GitHub Copilot and open source laundering
drewdevault.com
drewdevault.com
> Allow GitHub users and repositories to opt-out of being incorporated into the model. Better, allow them to opt-in. Do not tie this flag into unrelated projects like Software Heritage and the Internet Archive.
> Track the software licenses which are incorporated into the model and inform users of their obligations with respect to those licenses.
> Remove copyleft code from the model entirely, unless you want to make the model and its support code free software as well.
About the last point: Many of the larger corporations avoid copyleft code entirely or only use it in ways that avoids the viral nature of them. So I have to assume that Copilot would also be avoided for the same reasons by the same corporations until they can opt out.
Free software is already being exploited and violated in various ways by various actors and Copilot seems to be a tool that makes this even easier. I think it will be interesting to see where this issue goes.
I have two comments and a question.
First, my comment is that GitHub claims the right to use any public code on the Internet, not just GitHub. This means that they claim the right to mine code on Sourcehut, or in my case, on my personal Gitea instance. I'm not sure your suggestion 1 covers that. I think it should.
Second, users could fork code from Sourcehut onto GitHub, and then even if GitHub only uses code on GitHub, they could then use that code. This is, of course, a consequence of using DVCS's and can't be worked around. Your first suggestion should also address this, in my opinion, by allowing original authors to opt-out.
Third, my question: you've surely seen the licenses I have been developing against Copilot ([1]) since you've emailed me about them. Do you think the way I've approached the anti-Copilot clause is still free and open? For reference, this is the clause in all of my licenses:
> In this license, the phrase “this software” includes the source code licensed under this license. It also includes the output of any execution of any algorithm that uses all or part of this software as all or part of its input, but only if the output itself is software.
(The rest of the license then says it applies to "this software.")
However, if I can come up with some other term, then I'll definitely take your suggestion. I'll just define it to be "this software," any derivative work, or the application of an algorithm...and then make the license apply to that definition.
I hope that makes sense and is what you meant. If not, please let me know.
People are allowed to read code on the internet and then write code themselves based on their experiences of the code that is publicly available. Why can't a software tool do the same? Everybody is being ridiculous about this.
For example, I'm developing an algorithm to merge two binary files of the same type, a completely new algorithm. Say someone reads the code for that algorithm when I am done and implements the same thing using the same algorithm, but refuses to put the AGPL on it (because that will be the license). Are they infringing? Absolutely.
This has, in fact, happened with the Fast Inverse Square Root algorithm, whose code is under the GPL. Copilot reproduced it verbatim, including swearing comments. [1]
People are not being ridiculous about this because it has already happened!
EDIT: Fixed a small mistake.
[1]: https://twitter.com/mitsuhiko/status/1410886329924194309
The algorithm isn't under GPL, the code is. John took the algorithm itself from code which was written earlier.
I imagine that code in the nginx repository is much higher rated then my personal code that I have open sourced.
In psychology reliability and retest quality are important factors so I hope they are for something like this too.
Obviously if I took the code and modified it to suit my purposes I would've run afoul of the GPL, but if Copilot suggests the same snippet to me it'd be fine. So there's obviously an issue here.
If I imagine some seasoned art expert standing next to me and giving me hints and ideas while I'm paining and he's using existing art as his examples, am I stealing the art? While Copilot recommends bits of code, it's not copying the entire project is it?
Do you honestly believe that? I refuse.
Not a lawyer take my comments with a grain of salt.
Or at least that is how I understand it.
It lives by this vagueness and is abused as a tool for laundering the source code, to wash off the license terms for free software under a suitably complex and inscrutable system that establishing this provenance is not realistic, even if the output would fall on the "non-transformative" end of the scale.
I can kind of understand the argument that GitHub itself is, perhaps, not liable for this (setting aside the fact that they use Copilot in their own works, and GitHub's own software would have to be examined under this lens), but it is certainly irresponsible of them and disrespectful of the community that it owes its success to, and it seems to me that its users would definitely be at a higher legal risk.
It's a thin line. Depending on how the model is trained and what size it is, it is not unreasonable to expect that it will have the ability to remember training data.
Though has ruled that training AI on copyright materials is fine, as long as the defendants can claim it's a card catalog: https://towardsdatascience.com/the-most-important-supreme-co...
So it's going to be interesting to see how this is viewed by the supreme court when it gets there.
I mean... has anyone really been "hurt" by Copilot?
Copying from another thread... The concept of intellectual property exists to incentivize creating valuable art/literature/code. In theory at least, we agree to uphold IP laws because we recognize that more value gets created when they're a state enforced monopoly on the person who came up with that piece of art/literature/code.
But we also recognize that sometimes these laws go too far; eg that there are patent trolls and corporations fighting public domain and game publishers going after anyone who makes a let's-play of their video.
In those case, it's reasonable to think the world would be better off if we all shrugged and told the IP holders "too bad, someone else is going to create value off your work and you're not going to get a cent from it, we just think it's not worth building and maintaining a nightmare bureaucracy just so you can tax them".
And from that point of view... Copilot is fine? It's not like the people posting code on Github or StackOverflow were thinking "I'm only doing this because I know a future AI 10 years from now won't scrap the code I wrote to train a neural network to create a code completion engine". Yeah, yeah, this breaks the spirit of the GPL and Stallman's vision, etc, etc.
But... I mean, at some point, you got to stop debating semantics and wonder what we're coding for. What Microsoft has created is a tool that can collectively save developers billions of man-hours. It's a net good for humanity. As far as I'm concerned, the fact that this net good was developed is infinitely more important than the fact that Microsoft didn't pay royalties to a nebulous amount of developers who wouldn't have noticed anything if Microsoft hadn't developed Copilot.
tldr MIT license is great, piracy is great, fanfiction is great, screw the very concept of intellectual property.
Essentially, I agree that the very idea of intellectual property is invalid, and my end-game would be to have it overturned entirely, copyright and patents alike banished from this earth. However, a practical view must acknowledge that we live in a world where IP is normalized in the view of the public and in the view of the law.
I would ordinarily "walk the walk" here and act as if the world operated according to my moral lens, i.e. not bugging people about compliance with software licenses. In this case, though, that would be counter-productive. The issue is that there is an asymmetry between the software producer and consumer. I believe that the user has a right to the source code for all software they use (praxis: reverse engineering is good even when it's illegal). However, under the current copyright regime, the producer can withhold their source code. If I publish open source software without concern for copyright (e.g. WTFPL), this allows commercial entities to take my code, but does not allow me to take theirs, so there is a power imbalance that works against my interests.
So, free software licenses are necessary and important. In an ideal world, without copyright, I would be totally fine with GitHub Copilot - because I would also have access to its source code, and the model, and would be able to modify, repurpose, or sell it myself. But we don't live in that world, unfortunately, which allows GitHub to exploit the power imbalance by ingesting free software into a commercial product that they have the sole right to monetize and dictate terms of use for. It's this exact imbalance that the GPL family of licenses were written to address, and it's a spit in their face to pretend that they don't apply, especially from an organization that damn well ought to know better.