Hacker News Reader

Comment by chrismorgan | Hacker News Reader

People keep on talking about the GPL in these cases, but there’s absolutely nothing whatsoever special about the GPL: any code that is not public domain (or under a public-domain-equivalent license) is equally affected. Any mention of the GPL is a red herring.

Copilot is completely depending on the legal theory of being effectively exempt from copyright, under fair use doctrine; if that legal theory falls apart, the entire space (and a lot of other machine learning stuff) is utterly doomed.

Will it, won’t it, should it, shouldn’t it? Dunno.

(And when people say that it should just say what license the code it generates is under and what attribution or similar is required: Copilot can’t tell whether it’s reproducing copyrightable chunks of code, or indeed where what it produces came from, by the very nature of machine learning techniques. The whole verbatim reproduction issue demonstrates this—they’re trying to avoid such reproductions, which a cynic might say is because it weakens their fair use claim, but it’s not easy to do.)

View on HN

The GPL license prohibits building a competitive solution from the licensed software, and 'derivative works' also require the GPL license.

So I think it is relevant here because there's a gray area around whether or not training a model is like linking to a GPL licensed software(not derivative with caveats) or deriving from one.

By the way, Free and Open-source software licenses are not public domain (or 'public-domain-equivalent'), The copyright holder of the software licenses it to whomever, but the holder still retains their copyright.

> ‘derivative works’ require the GPL license

This keeps coming up, but if you look at the text of the GPL the word ‘derivative’ literally never appears. GPL in fact explicitly exempts code that is accessed over a web service from needing to be shared, as is the case with copilot.

Derivative works don't need to be referenced in the GPL as it's a concept from copyright law. See https://en.wikipedia.org/wiki/Derivative_work

That just further supports the claim that copilot is in the clear - it is clearly a separate work with many underlying works.

Of course the code copilot generates may violate GPL, but that’s up to the tool’s wielder to determine. Just as it is when searching for code on the internet, consulting books, recalling past knowledge, etc.

I don’t even use copilot (I had early access and discovered programming languages are better for unambiguous encoding logic than English, go figure). I’m just sick of all these supposed craftsmen blaming their tools rather than holding themselves accountable for what they commit.

Copyright law doesn't work that way. I'd bet this is going to be litigated to a final decision before anyone can say with certainty if/when a NN is violating copyright (i.e. via the training data) or not.

It has the same concept:

To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.

A "covered work" means either the unmodified Program or a work based on the Program.

Copyright law hold that’s derivative works don’t require copyright permission. So again, copilot is in the clear. Copilot users may not be, but that’s up to them to determine at time of commit.

You’re missing the point: Copilot depends on being exempt from copyright restrictions, so that the license, any license, is irrelevant. Simplified, copyright law says “the creator/rights-holder owns the thing and you can’t do anything with it unless they let you (grant you license), or one of these general conditions holds”, and Copilot is not using your code under rights-holder permission, but under the general condition of “fair use”.

If the fair use doctrine fails and the license is relevant, there’s still nothing special about GPL, because almost all licenses would be being violated in some way (most commonly starting with attribution requirements). In this situation, Copilot will certainly be discontinued immediately.

I see what you mean. It'll probably come down to how the AI is trained then because Copilot reproducing entire code blocks verbatim from the source material would not meet the criteria for Fair Use.

Copilot is not a competing solution, it's a knowledge base about text, like encyclopedia. As for snippets it produces, those might be copyrightable if they pass the copyrightability threshold. If it provides you kilobytes of text at once, that would be bad. A middle ground would be Copilot tracking how much code under incompatible licenses it pasted and stop at, say, 200 LOC.

GitHub want to treat GPL as special in this case. They choose to not use proprietary code for training copilot, for the obvious reasons of getting sued by companies that uses github, and instead put a bet that using GPL and other FLOSS licenses won't cost them more than what they earn by developing copilot.

Copilot is thus completely depending on this economical bet.

It for those reasons why we could not write a "Cosinger" or Comusician" that is trained on music found on youtube. It would be sued into oblivion the first time any 2-3 notes could be linked to a specific copyrighted song. If copilot survive long term we might see a similar project trained on creative common music, including CC-NC no-derivs, but music labels might own a few of those and their guns would be quite large.

> Copilot is completely depending on the legal theory of being effectively exempt from copyright, under fair use doctrine; if that legal theory falls apart, the entire space (and a lot of other machine learning stuff) is utterly doomed.

That's really depends on the country.

For example Japan has a law[0] that's allows usage of any copyrighted materials for machine learning and other data analysis. You can also do it for commercial purposes. There are some limitations (you can't share the dataset itself, but you can share the model), but overall it sounds good.

[0] https://storialaw.jp/en/service/bigdata/bigdata-12

IANAL but as far as I see it the case of copilot could be described as an ML that will output sometimes parts of the training dataset itself.

Did you know that the first of the two configuration options for Copilot is an option to allow or disallow it to suggest samples that match public code?

https://imgur.com/D2DDuY8

It looks like that filter does an exact comparison ignoring whitespace. To be more effective it would need to ignore things like variable renames and trivial transformations (for(;;) becoming while(true) or whatever).

In other words we're getting into cheat-detection software territory, which sounds difficult to get right in general.

I did not. That is a curious option to place, given how it would seem to weaken the fair use argument (since they’re providing a way of consciously allowing probable copyright infringement, rather than just treating the issue as inherent in the nature of learning, or a temporary bug that they’re steadily fixing). But still, to defend my earlier parenthetical claim that Copilot can’t tell whether it’s reproducing copyrightable chunks of code: this option is consistent with what I intended to convey in the paragraph as a whole, since they are developing extra bits around the edges to mitigate the issue, but it’s not possible for them to do it completely—it’s more like a game of whack-a-mole, fixing this class of undesirable reproduction here, that instance there, without causing too much damage to the perceived-legitimate output.

> since they’re providing a way of consciously allowing probable copyright infringement

I think the claim that it's "probable copyright infringement" is nowhere near proven.

GitHub likely gave that option to satisfy user's lawyers who might have a higher threshold for "clean room" implementations or "no open source". Not as any kind of implication of copyright infringement.

Fair use works as an argument to the usability of Copilot.

Derivative works, per US Copyright law, are not infringement, either.

I’m talking in the context of verbatim reproduction, which “suggestions matching public code” sounds an awful lot like. At that point, I think “probable copyright infringement” is a fair description.

Your work as a whole may be innovative.

is 'if err != nil {' your original work? Or is it 'commonly accepted knowledge' as a Go programmer?

It seems like the configuration option offered should be "allow/disallow other users to copy my code without attribution" rather than "allow/disallow me to copy other users' code without attribution"

i'm not buying the argument that copilot is infringing copyright. If someone learnt how to program via reading open source projects, you don't get to claim that their future work is derivative.

Except, y'know, when it regurgitates copyrighted code verbatim[0] which is not even derivative but just straight up copyright infringement.

[0] https://twitter.com/mitsuhiko/status/1410886329924194309

Even down to whitespace?

As a society IMO we should be fine with this

"I believe that all generally useful information should be free. By "free" I am not referring to price, but rather to the freedom to copy the information and to adapt it to one's own uses ... When information is generally useful, redistributing it makes humanity wealthier no matter who is distributing and no matter who is receiving" --Richard M. Stallman

Ironic that those who generally purport to champion FOSS fail to understand that Free Software was all about defeating copyright. The GPL was meant to turn copyright against itself.

The GPL is a tool for defeating copyright, or at least mitigate the worst of copyright’s effects on software development. If the GPL is weakened, it will be less helpful.

CoPilot didn't "learn how to program", it is reproducing blocks of code from other projects, some of which explicitly state that using their code requires attribution or other forms of acknowledgement. It is facilitating infringement of their licenses.

This is only partially correct.

Since I have two free complimentary months I decided to sign up even though I'm not super thrilled with it (see previous comments). I was given two options:

1. allow code from public repositories 2. allow copilot to learn from my code

I disabled both of these options. Presumably I am now using an AI model which learns and suggests based on the context of my project.

It would be interesting to start verbatim copying some open source GitHub projects with these setting disabled and see if it magically knows what comes next (ie it does have prior knowledge of published code even with this turned off)

I'm not sure why my comment is getting downvoted.

I just gave it a test run. I have a function with this code:

  if (!card.IsFaceUp && !card.IsBlocked)
  {
    FlipTableauCard(card);
    card.SetIsBlocked(false);
    break;
  }

I then added this comment afterwards:

  // if the card is face up, flip it

And this is what copilot produced:

  if (card.IsFaceUp)
  {
    FlipTableauCard(card);
    card.SetIsBlocked(false);
  }

I'm pretty positive that is code generated based on my comment and the surrounding code.

> Presumably I am now using an AI model which learns and suggests based on the context of my project.

The "allow code from public repositories" doesn't do what you think it does. All it does is add an extra filtering step to avoid producing code found in it's training set verbatim. The model you are using was still trained on those repositories, it's not limited to your project.

Thank you, I am aware it was trained on those repositories. I am not OK with this business model.

But my comment still stands. You can turn off the verbatim copying feature that people keep talking about and the "AI model" will generate code based on your own codebase.

When I'm using it with Unity or a JS project that has NPM modules, does it use those as context to fill in some code as well? No clue.

Was it trained on open source code and is that ethically and legally shady? Yes.

Is it copying verbatim at this point? No.

Does it help me be a better programmer and will I pay for it? No and only if I forget to cancel my trial subscription.

The line-by-line nature of CoPilot may make that difficult to establish.

You can open a sidebar (in both Rider and VSCode) which displays full blocks of code

That's a good point, but until it drops in whole blocks, I think the liability might lie more with the user. Kinda like all of Tesla's non-alpha driver assistance features where to use them the user has to opt-in and agree they will maintain full control of the car even when using these features.

> some of which explicitly state that using their code requires attribution or other forms of acknowledgement

US Copyright law states that fair use and derivative work are not infringing - and said law supersedes licensing.

> US Copyright law states that […] derivative work are not infringing

It says no such thing:

https://www.copyright.gov/title17/92chap1.html#106

Okay, but Copilot isn't a human. It's a computer program. If I wrote an algorithm that spat out copyrighted code with the variables renamed, it would be absurd to say that constitutes an original work. Copilot is much closer to that than to a human programmer.

I do consider copilot to be infringing on my AGPL code.

That's not a fundamental statement about all machine learning systems. GPT-2 did a lot more direct regurgitation than GPT-3. GPT-3 tends to be much more transformative, but does still sometimes spit out code / text verbatim.

Copilot and codex spit out close enough to my own code that it's clearly creating a derivative work, at least by my read.

This is untrodden legal ground, but I think that a lot of this comes down to issues of reasonableness. The reason I used the AGPL license was to create a commons. If copilot played within some reasonably friendly way around that commons, I might not feel bad about it.

However:

1) Copilot wants me to pay to use something derived from my own code, where I stuck a license there designed precisely NOT to be in that position.

2) Copilot provides a competitive advantage to proprietary projects who are more likely to be able to afford it, over open-source / community ones. The reason I used an AGPL license was because I thought we needed this type of code to be open and transparent. I work in a domain where transparency is essential (I don't disclose domain, but you can think of transparency in government, education, voting, medical, police, etc.)

3) I have no way to have a conversation with anyone at github / Microsoft. They took my stuff, and they won't talk to me about how they use it. It's automated systems all the way down.

4) The whole Open AI nonprofit -> for-profit transformation is just sleazeball. Given all the talk about ethical use of AI, something like this really leaves a sour taste in my mouth. I don't mind DeepMind, FAIR, etc., since they're honest about their goals. Open AI feels like a Silicon Valley get-rich-quick scheme with a lot of nice marketing copy and legally-questionable tactics.

Jury, judges, and developers are swayed by common sense. People like me can be swayed to testify one way or another based on whether we feel cheated. What Microsoft / github / Open AI did here wasn't very reasonable, friendly, or sensible.

TL;DR: I support the concept of co-pilot in essence. The specifics here feel illegal and sleazy.

> They took my stuff

I was about to admonish you for phrasing it this way when we all uploaded code willingly to github, giving up certain rights according to the ToS, but then I remembered microsoft straight up bought all of github, so "took my stuff" is pretty accurate. I would be interested to see a diff of the ToS since the purchase.

It's more complex than that.

A lot of code on github (albeit not mine) is uploaded without the original party's agreement. Richard Stallman doesn't use github, but a lot of his GPL-licensed code has been incorporated into projects hosted there. If the terms-of-service allowed github to violate GPL licenses, I think most projects would need to migrate to gitlab. It'd be neigh-impossible for project authors to know that no GPL code in their project came from someone who did not have a side-license to github.

Even if that argument fell apart somehow, their terms-of-service state (https://docs.github.com/en/site-policy/github-terms/github-t...):

    This license does not grant GitHub the right to sell Your Content. It also 
    does not grant GitHub the right to otherwise distribute or use Your Content 
    outside of our provision of the Service, except that as part of the right to 
    archive Your Content, GitHub may permit our partners to store and archive Your 
    Content in public repositories in connection with the GitHub Arctic Code Vault 
    and GitHub Archive Program.

github is now selling My Content. To add insult to injury, they're trying to sell it back to me!

If I pay a monthly fee for a search engine, and the search engine displays snippets of copyrighted work published online, is the search engine re-selling that content?

Yes.

why isnt copilot being trained on microsoft source code?

Because the 'snippets' would then be several pages long.

/joke

This would make a great argument in court if this ever is legally challenged. The only real argument would be because it could lead to lost income for Microsoft. In the UK, derived works which can be shown to harm the original work’s economic viability are much more likely to be seen as an infringement.

How do we know it hasn't?

Has anyone tried taking source from leaked copies of old MS code and tried to get copilot to reproduce it?

That's a strawman.

If you learn to write novels by reading other authors, is that a crime? No.

If you reproduce their work, sometimes word by word, yes.

Take your example, but make it more to the point. I hire an anonymous ghost writer to produce for me a novel based on some story premise that I made up. This ghost writer decided to use a bunch of copyright protected sections in their draft because reasons. I think the ghost writer isn't committing copyright violations, but when I publish the book, I almost certainly am.

I'm less worried about MS getting sued for this and approaching 100% expecting that users are opening themselves up to legal exposure. I can't see any legal department saying go ahead with using copilot code, but by all means ask.

> a bunch of copyright protected sections in their draft

it depends on what this "bunch" means. It's not clear cut at what granular level does the copyrighted parts become so small, and sources so many, that the new works is considered transformative.

> i'm not buying the argument that copilot is infringing copyright

I wrote some code. Released it under the GPL, and my only expectation is that if you use my code in your product you make source available to users (and GPL does require you tell the user how to get that source code). That on small requirement, the one thing that I'm asking you to do if you want to use my code, is not being respected by Copilot. It recommends my code, and obfuscates it, and does not tell the user where it was synthesized from, nor provides a way to get to the original source. From a certain point of view, Codepilot could be seen as a willful infringement machine. It will be interesting to see how this gets sorted out.

It has been shown to have reproduced code verbatim, including comments. If that code falls under a license that has requirements or restrictions, you are infringing. The problem is, how do you know when this is occurring or when copilot spliced many things together to create something sufficiently new?

> If that code falls under a license that has requirements or restrictions, you are infringing.

I think the interesting legal question here will be, are *you* (the user of the service) infringing, or is *copilot*?

I suspect Copilot's legal team has already worked license terms such that they're passing the buck onto you.

That’s a good question.

> I suspect Copilot's legal team has already worked license terms such that they're passing the buck onto you.

it would seem reasonable that copilot should not be liable for anything that a user instructs it to do.

You are correct.

Copilot is a tool, much like the "copy" command.

If you choose to use what it's suggesting, then the fault is completely yours.

the part that I haven't seen decided yet is, how much do I have to copy before it's infringement?

maybe my co-pilot reproduces code verbatim from your GPL'd project because you and a dozen other developers all copied the same solution from stack overflow.

Remember that the SCO vs IBM court case was over a very small number of code lines and if memory serves they only lost because it was deemed trivial. Triviality might be correlated with a low number of code lines, but its certainly not a given.

If I spent hours looking at the Linux kernel source, then wrote a kernel that had a lot of the same ideas and idioms, that would indeed be considered infringement.

Some open source developers are not allowed by their employers to read source code with a different license for fear of infringement.

Independent recreation of the allegedly infringing work is an absolute defense.

If you were to write all those ideas and idioms down and pass them to someone who had not seen the Linux source code, who then used it to reimplement similar functionality, neither of you would probably be guilty of copyright infringement. (there are still patents of course). https://en.m.wikipedia.org/wiki/Clean_room_design

It all comes down to how you characterize what Copilot does. We will just have to wait for new caselaw or even legislation that accounts for autonomous systems in defining legal wrongdoing.

> If you were to write all those ideas and idioms down and pass them to someone who had not seen the Linux source code, who then used it to reimplement similar functionality, neither of you would probably be guilty of copyright infringement. (there are still patents of course). https://en.m.wikipedia.org/wiki/Clean_room_design

This response doesn't relate to the example provided by CameronNemo, as it's a different scenario.

At any rate, there is no clean room because copilot has "seen" the literal source. It is not comparable to clean room implementation in any fashion.

a training program reads source code and produces a model

the software running the model does not have access to source code

as the parent said, it depends how you characterize it, which is why this will be decided by whoever can afford the best lawyers.

Well, the problem is with that characterization is that it's shown to be false already.

Copilot has reproduced entire functions from existing codebases, which invalidates the idea it doesn't have access to source code.

I would have to better understand language transform models to back up my argument, but my impression is that copilot is not sitting ontop of a SQL database ripping the most likely line of code out of a row of a table, rather, it is a lossy compression that happens to be able to reconstruct some data better than others

thanks for bringing up clean room design, I think it's a good analogy. The model, tho it may reproduce verbatim source code, does not contain the original source as such, right?

But if that were the case, one could get away with copying music by merely compressing it - I am not copying the data, I have a totally different set of data that happens to get decoded into a similar performance.

That's roughly analogous to a machine learning model, isn't it? compressing an enormous dataset into a "model" that is capable of being decoded in myriad ways depending on context.

IANAL but I don't see a double-rot13 "machine process" as any defense against demonstrably identical code. Just because it passes through a process doesn't make it clean. There were numerous examples of whole functions and code blocks repeated verbatim from its source material. I'm not sure the state of the application now, but the effort to prove an output snippet isn't copyrighted with restrictions by the source feels like an O(N) problem that nobody would want to ever do.

At best, if copilot told you explicitly (by doing the very hard work of identifying the likely sources of the code output ) you could make some (more) informed decisions as to if it's worth the risk to include it.

I'm not buying the argument that copilot is "learning to program". It's doing nothing more than rote memorization and recall.

Some cultures unironically use this approach to educate humans.

"Some cultures use rote memorization to educate humans" != "anything educated via rote memorization necessarily has developed a human-equivalent understanding of the material"

IANAL, but my understanding is that this is not clear-cut. Clean room implementations aren't strictly required by law, but the legal standard is how similar the new work is to the copyrighted work. If an employee reads open source code and then writes substantially similar code, as copilot sometimes does, that could be found to be infringement by a court.

For this reason, I've worked at places that forbid employees even reading open-source code. If we were having difficulty with an open-soruce component to the point where we needed to look at the code, we'd hire a contractor, explain the problem, and then they'd explain a solution, and all the communications would go through a company lawyer.

Reply on news.ycombinator.com