If you steal 10 lines of code from me, the damages will be the greater of:
- The benefit to you (10 minutes programmer time)
- The cost to me ($0)
- Statutory damages (probably $200)
In other words, it's very unlikely to be worth a lawsuit. The most likely outcome is:
- A legal letter is sent
- Infringing code is removed
- As good bedside manner, some nominal amount of money is transferred, mostly in some gesture designed to make the violated party feel good about themselves (e.g. a nice gift).
If liability sits somewhere, it's with copilot, github, and Microsoft.
A lot of that might come down to bedside manner. Right now, github isn't super-polite to people whose code it used. That's probably a mistake. They'd be a unsympathetic evil megacorp in a jury trial.
No one has won billions of dollars on GPL enforcement. It's not how courts work. Contrary to popular belief, courts also won't compel compliance (e.g. releasing my code); if I break your license, the standard recourse is damages, whether that's GPL or All Rights Reserved.
Otherwise, I'd make the First Born Child license, whereby by using my code, you give me full ownership of your first born child, your home, your car, and your bank account. I could write a license like that right now, but I couldn't force you to give me your child, car, bank account, and home. If you used my code, you'd have the option to accept the license and give me those things. Or you could reject it, in which case, it's a normal copyright violation; in that case, whatever I wrote in the license is moot, and you pay damages (and stop using my code).
I should have put "reuse" in quotes, since I meant copilot takes reuse one step further and replicates or regurgites code.
The only part which wouldn't be valid in a contract was the first-born child. That was a joke.
Indeed, if the GPL were a contract, courts might compel compliance.
However, the GPL is not a contract, it's a license. The FSF bent over backwards to make sure the GPL/AGPL licenses wouldn't be viewed as a contract, in part to limit liability / damages / risk.
Confusingly, some EULAs are framed contracts, contrary to the acronym, and do expose users to much more risk of liability than the GPL.
The relevant part of the GPL is:
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission to
receive a copy likewise does not require acceptance. However, nothing
other than this License grants you permission to propagate or modify
any covered work. These actions infringe copyright if you do not accept
this License. Therefore, by modifying or propagating a covered work, you
indicate your acceptance of this License to do so.
It will be a gift. Gifts are valid, but they require free will of the gifting party. Gifts, without free will, can be easily canceled by court.
As far as copilot goes, yes it’s possible to get it to recite copyrighted works, but in normal usage it is creating independent works because it is too influenced by the structure of your code around the insertion point to recite anything. It’s auto completing things like the variable names that you already declared, simple loops and function applications, etc.
> What that means legally has yet to be fully determined.
At least in the US, the Supreme Court ruled in Google v Oracle that the entire Java API is not copyrightable. Copilot users are very far from crossing the line, the courts are not going to come after some de minimis 10-line snippet that copilot generated.
Whether Microsoft itself was legally in the right by training copilot is a more interesting legal question that remains unresolved.
It might be possible, I don’t know about “highly”. Have you checked the license exclusions required to use Github? Their terms already carve out a Copyright exception for Github, because they need it on order to host your code. There’s also no reason Github can’t filter certain licenses, or make it impossible to complete entire functions, or build an option for everyone to opt-in to being autocomplete source material regardless of license, right? Any legal challenges are likely to result in changes to the feature before there are ever any serious repercussions.
I think it’s at least as likely, if not more so, that Copyright Law could evolve in response to the growing number of AI auto completers, and we (society) try to allow it within reason by being more specific about what constitutes automated infringement and who’s responsible for it. Fair Use currently exists but is vague and left up to courts to decide. In the meantime, Copyright is primarily intended to foster a balance between business and freedom of expression, and there’s a lot of open source software on Github that cares about freedom of expression and not about business. In any case, we don’t really want Copyright to represent some kind of absolute ownership land-lock over every string of 100 characters, that is a bit antithetical to both Copyright and the FOSS community.
Triply so when Microsoft is involved.
https://en.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_...
For this content:
a nine-line rangeCheck function, several test files, the structure, sequence and organization (SSO) of the Java (API), and the API documentation.
It adds up.
That's an incomplete view. You're judging the value by the time it'd take to rewrite it.
The real value is in knowing what to type and why.
When Co-pilot suggests you a GPL code, it's main value is the knowledge, not the typing.
That piece of knowledge may have taken a LOT of effort from an OSS team to acquire.
Depending on the context, this knowledge would be worth millions.
Worth a lawsuit.
But it probably won't be worth millions of dollars. And that is why the lawsuit wont be worth it.
> That piece of knowledge may have taken a LOT of effort from an OSS team to acquire.
Anything "may" be possible. But it probably won't be worth that much.
I'd suggest to get more information about the repercussions associated with appropriating GPL code into proprietary closed source.
This is a big deal. You may have to license your entire codebase under GPL if you incorporate GPL code and distribute it.
I would suggest that you actually take your own advice and get more information yourself.
No license can force you to release your code. Nope, not even GPL.
Instead, what a rights holder can do, is sue for damages for the copyright theft, for not following the license. They can't force you to follow the license. Instead, they can say that you didn't follow it, therefore you stole the code, and owe money to them, for stealing the code, depending on how much the code is worth.
The only thing that GPL does, is it gives people permission to use the works, in exchange for releasing code. But, if you infringe, the damages do not depend on whatever the license was, or whatever request the license makes.
To use an example someone else gave, of the "first born child" license, imagine someone writes a simple binary search function, and puts out a license that gives it out for free, in exchange for paying them some absurd price. EX: the joke of the first born child, but more seriously, lets say the license was "1 million dollars".
If someone stole that binary search, couple line function code, and it went to court, they absolutely would not own them 1 million dollars, even though thats what the license said.
Instead, they would owe the rights holders damages. And chances are, a couple line binary search function, or some other example that you could think of, would only be worth a small amount.
And even though the license said "This code is worth 1 million dollars, and you owe us that money if you use it!", it is not true that anyone would owe them a million dollars. Instead they would only owe them damages, which would not be anywhere close to 1 million dollars.
In most cases, damages are set to make both parties straight, not to be punitive. People cite how trillion dollar companies might have billion-dollar lawsuits, but that's pretty reasonable. $1B damages are 0.1% of a company's value in a battle between FAANGs, which have big-O trillion-dollar valuations. If you have a dispute between $1M businesses, the analogue is $1k damages. That's not atypical for a commercial dispute.
I did not say it forces you to distribute it. That's absurd.
What I said is: "if you incorporate GPL code and distribute it"
If you do those two things, yes, you have to license your code under GPL.
It's not me saying, please take a look at Section 5-b and 5-c of the license. [1]
Let's do an experiment: You need to hit yourself repeatedly in the head with a mallet until you pass out.
Are you currently hitting yourself with a mallet until you pass out? No. Just because something is written doesn't mean you need to do it. If I incorporate your GPL code, distribute it, and don't license my code under the GPL, that means I'm distributing code without a license (or breaking a license). Unless I've crossed the line for criminal prosecution (which is far from anything we're discussing here), the worst-case consequence of that is .... damages.
If I've crossed the line into criminal prosecution, then the consequence is damages and jail time. I absolutely STILL do not need to license my code under the GPL.
(In most cases, it's a good idea to license code under the GPL, though, both due to branding/reputation damage, and since usually that leads to an out-of-court settlement; but those carry no legal force being that)
This is not how the law works. In addition to damages, if you're a party to a civil lawsuit then a court can order you to do something. This is called an "injunction".
For example, if I write something and you start selling copies of it without permission, and I sue you over your copyright infringement, a court can and will order you to stop. Copyright has teeth like that.
If the thing you were selling was your product -- based illegally on my GPL'd code -- then that may be a lot worse for you than some damages.
The solution to that is to remove or replace those lines.
That's not worse than damages. That's just table stakes. That's expected no matter what happens. If I had a few lines of GPL code in a proprietary code base, I'd do that the day it was discovered.
To understand the frequency of injunctions, have a look at this test:
https://en.wikipedia.org/wiki/Injunction#Permanent_injunctio...
Injunctions generally only happens if other means (like damages) have been exhausted.
If not, then you do have to license your entire work under GPL if you incorporate GPL code and distribute it.
If yes, what kind of environment do you think you're promoting? Is it positive for the development of the industry, and to society in general?
"can" is a complex question. You can do anything you want, but actions have consequences. I can buy a gun and shoot someone. The consequence is that I might spend the rest of my life in prison. I can fart in a crowded elevator. The consequence is that people will look at me funny, and might dislike me.
Consequences should be proportional to the action.
If farting in an elevator lead to life in prison, or if shooting someone led to people looking at me funny, things wouldn't work very well.
> If not, then you do have to license your entire work under GPL if you incorporate GPL code and distribute it.
No. This is not a proportional consequence. If a random developer incorporates 10 lines of GPL code into Windows, Microsoft doesn't need to license Windows under the AGPL. That's not how our legal system is set up.
Microsoft has to remove the code and pay damages.
> If yes, what kind of environment do you think you're promoting? Is it positive for the development of the industry, and to society in general?
The logic you're suggesting -- is not only incorrect -- but would lead to an environment where people have an irrational fear of "viral" licenses. They're intentionally not viral. They don't infect code. Releasing your code is one option for remedy, but not one the GPL author can force. The FSF went over backwards to design the license like that.
Damages and removing code is an appropriate consequence. It's adequate to prevent most license violations, and still not overly draconian. I don't know of any business which has gone under due to an error around the GPL. That's as it should be. If the GPL were business-toxic, it wouldn't set up a successful ecosystem.
Think of it: If Nevada gave the death penalty for littering, would you liter less? Or simply never, ever, ever travel to Nevada?
In this case, I don't know of a reasonable remedy. I don't want to shut down copilot, but I do feel bad about having my code stolen from me. Perpetual license for everyone whose code was used to develop co-pilot? A nominal stock grant in Open AI? I dunno. When I've seen class action lawsuits, those are the sorts of places things usually land. Indeed, it's usually just short of being fair.
But you know what? I think we'll find that CoPilot will have magically skipped those Oracle repositories and only used code from lowly open source slaves.
I know what you mean, but silly nit pick since you mentioned “commercial” twice - GPL v3 does not prevent commercial use, it only requires copies to be open source. For someone to notice the project has copied code and not be inside the company, the code would (probably) have to be open source. So, this hypothetical is less likely to happen than your comment makes it sound.
A little further off topic, but amusing to me, is that the US government defines “commercial” software to be any software that has a license other than public domain. Free and open source software, such as GPL v3, is still “commercial” because it is licensed to the public https://www.acquisition.gov/far/part-2#FAR_2_101
More on-topic now, a small single function accidentally copied from an open source project by automated software might be considered fair use by US copyright law. https://www.copyright.gov/fair-use/more-info.html
(Edit) Oh yeah, and I just remembered that GitHub’s Terms already carve a necessary exception to whatever license you use in your project, to allow Github to host & display your code. I assume those terms already include some CoPilot coverage…? If not, and if they aren’t legally covered already (which I bet they are), then they could change the terms to stipulate that hosting code on GitHub bars people from suing over incidental amounts of automated copying. Main point here being that the GPLv3 license on your project is neither the only nor the primary license governing GitHub’s relationship with your code.
The are plenty of source available or open core projects where use of GPL-ed code would both be visible and incompatible with the licensing.
> Oh yeah, and I just remembered that GitHub’s Terms already carve a necessary exception to whatever license you use in your project, to allow Github to host & display your code. I assume those terms already include some CoPilot coverage…?
Letting github host and display the code is compatible with open source licenses but is very much different from letting third parties incorporate that code into non-open codebases.
> If not, and if they aren’t legally covered already (which I bet they are), then they could change the terms to stipulate that hosting code on GitHub bars people from suing over incidental amounts of automated copying. Main point here being that the GPLv3 license on your project is neither the only nor the primary license governing GitHub’s relationship with your code.
GitHub TOS can only possibly give them authorization from those directly uploading code to GitHub. They don't give github any additional license for code that was uploaded by a someone else (for example a mirror bot) becose that someone does not have the rights to give out that license.
And even if they write in their TOS that they can do whatever they want it does not mean that they can actually legally do whatever they want - even moreso when retroactively changing those terms.
Agree completely. It’s still a fact that GitHub’s Terms provide a separate license for Github. See section D.4 https://docs.github.com/en/site-policy/github-terms/github-t...
> GitHub TOS can only possibly give them authorization from those directly uploading code to GitHub. They don’t give github any additional license for code that was uploaded by a someone else (for example a mirror bot) becose that someone does not have the rights to give out that license.
GitHub’s terms already require that uploaders have copyright authorization, or that machine uploaders are doing automated tasks exclusively. Letting a machine upload someone else’s new and copyright code that the account owner doesn’t have copyrights to appears to violate GitHub’s terms. “the owner of the Account is ultimately responsible for the machine's actions” https://docs.github.com/en/site-policy/github-terms/github-t...
> even if they write in the TOS that they can do whatever they want it does not mean that they can actually legally do whatever they want
Yes, correct, I completely agree. Asking for people to agree to ‘indemnify and hold harmless’ over the site’s features is standard language and not really a stretch, it doesn’t amount to Github doing whatever they want. That language is already in the terms.
What is the summary of your comment, what are you trying to say at a high level? We can debate the fine points, but if you are trying to say that my speculative suggestion was crappy and Github has other ways to make copilot legal, then I agree. If you’re trying to say that Github has no legal way to make copilot available, then I disagree.
There is already language in the terms that might cover copilot. Section D.4 I linked to above includes this:
“This license [that you grant us] includes the right to do things like copy it [your content] to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video.“
The Copilot FAQ also mentions they have IP filters and actively prevent reciting large portions of anyone’s code, it explicitly mentions a threshold of 150 characters.
Honest question: can a function have a license? Ie. can a function be copyrighted?
If an MIT library and a GPL library use the same function with some minor variation and I use the function from the GPL code in my commercial project, have I infringed on someone’s copyright/license? Or would be argument be that the function in question is not copyrightable as almost the same version exists licensed under MIT?
- Yes, functions are copyrighted.
- Copyrights are not patents, and providence matters. If you and I independently both come up with the same text, we both have a right to use it. If it could be proven in a court of law that by a 10^(-100,000) chance, we both wrote an identical novel, we'd both have copyrights to our work.
- Conversely, if you took my creative work, the fact that someone else came up with the same creative work isn't a defence
- If the code you borrowed went MIT->GPL->your code, things get very ambiguous. The copyright holder is the original author if the GPL code made no changes.
- For just one function, you might be able to get away with a fair use defence. There's a four-prong test, which is pretty fuzzy. You'd do well on some prongs ("the amount and substantiality of the portion used in relation to the copyrighted work as a whole") and poorly on others ("the purpose and character of the use").
- For something like copilot inserting it, you do much better, since intent matters too.
def print_harry_potter_book_1():
print("Chapter One")
print("The boy who lived")
print("Mr. and Mrs. Dursley, of number four, Privet Drive, were")
print("proud to say that they were perfectly normal, thank")
print("you very much. they were the last people you’d expect to be in-")
print("volved in anything strange or mysterious, because they just didn’t")
print("hold with such nonsense.")
print("Mr. Dursley was the director of a firm called Grunnings, which")
print("made drills. He was a big, beefy man with hardly any neck, al-")
print("though he did have a very large mustache. Mrs. Dursley was thin")
print("and blonde and had nearly twice the usual amount of neck, which")
print("came in very useful as she spent so much of her time craning over")
print("garden fences, spying on the neighbors. the Dursleys had a small")
print("son called Dudley and in their opinion there was no finer boy")
print("anywhere.")
[...]More like, everybody has their own sourdough starter. Some people sell theirs, some people give it out for free. Someone goes from house to house to make a super-starter by collecting pieces from each house. Then someone uses that starter to sell a patented bread
Ok it's not a great analogy either. Maybe we need to stop trying to reduce the complexities of digital so much
But being digital, the knife was just copied and the original owner still has one, but you also have theirs without their permission. So there's much less sympathy for the victim.