large block of GPL2'ed code for my project, which I then include, then that is a GPL2 license violation.

Whether the GPL2 will hold up in court, or whether the courts will uphold this specific case (e.g. can you prove intent? Do you need to?), is a separate issue entirely.

The next question is, can I use GPL'ed code in my product and then claim that it was injected by Copilot to avoid repercussions of my actions if caught?

> If I use Copilot and it suggests a large block of GPL2'ed code for my project

But why would copilot do this? It's a language model not a database.

> If I use Copilot and it suggests a large block of GPL2'ed code for my project, which I then include, then that is a GPL2 license violation

Not necessarily. Even 11k lines of copied code might fall under fair use, as Oracle recently discovered ;)

There are plenty of SAAS that use GPL'd code on the backend. That's fine.

The claim (which I'm not qualified to judge) is that this use falls under fair use. The point of fair use is to allow some use of copyrighted works even if the copyright owner does not license it to you and even if the owner is explicitly hostile towards your usage. If it is indeed fair use, then the license doesn't matter because that's not the thing that's allowing you to use the work.

You mean like Red Hat Enterprise Linux, that kind of commercial product based on GPL'd code?

Your example doesn't quite match what's happening in real life though. You're not "using copilot as a mechanism to ferry around code". Co-pilot is making recommendations for what code to use and then also giving that exact code (the text) to you. A more apt example would be if Amazon had some UI which said "What kind of book do you want to read on your kindle?", you click the button labeled "biography", and then Amazon sends your Kindle an AI generated book which is the biography of a famous person, and it just so happens that the "generated" book being sent to you is an exact copy of someone elses book (or incorporates exact copies of chapters/paragraphs of someone elses book), legal disclaimers and all.

Maybe you're right, maybe you're wrong.

I'll give the best example, the one task that off the top of my head that I would like some AI help with.

I would really like to replicate the functionality of Java's SSLEngine, but for C#.

If I used Co-Pilot to help, at best, I would need to pay for a legal team to do some form of 'clean room' review of whatever was generated to make sure it did not infringe on the OpenJDK code that is out there. At worst, I would be having to defend myself from Oracle's legal team -anyway-.

And yeah, I'm assuming in this case that Copilot would be 'smart' enough to be able to make the right inferences of that java code and put it into workable C# construct. Stepping back, though, one could still ask the question; what's the risk of a Java developer accidentally getting some OpenJDK code a little too closely? There's an order of magnitude difference between even a smaller AGPL developer and Oracle.

If Microsoft/GH was willing to go to bat and agree to pay for the defense of users of Copilot, I would be far less concerned with the implications of all of this.

> Stepping back, though, one could still ask the question; what's the risk of a Java developer accidentally getting some OpenJDK code a little too closely? There's an order of magnitude difference between even a smaller AGPL developer and Oracle.

It would be extremely interesting to know how much accidental and non accidental code infringement happens and in what proportion of those cases go to the courts. I would guess that both cases happen utterly constantly and it is only a tiny minority of those cases where legal action is taken. If that's the case right now, then nothing has changed with this tool except the possibility of playing hot potato with liability when those few cases that do happen make it to courts. Even if the developer actually wrote the code that infringed, copilot could make a useful scapegoat and every case will have plausible deniability if copilot lacks really good explainability.

> every case will have plausible deniability if copilot lacks really good explainability.

Out of pure curiosity, and please do take it as a candid question; do you intend to mean that "I don’t know how what I used works" is a good defence?

The proprietary model is a representation of lots of harvested open source code snippets. Without the model copilot is nothing. Arguably, the code snippets are part of the product....

Github (and by extension Microsoft) is gambling on the fact that their license agreement granting them a license to the code

This is incorrect. First of all, GitHub isn't even the people building the model. It's built by OpenAI, which has none of these licenses. Secondly, the model is not built purely from GitHub data. OpenAI is relying on fair use, not on a specific license.

> GitHub Copilot is indeed infringing copyright and not only in a grey zone, but in a very clear black and white fashion

You seem to be confusing what you'd like the law to be with what the law is.

Here is an explanation of the law: https://www.copyright.gov/fair-use/more-info.html#:~:text=Fa....

Effect of the use upon the potential market for or value of the copyrighted work: Here, courts review whether, and to what extent, the unlicensed use harms the existing or future market for the copyright owner’s original work. In assessing this factor, courts consider whether the use is hurting the current market for the original work (for example, by displacing sales of the original) and/or whether the use could cause substantial harm if it were to become widespread.

If your view of the law is correct then programming is illegal, because who among us has not read copyrighted code and used it to train our biological neural network? I suspect your view of the law is not correct.

Your analogy looks alien to me. Can you show us the link between a human and a computer program? WTF is "biological neural network"? Can you quote a law?

Humans aren't robots and our laws aren't designed to equate the two, even if you assume that copilot is anything close to intelligence

Copyright is not an indefinite ability to control a work. You can't for instance stop me from lending or leasing my rightfully acquired copies of your works, nor from making short quotations for criticism, nor teaching a class about it, etc.

Particularly in the context of the occasional, unintentional reproduction of short snippets that likely need adaption to the rest of the code they are inserted into I suspect courts are unlikely to find more than de minimis, unactionable, infringement.

> You can't for instance stop me from lending or leasing my rightfully acquired copies…

I mean in this specific example can’t I though? Yes the first sale doctrine applies to certain kinds of works but not every work and specifically not software. I absolutely can grant you a single non-transferable license to use my software.

Right, but Copilot is not creating a piece of critical media about the code it is ingesting (IANAL, but my understanding is that this gets interpreted pretty strictly). I don’t think the normal Fair Use classes apply here.

Even if the code isn’t being copied verbatim, it feels like the spirit of these licenses is being violated, although I don’t know if that’s enough to get anywhere in court. But if the code is in fact being copied (like that Quake example) then the license is definitely being violated.

But I feel like there’s too much analysis in these comments of whether a current law is being broken, and not enough thought about what will happen if licenses like the GPL can no longer keep intellectual property free. Open source licenses are part of the foundation of this community, and we’ll be much worse off without them. We really need a way to prevent this kind of IP laundering, and if current laws won’t do it, then we need new ones.

> Any open-source code available on Github is controlled by the copyright notice of the owner granting specific rights to users.

and by the GitHub ToS:

> You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video.

https://docs.github.com/en/github/site-policy/github-terms-o...

Does the GitHub ToS matter when I upload code that was written by somebody who doesn’t use GitHub?

Then you would be the one infringing their copyright, and they could probably sue you.

Although I'm curious about what GitHub would do if the original author asked them to remove the work from Copilot. Retrain from scratch every month or so, to remove last month's DCMAed content?

I doubt that as an interpretation that Github wants people to make since that means that tons of major projects need to be remove from Github. Basically all that are older than Github.

Not everyone who’s code ends up on GitHub has agreed to this set of terms

See my answer to https://news.ycombinator.com/item?id=27741709

> > as necessary to provide the Service

I would consider Copilot to not be part of ”the Service”[1], but at least currently[2] the definition of ”the Service” is so vague as to include anything that Github does.

Maybe they consider Copilot to be a ”search index” and the suggestions ”[sharing] [Your Content] with other users”.

[1] Since, as I understand it, it will require separate payment.

[2] The ToS is currently last edited 2020-11-16, and does not contain the word ”Copilot”

> Github (and by extension Microsoft) is gambling on the fact that their license agreement granting them a license to the code in exchange for access to the platform supersedes the individual copyright notices attached to each repo.

The person who has the account on Github and uploads code to them rarely owns the copyright on all of the code, and therefore doesn't have the right to delegate to Github any further licensing permission.

Legally I believe that’s the person who uploaded the code’s infringement rather than GitHub’s, so long as GitHub deals with takedown requests in a timely manner as per the DMCA.

Furthermore, as described in the article, the legal precedent has been that you don’t actually need copyright to something to train a model on it. You may think that’s silly or inconsistent, but that’s how the legal precedent is.

> that’s the person who uploaded the code’s infringement rather than GitHub’s

That's not how it works. Anyone and everyone who distributes it is infringing and carries risk of enforcement action. That could also be someone further downstream.

> Furthermore, as described in the article, the legal precedent has been that you don’t actually need copyright to something to train a model on it.

I'm not commenting on this aspect.

That is absolutely how it works.

https://www.eff.org/issues/dmca

“The DMCA “safe harbors” protect service providers from monetary liability based on the allegedly infringing activities of third parties.”

That does nothing to derisk those further downstream of infringing content.

If Copilot is infringing copyright by reproducing small samples of the training data, and if we agree that that isn't acceptable, doesn't that effectively spell the end of the road for any and all AI generated content unless the developers explicitly stop their product reproducing data that matches the data it was trained on? That seems like it would have far reaching consequences for AI as an industry.

A pandora's box full of already-opened cans of worms -producing factories. The singularity is now?

Doesn't everyone who uploads code to a public repo give Microsoft/GitHub a license to (strike ~redistribute~) reproduce that code?

If they didn't, GitHub itself would be violating copyright every time someone browsed the repo.

And copilot appears to be a part of GitHub.

https://copilot.github.com/

So why wouldn't copilot itself be covered by that license?

(Certainly people using copilot would not. Let the user beware.)

Edit: downvoted to death but the top reply shows that it's true. An inconvenient truth, I suppose.

I'm thinking it's not so much what is legal for Copilot to do with code chunks from GPL'ed code, but what it means for end users (i.e. developers at for-profit companies) to incorporate those chunks into commercial products

No.

Edit: Sorry downvoters, whether you like it or not, you don't understand the terminology. You're confusing reproduction with redistribution.

I'm not a lawyer so it's entirely possible I used the wrong term. Thank you for clarifying below.

Using the terms as you explained them below, I meant that Microsoft/GitHub has permission to reproduce the code so why wouldn't that extend to copilot?

Reproduction is enough to cover the first part of your use case. This is mentioned on Github's TOS.

For the latter you would need redistribution as it is going into a different product, for which you claim ownership, and with possible modifications/adaptations (this would depend on the rights granted by the license). Nowhere on Github's TOS is the word or concept of redistribution referenced.

So, the answer to your original question is "no".

Edit: leereeves modified its comment after I wrote this, so it may not make much sense but you can figure out the point. Best!

I’m not sure this is a completely fair take, I think the original question is legitimate and relevant. Github’s TOS does in fact ask the contributor to grant a license for GH to host and serve their code from GH servers. That is both reproduction and distribution as defined by copyright law, and copyright covers both of those at the same time https://www.copyright.gov/what-is-copyright/

(Edit and BTW GH calls out their ‘distribution’ in section D.4 of their TOS explicitly, but without using the word “distribute”. They say you grant them the right to “publish” and “share” code you upload, which means “distribute” under copyright law. They also imply that by spelling out the terms under which they do not “distribute”, which is anytime the content is used outside of GitHub’s services.)

I don’t think you’re correct that the term “redistribution” means either going into another product, nor that it implies a claim of ownership. Putting works into another product is sometimes known as making a derivative work, while “redistributing” is quite commonly used to mean copy-and-distribute as-is. Redistribution can happen via license as well, it requires permission by the copyright owner, but does not imply the redistributor is (or is claiming to be) the copyright owner.

>I think the original question is legitimate and relevant

You didn't see the original question, it was edited, so we cannot discuss that further.

"[...] which means “distribute” under copyright law" <-- Citation needed please, because I don't think that's correct.

From the site you linked:

"Distribute copies or phonorecords of the work to the public by sale or other transfer of ownership or by rental, lease, or lending."

What I seem to grasp about the difference between reproducing and redistributing is that it has to do with the concept of "transfer of ownership". Also derivate work and redistribution are not mutually exclusive.

The moment you create a new thing and start distributing it (even if you do not modify it), you become the de facto owner of that new product, and copyright law is trying to limit the extent of the rights that apply there. So, in the case of music, it's different thing to play (reproduce) a song than to create a new album with your favorite artists that happens to include that particular song (redistribution).

> "Distribute copies or phonorecords of the work to the public by sale or other transfer of ownership or by rental, lease, or lending."

> What I seem to grasp about the difference between reproducing and redistributing is that it has to do with the concept of "transfer of ownership". Also derivate work and redistribution are not mutually exclusive.

What you've misunderstood is it is the copies that are sold, not the copyrights.

* edit

> create a new album with your favorite artists that happens to include that particular song (redistribution).

This is not what redistribution means. You seem confused about this word.

>What you've misunderstood is it is the copies that are sold, not the copyrights.

Sorry, I'm not following you anymore. I don't even know what you mean by that sentence.

Edit:

>This is not what redistribution means. You seem confused about this word.

But, that's exactly what redistribution entails ...

> Sorry, I'm not following you anymore. I don't even know what you mean by that sentence.

The transfer of ownership you referred to is a transfer of ownership of a copy, it is not a transfer of ownership of the original work itself. You misunderstood the passage you quoted to mean that redistribution is transferring ownership of the work itself, as in copyright ownership of the work. But the text you quoted is only talking about transferring ownership of the copies. The text you chose makes more sense in the context of physical copies of books or "phonorecords".

I'm not following your logic, really.

Copyright is meant to protect original/authentic/unprecedented expressions, disregarding the medium where they may exist. So I don't really get your point in trying to make distinction between a copy or a "master"(?) or whatever.

What's at stake is the originality of the expression and what kind of rights does somebody else (i.e. everyone but the creator) have (or not!) over it.

Can I make copies of this original expression? (y/n)

Can I use this into a new product of my own? (y/n)

Whether something is already a copy or not does not really change the extent of the rights that you have (unless it's explicitly stated in the license, of course).

> I’m not following your logic, really

I can see that, and I mean no disrespect, but you shouldn’t have attempted to comment on this topic authoritatively and police what others say without understanding it.

> I don’t really get your point in trying to make distinction between a copy or a “master”(?) or whatever.

You have clearly and repeatedly demonstrated that you don’t understand what “distribute” and “redistribution” means to copyright law. You claimed others were confused about it and that using the word “redistribute” was incorrect, when in fact it was fine and correct.

I’m trying to help you understand that redistribution is a term that is talking about what happens to copies of a work. The sentence you quoted, and the “transfer of ownership” that you said you grasp only have to do with transferring copies, and nothing else.

The main point here is that when GitHub shows you code, it is transferring a copy to you. That is what GitHub calls “publish” and what copyright law calls “publication”, and by publishing they mean redistribution (because the copyright legal code says so).

> that's ("create a new album with your favorite artists that happens to include that particular song (redistribution)." exactly what redistribution entails

No, it isn't. You're wrong. Redistribution, or just distribution, in copyright law is plainly and simply making copies of a work available to other people. It does not mean anything more than that, and it does not transfer ownership of anything other than the copy you distribute.

Are they displaying the license under which said code is licensed when they display a chunk of licensed code? If not, then they're violating the terms of most licenses (except pure public domain, or other similar licenses which don't have any such requirements attached).

The use of licensed code in other projects must be done under the terms of that license or you aren't legally (under copyright law) allowed to use the code.

As I said, I'm not a lawyer, but I believe they're displaying it under the terms of the GitHub ToS, using rights granted to them when the project is uploaded to GitHub, not under the terms of the license the project uses for everyone else.

> Are they displaying the license under which said code is licensed when they display a chunk of licensed code? If not, then they’re violating the terms

The GitHub TOS is a license that is separate from the license in the code. It is legal and common for an author to license the same code multiple ways (and the licenses do not have to agree with each other). By agreeing to GitHub’s TOS and uploading code to GH servers, people are licensing GH to display the code, because the license agreement says so explicitly. This could be problematic if someone uploads code they don’t have the rights to upload, but then the violation is the uploader’s, and not GitHub’s.

Additionally, GH has a provision for already licensed code in section D.6:

“6. Contributions Under Repository License

“Whenever you add Content to a repository containing notice of a license, you license that Content under the same terms, and you agree that you have the right to license that Content under those terms. If you have a separate agreement to license that Content under different terms, such as a contributor license agreement, that agreement will supersede.

“Isn't this just how it works already? Yep. This is widely accepted as the norm in the open-source community; it's commonly referred to by the shorthand "inbound=outbound". We're just making it explicit.”

https://docs.github.com/en/github/site-policy/github-terms-o...

> You're confusing reproduction with redistribution.

It seems like you're confused; GitHub's terms require users to grant both of those. Copyright law also covers both.

>GitHub's terms require users to grant both of those

Last time I checked (about an hour ago), that wasn't true. Feel free to provide evidence to support your argument.

> Last time I checked (about an hour ago), that wasn't true. Feel free to provide evidence to support your argument.

https://docs.github.com/en/github/site-policy/github-terms-o...

"publish" and "share" mean redistribution. "Store" and "copy" mean reproduce.

>"publish" and "share" mean redistribution

No. That's something you believe, but it's not necessarily true.

Check here, https://copyrightalliance.org/faqs/what-rights-copyright-own...

Again, distribution has to do with a transfer of ownership. In layman terms, Github can show your code to others but it cannot give (as in ownership) your code to them. It's a bit tricky here since on the web showing something literally means making a copy at some point, but try to view things under the light of "who owns what" and it's a bit easier to grasp.

If you browse through someone's repository, it's pretty clear who the owner of that code is, if a program gives you a chunk of code that it "got from somewhere" there's definitely some sort of change of ownership operation going on; which in this case is interesting, as it went from attributed to someone to missing/unknown.

> Again, distribution has to do with a transfer of ownership

You're mixing sub-threads here, but you're still confused. Distribution is a transfer of ownership of a copy, it does not grant copyrights or ownership of the work. You can buy a book that was distributed, and that does not give you the right to make copies of the book.

> Github can show your code to others but it cannot give (as in ownership) your code to them.

In the digital world, showing is "distributing", and copyright law is clear about this.

You should perhaps read the definitions that are in the copyright law itself, and try to understand them:

"“Publication” is the distribution of copies or phonorecords of a work to the public by sale or other transfer of ownership, or by rental, lease, or lending. The offering to distribute copies or phonorecords to a group of persons for purposes of further distribution, public performance, or public display, constitutes publication. A public performance or display of a work does not of itself constitute publication.

To perform or display a work “publicly” means—

(1) to perform or display it at a place open to the public or at any place where a substantial number of persons outside of a normal circle of a family and its social acquaintances is gathered; or

(2) to transmit or otherwise communicate a performance or display of the work to a place specified by clause (1) or to the public, by means of any device or process, whether the members of the public capable of receiving the performance or display receive it in the same place or in separate places and at the same time or at different times.

https://www.copyright.gov/title17/title17.pdf

You make some good points, here and on the other comments, so I'm not arguing against you.

>In the digital world, showing is "distributing" [...]

I guess it has to do with how copyright law adapts to the specific circumstances of this particular case. I guess we won't get an answer until a judge justifies some sort of resolution on either side.

My take is that:

* GH showing you some source code on their website is akin to reproduction; even though, of course, a binary copy of the code was made and was transmitted to your local browser in order to be displayed.

while

* GH taking chunks of code from here and there, and making them available into a new product from which they claim ownership (or the final user, or whatever) is more akin to the physical concept of redistribution.

But we'll have to wait and see.

> GH showing you some source code on their website is akin to reproduction

This is clearly and unambiguously defined as “publication” in the copyright law, where “publication” is defined as distributing copies. (And GitHub’s TOS also calls showing you code “publish”).

There is nothing to wait for, and the law and many court cases have already established clear definitions and precedent on these terms. You just got stuck on the wrong idea, it happens, it’s okay, but if you are curious about copyright and interested in discussing it here, it will certainly help to improve your understanding of the terminology.

> GH taking chunks of code from here and there […] is more akin to the physical concept of redistribution

No, this is still just wrong. You’re talking about derivative works, which is also defined in the copyright legal code. There is no such physical concept of mixing and matching that is called “redistribution” in legal terms. I’m not sure where that idea came from, it might make sense to you or in some narrow contexts, but generally speaking and specifically wrt copyright law, distribution has nothing to do with whether you sample a work nor whether you make a new work out of old works.

There's more than redistribution happening here. Co-pilot is providing a value-add service where the open-source code is an input and the output is a service. As it happens, the service is actually regurgitating the code at this point, but it's important to consider that even if it didn't regurgitate the code verbatim, the fact that the service is making use of that code to provide a value-add means the code is a crucial input to the value proposition. Would Co-pilot be able to provide the value-add without the source? Likely not.

Couple that with the fact, that presumably at some point in the future, Co-pilot will come attached with a subscription model (otherwise why do it in the first place?), and we have the makings of a product that is commercially infringing on copyright left, right and center.

From the GH TOS:

> 4. License Grant to Us

> This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service

https://docs.github.com/en/github/site-policy/github-terms-o...

> 5. License Grant to Other Users

> If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking).

> You may grant further rights if you adopt a license.

https://docs.github.com/en/github/site-policy/github-terms-o...

So yes, but only within GitHub.

Edit:

> A. Definitions

> The “Service” refers to the applications, software, products, and services provided by GitHub, including any Beta Previews.

https://docs.github.com/en/github/site-policy/github-terms-o...

Sneaky bastards.

Edit: Formatting

Not everything on Github was uploaded by the copyright holders. Often enough, it's uploaded by people who only have access to it under an open source license, so Github cannot in general squeeze additional license terms out of the uploader at that point.

That's a good point; what is their obligation/liability in that case?

Yap. Some of them are mirrors uploaded by unknown/non-official uploaders.

I guest next step github would require cell phone to sign up to make sure who you are and get the rights to profit.

Yes (as you now know), GitHub’s terms require users uploading code to agree to GitHub being able to both redistribute (“publish”) and reproduce (“copy” / “store”) their code.

The “Terms” link on the copilot page goes directly to GitHub’s TOS, so yes the terms are one and the same.

This question is interesting and I’ll try to help turn the downvotes around, but it might be too late. Anyway, when users agree to allow their code to be “published” by GitHub, they are allowing it to be both copied and distributed. The TOS also says (note the indexing/analysis comment) “This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video.”

The part where GitHub might have trouble (I speculate) is that their TOS doesn’t discuss derivative works, and the input code to copilot could have licensing terms on derivative works that get scrubbed out by copilot. OTOH, if copilot were to guarantee that a chunk of code never resembled one of the original inputs it may be legal to create derivative works from samples under fair use.

There were two parts to the argument which seem to hold water.

1. Any code generated by co pilot is likely to be agpl

2. since the authors of copilot used co pilot beta to make co pilot release copilot is very likely using agpl licenced code and therefore in breach of the agpl licence.

so yep, article looks flawed.

Reply on news.ycombinator.com