GitHub is sued, and we may learn something about Creative Commons licensing
scholarlykitchen.sspnet.org
scholarlykitchen.sspnet.org
Such projects should always be opt-in, not just because it is the law but also because it is common sense and the right thing to do from an ethical perspective.
https://jacquesmattheij.com/what-is-wrong-with-microsoft-buy...
What do you use instead?
The top alternatives in my opinion are:
- SourceHut https://sr.ht/
- Codeberg https://codeberg.org/
- Self-hosted using Forgejo https://forgejo.org/ (fork of Gitea)
I was self-hosting my code with Gitea for a while but currently I’m using GitHub. Planning on setting up a Forgejo instance in the coming weeks.
At work we use GitLab, but personally it is one of my least favourite platforms, so I am excluding GitLab from the list above.
Forgejo is a fork of Gitea, not Gitlab.
The most likely of which – if this lawsuit ends up winning – is that corporations will have new ways to sue everyone and that the world will be a worse place.
Copyright expansion has never benefited the "little guy" such as Open Source authors, only large entities with deep pockets who can litigate to no end.
People will quote that John Carmack Doom example where it copies the function verbatim, but as far as I can tell that's a rare thing, and it's a function that's been widely copied around without proper licensing; a human could also get it wrong by copying it from github.com/random-person/mit-project with the wrong license (and since then there's also been work to prevent this kind of thing).
Co-pilot isn't unique, or the first AI/ML project to use copyrighted works; all the GPT models use copyrighted works as their input. Some doubts have been raised over the legality of that too, but it's received nowhere near the amount of criticism that Co-Pilot has, certainly not on HN, and I've never seen anyone doubt the morality of it – only the legality.
If you were to go through my public open source code I'm sure you can find stuff that's very similar to some code from my previous employers or other open source projects. Not because I copy/pasted anything, but because my brain was trained on that dataset: you see or write something that works, you face a similar problem a few years later, you write a similar solution.
"Using existing works as input" is common throughout creative works. As Phil Anselmo once said: "with Pantera we took our five favourite bands and ripped 'em off to hell".
People are already getting sued because "that one melody sounds a bit similar to this other melody"; fair use is already widely ignored/disrespected. Much will depend on the exact details, but any win in this lawsuit has a very real chance of empowering that sort of nonsense.
A union of creative minds seems long overdue. It can provide a copyright trust, addressing your concerns, as well as removing the excuse of inability to get permission from n thousand creators used. It can also address matter beyond OSS, such as overreaching employment agreement clauses that assert ownership of everything in your head.
[Possibly 'trust' is more suitable than 'union'. Something like Creative Commons Trust.]
But what prevents Microsoft from harvesting open-source code from any hosting site? What have you gained?
All of those build their models based on the same sources and it's therefore a much more general issue than just one particular company being sued.
But that doesn't make it right in this case and, conveniently, someone has decided to bring suit. The funny thing is that Microsoft depends on Copyright law for their existence and now they want to change the rules to favor them when it suits them. In fact one of the first things that Bill Gates ever did that I remember is bitch about people copying the software that he wrote.
Parking tickets should start at 50% of your yearly take home income. Didn't feed the meter an extra quarter? $10k minimum sounds fair.
Pay is not profits, it's revenue.
Fyi... Google Books (scanned and OCR'd books) eventually won against the authors filing lawsuits of copyright infringement. So there is some precedent that courts do look at the "utility" or "sufficiently transformative" aspect when weighing copyright infringement.
https://www.google.com/search?q=google+books+%22is+transform...
But courts in Europe may judge things differently.
The thing that surprised me about that ruling is that it was deemed final without a chance of an appeal.
An libraries are very special entities.
I still think "training is fair use" still has a leg to stand on, though. But it doesn't save GitHub Copilot because they're not merely training a model; they're selling access to its outputs and telling people they have "full commercial rights" to its outputs (i.e. sublicensing). Fair use is not transitive; if I make 100 Google Books searches to get all the pages out of a book, I don't suddenly own the book. There is no "copyright laundry" here.
If that's the case, we need to serious re-consider how we reward Open Source as a society (I think that would be fantastic anyway!) -- we have people producing knowledge and others profiting directly from this material, producing new content and new code that's incompatible with the original license.
You make GPL code, a make an AI that learns from GPL code, shouldn't its output be GPL licensed as well?
I think meanwhile the most reasonable solution is that an AI should always produce content compatible with the training material licenses. So if you want to use GPL training sets, you can only use that to create GPL-compatible code. If you use public domain (or e.g. 0BSD?) training sets, you can produce any code I guess.
No. It's called copyright, it is enforceable, and that's the control.
GPL source code is available everywhere, in all formats, in textbooks, on CDs, on websites, but it is still gpl.
And Microsoft doesn't get to scrub the license.
GitHub's argument* is not that they're following the license but that the license does not apply to their use. So they would continue to ignore any provision that says they can't use the material for training.
Previously discussed: https://news.ycombinator.com/item?id=27740001
Moving off GitHub is a better step at a practical level. But again they claim the license doesn't matter, so even if it's hosted publicly elsewhere they would (presumably) maintain that they can still scoop it up. It just becomes more work, for them, to do so.
*Which is completely wrong in my opinion, for the record
I think, for the desired outcome to occur, you should instead ask:
You write close sourced code, then a make an AI that learns from that code, shouldn't its output be licensed as well?
Ask the above, and suddenly Microsoft will agree.
> Ask the above, and suddenly Microsoft will agree.
Does Microsoft actually agree? Many people have posted leaked/stolen Microsoft code (such as Windows, MS-DOS 6) to GitHub. Microsoft doesn't seem to make a very serious effort to stop it – sometimes they DMCA repos hosting it, but others have stayed up for ages. They could easily build some system to automatically detect and takedown leaks of their own code, but they haven't. Given this reality, if they trained GitHub Copilot on all public GitHub repos, it seems likely that its training included leaked Microsoft source code. If true, that means Microsoft doesn't actually have a problem with people using the outputs of an AI trained on their own closed source code.
It's a surprisingly subtle distinction.
EDIT - if I squint hard enough in exactly the right way, there's a sense in which CoPilot etc aligns perfectly with the goals of the free software movement. A world in which you can use it as a code copyright laundry might be a world where code is actually free.
Is that any weirder than bizarre legal contortions such as the Google/Oracle "9 lines of code"? Or the whole dance around reverse engineering: "It's OK if you never saw the actual code but you're allowed to read comprehensive notes from someone who did"..?
There's a ton of examples like this. Tell me with a straight face that there's a clear moral line in either copyright or patent law as it relates to software.
IP is a mess and it's not clear who benefits. Is a world where code isn't subject to copyright so bad?
It is specifically the idea of using copyright to eat itself that is harmed by AI training. In the world where we currently live in, only source code can be trained on. If I want to train an AI on, say, the NT kernel; I have to decompile it first, and even then it's not going to be good training data because there's no comments or variable names to guide the AI. The whole point of the GPL was to force other companies to not lock down programs and withhold source code, after all.
Keep in mind too that AI is basically proprietary software's final form. Not even the creator of an AI program has anything that resembles "source code"; and a good chunk of AI safety research boils down to "here's a program you can't comprehend except through gradient descent, how do we design it to have an incentive to not do bad things".
If you like copyright licensing and just view the GPL as an exception sales vehicle, then AI is less of a threat, because it's just another thing to sell licenses for.
If the output (not just the model) can be determined to be a derivative work of the input, or the model is overfit and regurgitating training set data, then yes. It should. And a court would make the same demands, because fair use is intransitive - you cannot reach through a fair use to make an unfair use. So each model invocation creates a new question of "did I just copy GPL code or not".
Overall it feels like it's a bit too much of specialized learning on GPL/Copyleft code to be fair. It's not like a human that reads some source code and gets an idea how it works. It's really learning code from scratch on Copyleft code, without which it would likely perform much worse and not generate a number of examples. It's not just copy-paste, but it's closer on the spectrum to copy paste than just super-abstract inspiration to feel fair.
As others have said, I don't think it would be fine (specially from big companies pov.) to decompile proprietary code (or just grab publicly available but illegal to reproduce code) and have AIs learn from that in a way that seems different in scope and ability to human research and reverse engineering.
I think we need a good tradeoff that isn't ludditism (that would reject a benefit for us all, i.e. that is good for everyone), but that still promotes and maintains open source software. In this case it's really a public "good" that's being seized and commercialized, that doesn't seem quite right: make copilot public, or use only permitted code (or share your revenue with developers -- although that would seem more complicated and up to each copyright holder to re-license for this usage). I remember not long ago MS declaring Open Source was a kind of "Cancer", now they're relying on it to sell their programming AIs. I personally think Open Source is quite the opposite of cancer, it is usually an unmitigated social good.
Much of the same could be said for the case of artists an generative AI art.
And this isn't even starting on how we move forward as a society that has highly automated most jobs and needs to distribute the resources and wealth in a good way to enable greatest wellbeing for all beings.
Is that new? If I include some excerpt from copyrighted material in my own work and it's deemed to be fair use, that doesn't limit my right to profit from the work, sell the copyright to someone else, and so on, does it?
But if you read the source code of 100 different projects to learn how they worked and then someone hired you to write a program that uses this knowledge, that should be legit. I'm not sure if the law currently makes a distinction between learning vs. remixing, and if Copilot would qualify as learning.
But, for the general case, the argument still stands. I have looked at GPL code before. I might have even learned something from it. Is my brain infected? Am I required by law to license everything I ever make as GPL for the remainder of my days?
I mean in essence Github is a library; they did have a license to a point to do with the code as they pleased, but they then started to create a derivative work in the form of an AI, without correctly crediting the source materials.
I mean I think they made a gamble on it; as far as I'm aware, AI training sets were yet unchallenged in a court of law, so legally not fully defined yet. These lawsuits - and the ones (if any) aimed at the image generators, using CC artwork from e.g. artstation - will lay the legal groundwork for future AI / ML development.
Entities like the Internet Archive skate by (at least before their book lending stunt during COVID) by being non-profit and bending over backwards to respect even retrospective robots.txt instructions, meaning that it's not really worth suing them given they'll mostly do what you ask anyway.
But I guarantee you that if I set up a best comic strips of all time library I'll probably be in court.
I find this to be a very appropriate analogy. If Google had done such a thing, they would be facing the same kinds of lawsuits that Microsoft is facing now. And despite Microsoft's money, I don't see how they can wiggle their way out of this one. They basically ignored the license terms and attribution requirements of the authors. Something Microsoft would never stand for, if "the shoe was on the other foot".
They did appeal it. SCOTUS declined to hear the case.
https://www.nytimes.com/2016/04/19/technology/google-books-c...
Google Books retains the bibliographical information so you can properly cite the authors or contact them for permission to use their material.
And Google Books does not automatically write new books for you that you can then send off to Penguin Books or self-publish on Amazon.
That sounds to me somewhat close to "if I take an FFT of each of those copyrighted images, glue them together, and sell this as a picture, is that a derivative work?" - I'd say yes, or perhaps even a different encoding of the original work, since you can reverse the frequency domain representation and get the original spatial representation - the original images - back.
Sometimes parts of the original works are still encoded, which we've seen when some code is reproduced verbatim, and I'm sure that happens to people as well, ie. they see some algorithm and down the road have to write something similar and end up reproducing the exact same thing.
Once they iron out those wrinkles, it's not clear to me that a large language model is a directly reversible function of the original works. At least, not any more than a human learning from reading a bunch of code and then going on to have a career selling his skills at writing code.
Edit: by which I mean, LLMs are lossy encodings, not lossless encodings.
They're not, but the "giant table of token frequencies and associative keywords" reminded me of doing FFT on images, and I wanted to communicate the idea that transformations like this can actually retain the original information, and reproduce it back through inverse transform.
> by which I mean, LLMs are lossy encodings, not lossless encodings
Exactly. And while I doubt most training data is recoverable, "lossy encoding" is still a spectrum. As you move away from lossless, it's not obvious when, or if at all, the result is clear from copyright of original inputs' author. Compare e.g. with JPEG, which employs a less sophisticated lossy encoding - no matter how hard you compress a source image, the result would still likely retain the copyright of the source image author, as provenance matters.
(IANAL, though.)
I'll just finally note that LLMs are not lossy encodings in the same sense as JPEG. LLMs are closer to human-like learning, where learning from data enables us to create entirely new expressions of the same concepts contained in that data, rather than acting as pure functions of the source data. That's why this will be interesting to see play out in the courts.
You could say a higher order program can "just" be transformed into a first-order program via defunctionalization, but I think the expressive difference is in and of itself meaningful. I hope the courts can tease that out in the end, and we'll see if LLMs cross that line, or if we need something even more general to qualify.
Interesting analogy, and I think there are a couple different "levels" of looking at it. E.g. fundamentally, they're the same thing under Turing equivalence, and in practice one can be transformed into the other - but then, I agree there is a meaningful difference for humans having to read or think in those languages. Additionally, if those are typical programming languages, you can't really have the code in the "weaker" language self-upgrade to the point the upgraded language has the same expressive power as the "stronger" one. If the "weaker" one is Lisp though, you can lift it like this.
In this sense I see traditional compression algorithms - like the ones we use for archiving, images and sound - to be like those typical weaker languages. There's a fixed set of features they exploit in their compression. But human learning vs. neural network models (or sophisticated enough non-DNN ML) is to me like Lisp vs. that stronger programming language, or even Lisp vs. a better Lisp - both can arbitrarily raise their conceptual levels as needed. But it's still fundamentally compression / programming Turing machines.
And if such algorithm is copyrighted, that would be infringing! It doesn't matter if you copy on purpose or by chance.
I'd have thought that's exactly what you can't do with CoPilot.
If you overlap a hundred different FFTs, then the result is likely fine copyright-wise.
These networks are not [supposed to] contain much of the original data. Like the trivia point that Stable Diffusion has less than two bytes per source image, on average.
Stitch them side by side. Yes, this is not how those DNNs work, but the example was more about highlighting that "a giant table of token frequencies" by itself is probably reversible back to original data, or at least something resembling it.
> Stable Diffusion has less than two bytes per source image, on average.
I'm not convinced by this trivia point, though. Stable Diffusion is, effectively, a lossy compression of the training data. Nothing says lossy compression algorithms can't exploit some higher-level conceptual structures in the inputs[0], and applying lossy compression to some work doesn't automatically erase the copyrights of the original input's author.
--
[0] - SD isn't compressing arbitrary byte sequences, it's compressing images - which is a small subset of all possible byte sequences as large as the largest image used in training. "Less than two bytes per source image, on average" doesn't sound to me like something implausible for a lossy compressor that is focused on such small subset of possible inputs, and gets to exploit high-level patterns in such data.
That depends entirely on how many frequencies you're keeping.
> high-level patterns in such data
High level patterns across thousands of images are generally not copyrightable.
I might even describe the purpose of stable diffusion as extracting just the patterns and zero specifics.
Two bytes would only let you uniquely identify ~65k images though, which to me doesn't sound plausible for a lossy compressor.
Curiously, from the article, copyright infringement is not alleged:
> As a final note, the complaint alleges a violation under the Digital Millennium Copyright Act for removal of copyright notices, attribution, and license terms, but conspicuously does not allege copyright infringement.
Perhaps the plaintiffs are trying to avoid exactly this prior law?
I mean, it's obvious that uploading code requires you license the hosting provider a license to host it (which is not singing over copyright); although feel free to argue that the license doesn't or shouldn't extend to CoPilot usage.
So in a way this would void parts of many TOS agreements where you do relicense your User-Generated Content. If we're uploading memes to Facebook, they're gonna have to work out license terms with the copyright holders, not the uploaders.
Suppose person A comitted a crime, that does not mean you are now allowed to profit from someone else's crime
Same will be for GitHub: if people really didn't have the legal authority to bind someone else's code to GitHub's TOS, then GitHub can go after the $x million of users that have uploaded code they shouldn't have.
Ok, but can they go after them in an efficient manner that doesn't end up costing more than it's worth?
Thats doesnt mean. Getty can keep the money
It is a similar case when a single user uploads a movie or game to a pirate torrent site. The site can have a terms-of-use that gives a license to the hosting provider, but naturally the users who upload the content might not have the permission to grant anything to the hosting provider. Depending on how much the hosting provider is or should be aware, hosting the content can still be illegal.
Then, chances are, it's technically illegal to upload those other contributors' code, although if that code is contributed via GitHub itself then the code in the pull request has already been licensed to GH.
It boils down to copyright/DMCA not requiring that hosting providers ensure the code people say they have the rights to is valid at submission, so GitHub now has tons of examples where people themselves lied about the permission when they uploaded code that wasn't theirs, and this will probably be a valid legal defense, at least only for the argument of "does GitHub have the right to use the source in their ML model" (it might really boil down to "are GH's terms vague enough to where nobody thought they the license included the ability to train artificial intelligence").
In the US what it will be is good evidence to support a claim by GitHub that they were an "innocent infringer"--someone who did not know they were infringing and had no reason to believe that they were.
What that does is in the case where the plaintiff seeks statutory damages (which they almost certainly will¹) is lower the lower limit. Statutory damages are normally $750-30000 (amount determined by the court). If a defendant proves they are an innocent infringer that lower limit drops to $200. If the plaintiff can prove that the infringement was "willful" the upper limit goes up to $150000.
Statutory damages are per work infringed, not per infringement, so we aren't talking $200 or so multiplied by the number of copies GitHub distributed. We are talking of a likely award of $200 or so total (plus maybe attorney fees).
¹It is usually way too hard to determine actual monetary damages in cases like this, and actual damages are likely to be quite low anyway, so plaintiffs almost certainly will go for statutory damages.
Can this be said by microsoft? They explicitly chose to not include hidden repositories by their paid customers, likely because they knew that those customers would sue them if proprietary code was used as training data.
Apple seemed to have chosen not to include GPL in the app store for very similar reasons. Their term of service require a permission which is incompatible with the terms of GPL, and knowing that GPL software tend to include multiple rights owners, Apple chose to go the route of not allowing GPL.
And last, authors has requested to have their works removed from the training data. It is part of the lawsuit. Can Microsoft then still claim that they did not know they were infringing?
I believe GitHub would likely be seen as an innocent infringer in that case.
I doubt Microsoft would make that argument. It is more likely they will argue fair use, but by not using closed repositories owned by paying customers, it seems to show that they themselves have doubt about the legal status of using other peoples copyrighted work for copilot.
Or they're worried about leaking secrets, which is a different matter entirely. The amount of copying needed to leak secrets is far lower than the amount needed to commit copyright infringement.
If Copilot is trained on Microsoft's code and accidentally regurgitates a comment, "// for 2024 Xbox", it has done one but not the other.
Copyright infringement doesn't have a fixed size. It depend on context and what kind of information is copied. It demonstrate that copilot has not actually learned how to code (as many people like to claim), but is simply a algorithm for copying code. If it had learned to code like a human it wouldn't divulge secrets.
> 4. License Grant to Us We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video.
https://docs.github.com/en/site-policy/github-terms/github-t...
I suspect that the main argument will hinge not on the permission though, but rather if the use of code that is copyrighted in an AI model is transformative enough to fall under fair use. Obviously it's to be decided but I would imagine that because it wasn't a human transforming the code and/or hand selecting the code to put into the AI model, that it won't be considered transformative and therefore the use of the code doesn't fall under fair use.
I'm very curious how this case will play out.
To illustrate: GitHub could delete any project they want, and there would be no real recourse for the project's author. That is a service decision that they reserve the right to impose via their TOS. However, if they were to steal code from a user's private repository and violate the license therein, the author could sue for theft of intellectual property.
Again, the LICENSE file in the repo is not the only license for that code. A copyright holder can grant people licenses to their work with or without documentation and with or without that license being accompanied within their work itself.
By uploading code to GitHub, you are asserting that you can legally grant GitHub a license to that code for hosting as described below.
> If you're posting anything you did not create yourself or do not own the rights to, you agree that you are responsible for any Content you post; that you will only submit Content that you have the right to post; and that you will fully comply with any third party licenses relating to Content you post.
Note that this is literally only limited to the provisions set below; uploading to GH doesn't allow them to import or use your code in Windows or the Github codebase or anything like that, doing so would indeed be bound by the license terms you've granted the world via the repo's LICENSE file.
> 4. License Grant to Us We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video.
https://docs.github.com/en/site-policy/github-terms/github-t...
I think we're over here in our armchairs weirdly assuming that GitHub doesn't have any lawyers working for them. I think they know they're legally in the clear on CoPilot.
I'm not at all a lawyer, but in my opinion we observe that the non-automated version of AI-generated works (the act of making art and prose in the style of an existing copyright work based on the artist's observation of that work) is not illegal. The only thing that AI introduces is automation.
What I can't understand is people feel locked into Github because of the social features. To me they seem the least important part of Github, particularly with so many OSS projects running communities on Discord or Slack.
Hmm...Automated Inference? Automatic Infringement? Maybe we can make a nice backronym out of this.
IANAL, but I think Copilot is not a reasonable thing to include in these services.
Agreeing to GitHub's terms doesn't try to assign copyright over your code, it grabs licence to use your code however they see fit which is¹ legally quite different.
Of course the real fun comes if someone agrees to their terms then uploads some of my code which they have to right to assign the licence to GitHub for. What come-back do I get in that case if I don't want my stuff used that way?
It seems odd to me that MS² who for many years strongly spoke against touching anything with the remotest whiff of GPL because of what it could legally do to your release requirements, are now more than happy to hoover up all the GPL covered code in GitHub and potentially mix it into their users' work output via copilot.
----
[1] in my not-at-all-legally-trained understanding
[2] current owners of GitHub, for those not paying attention
If it is shown that the license in the TOS is valid, the legal question might boil down to "is the TOS License broad enough to where nobody thought that it allowed their code to be used in for-profit ML models?"
user bluca works at microsoft, but i think their opinions are their own.
How does one check who owns a work if the work does not include the authorship information? (or if the work has been altered to have incorrect authorship information)
Edit: Wow, this is game changing. Markdown parsers need to implement superscript ascii character support!
Lowercase ⁽ᵃ⁾ Uppercase ⁽ᴬ⁾ Numbers ⁽⁹⁹⁾
To type them easily you'll usually need composition (sometimes called chording) support. Some Linux (and other Unix) distributions still have this built in by default, though last time I used Linux for much desktop use it seemed to be fading from common availability, otherwise you'll have to hunt for another method. On Windows I use http://wincompose.info/ (here [atlgr][^][1] produces “¹”, for instance, in the default settings) which is useful for a number of other things (I first started using it for accented characters like á on a UK keyboard). If you have a keyboard with programmable function keys then you could use its customisation tool to map some of them to produce the super-script (or sub-script, or other) characters you commonly want.
For less convenient typing, use your OS's Character Map or similar tool.
On Android, unless you have a different keyboard in use which doesn't support this of course, long press on the number on the touch keyboard gives superscripts as an option.
chucks iPad out the window
We only get the standard shift character as an option. E.g. 1 shows !, 2 shows @, etc.
I’d use superscripts all the time if it was on the keyboard. Anyone know if MacOS can do it? Other than pressing the weird globe key and searching.
https://apps.apple.com/us/app/unichar-unicode-keyboard/id880...
They are _not_ in ASCII. A few are available in some 8-bit code-pages that expand on ASCII's 7-bit character set, otherwise you need to be working in a Unicode-supporting environment (which is most these days, thankfully).
I disagree, IANAL, and I'm happy they are getting sued. The fact that they are are foremost a code hosting/collaboration company and the terms of service we all agreed to when creating our accounts was to have them host our code, and use it however they need in order to provide the service. The fact that they changed, post agreement, the service provided (from mere hosting/collaboration to feeding it into Copilot) should be an opt-in. I hope it's tested in court what the service is, because if you have a feature that (let's say) 1% of your users use, that's not the service, is it?
I'm pretty sure I didn't receive one about them using my public (although unpopular) open source code into their NN mixer.
Edit: Anyway a bit outside the point. It being, when your ever expanding set of services incorporate your ownership in ways unforseen when the agreement was made, opt-in would have been the agreeable aproach in my opinion. Even ignoring over the licensing woes, as that's something to be tested in courts with this lawsuit, and interesting to follow.
This isn't about privacy, it is about licensing (and possibly copyright). mhitza mentioned privacy as another policy, that you agree to upon sign-up like the terms of service, one for which updates are regularly announced.
> I'm also curious how you're certain your project was used?
Hasn't it been suggested that all public repositories at least could have been used? It makes sense to give the training pool as much information as possible.
The terms of service say you grant GitHub an implicit license to display your code. They also say:
"We may modify this agreement, but we will give you 30 days' notice of material changes."
Are you claiming that hasn't happened?
> Hasn't it been suggested that all public repositories at least could have been used? It makes sense to give the training pool as much information as possible.
Has it? I don't like to make assumptions.
> Are you claiming that hasn't happened?
Your post that I replied to explicitly stated that it hasn't.
Is that the case or was that one if the assumptions you don't like to make?
Not your code. Anyone's code that's uploaded to github by any third party. Under open source licenses, that's expressly permitted. However, it seems you're arguing that Github is not bound by the license under which they (and their users) acquired the code because of their TOS.
How many projects on github are put there by the original copyright holders? Perhaps it's more than 50%, but it certainly is less than 100%. So where is github's legal paperwork that shows that they're only processing the code that's copyrighted by the user who uploaded it, or that they received permission from third-party rights holders that did not agree to their TOS?
It's interesting, because Github certainly have the right to set whatever terms they like on their website. The dependency authors certainly have the right to set the licence terms on their code, and that gives me the right to vendor their work and include it in my upload to Github. But I, obviously, don't have the right to agree to Github's terms on behalf of the dependency authors.
I think the problem here is that Github assumes that everything I upload is my property, and that I have the ability to assign a licence to what I upload. This is not true for any project that vendors its dependencies.
Under other circumstances they don't need it. But if CoPilot is creating a derivative work including parts of that code without including the licence terms or attribution (as required by many licences) things are far more grey, or possible full black.
Some argue that the AI is unaware of the terms so can't be held responsible. Two possible counters for that: 1. it is the licence that gives you the right to use the copyrighted code, if you are unaware of the licence then why assume you have the righ tto use the code? 2. if I found some useful code that happened unbeknownst to me to be from MS, and used it in a way that I wasn't licensed to, and MS noticed, it is a pretty safe bet that they'd state ignorance of the copyright terms doesn't mean you can't be held to them.
Or another angle: the tool is allowing, even encouraging, people to use code or other materials in a way that infringes copyright (again: you don't have the right to use the code under most licences unless you give correct attribution and such) – the very conditions often stated as reasons for trying to ban other tools.
Plus of course the general argument: if this is entirely a non-issue, why is no Windows, Office, or SQL Server code in the training set? Surely they are great examples of how to do things to train the AI with?
Look, proving copyright infringement is downright trivial here, if copyright law applies. And that shows where GitHub’s defence will—must—lie.
(And for other readers unfamiliar with the parent comment’s phrasing: “end-run” is apparently an American sporting term which here makes “as an end-run around” mean “to circumvent” or “to work around”.)
DMCA was designed to catch not just normal pirates that share the copied content, but also "crackers" that figure out how to share content that is protected somehow, as such it offers various ways to infringe it without infringing the copyright itself.
Basically they are accusing MS of behaving like crackers, by removing stuff from code to allow it to get shared illegally.
Create a for-profit copyright registry for code snippets that are long enough to qualify for copyright protection. You can be the canonical owner of the copyright for a given piece of code! For a premium fee, we can generate and submit a patent on your behalf as well.
Once I have a large corpus (perhaps millions of entries of code, most one or two lines long), I can automatically scan new respositories and send cease and desist letters for violating my client's copyright. Even if a piece of code is very common, that doesn't mean its unoriginal, it just means that there are many people violating its copyright after all. According to the logic of the folks in this thread at least.
Just yesterday, I bought a nice domain name for an idea that's very close to what you mention, monetize on snippets of code.
If you want to team up, hit me up!
This may be one of the reasons why the lawsuit isn’t based on copyright.
But your idea is pretty much what almost all manufacturers do, and have been doing for decades.
In copyright law there is no such concept as "code snippets that are long enough to qualify for copyright protection" or "canonical owners". Quite explicitly, copyright does not give a monopoly over an idea, but merely protects against the unlawful reproduction of an original work.
If you take some snippet from a work in which you own copyright and find that in the world multiple people have somehow managed to write the exact snippet, but they did it independently without copying it from you, then copyright law effectively states the following things:
1) They definitely aren't violating your copyright, and you have no claim on them whatsoever - independent creation is a complete defense to copyright infringement;
2) Perhaps this snippet might be judged uncopyrightable, as the existence of multiple independent recreations is some evidence that it lacks originality and thus would not qualify for copyright protection at all.
There does exist the concept of 'originality' in copyright law, which I was erroneously conflating with length.
Signing up for disperse litigation like this seems like a pretty ballsy move by GitHub, but hey, Microsoft presumably has in-house lawyers with lots of spare time.
a) at scale
and
b) make some other population happy
In other words, piracy should be perfectly fine, too, right? After all there are a huge number of users who benefit from it?
Made all the more silly by the fact that it's Git. You could just host it yourself for five bucks a month and that's probably overpaying.
Embrace
Extend <-- here
Extinguish
1. Acquire company for tens of billions.
2. Intentionally ruin own investment.
3. ???
4. PROFIT!
?
1. Acquire company for $7.5bn in stock, so fortunes are joined rather than cash paid
2. Still charge money for it
3. Create an AI product out of the open source bit of it, justifying the price tag, as well as build links to Microsoft dev tools to entice OSS back into the Microsoft ecosystem
4. Maybe profit, but almost certainly not loss
Do you mean copilot? I would not classify that as extending anything. It's just a thing they made.
"Monetizing goodwill" is not an extend.
And the idea of the extend of EEE applying to all of open source at once, the way you could apply to a product or a standard or a protocol, doesn't really make sense.
It's basically Microsoft saying "Here is a thing that looks like it might in some way eventually be a threat to our business model and/or we can make some money off of it -- let's get our hooks in now and see what happens, we have the money to do it."
EEE doesn't need a specific plan but it does need some kind of target standard. Getting into an emerging market, without specific kinds of integration or malfeasance, is just competition.
Even Ignoring the value and the features, Employers don't ask for your git link, they ask for your GitHub account. And since most projects are on GitHub having all of your projects there tooz makes it easier to see all of your commits, making your profile look more active.
That's without mentioning the ease of discovery and issue reporting since everyone has an account.
Drugs, alcohol and sugar all fit this description very neatly.
It's good to have a backup plan, but it's convenient to keep using it for now.
Ah, but GitHub isn't selling git hosting. It's a social network that also does git. That's the cake that Microsoft bought, not the UI and API frosting.
> ForgeFed is an upcoming federation protocol for enabling interoperability between version control services. It’s built as an extension to the ActivityPub protocol, allowing users of any ForgeFed-compliant service to interact with the repositories hosted on other instances.
Sure, it might work fine forever, but when it doesn't, you're really screwed and you could have avoided that in a relatively simple way. Reminds me of seatbelts and fire extinguishers.
The value GitHub provides is far from unique in anyway, but let’s not pretend it’s trivial. Especially for an open source project already struggling to get contributors to their main code base, even more so for any ops work.
local> ssh user@example.com
user@example> git init --bare $DIR
user@example> exit
local> git clone user@example.com:$DIR
I'm with you in camp baffled.
Of course you could do all of these things with enough work. But why would the average developer want to? Do you really think most developers care so much about Microsoft owning GitHub?
They use this for access:
(somewhat ironicaly code hosted on github. Not sure its still being updated..)
we currently don't use it, just because its on the same network as our site.. though because its git and it replicates the repo everywhere its less of an issue.
There is no situation in which I'd want to do all of the above work for every single repository I setup.
I have hundreds of repositories that I own on GitHub for things like school assignments and personal projects. If I start a weekend project as you describe then the first 4 hours are going to be setting my repository up.
Nobody wants to do this. Just because something is difficult or time consuming doesn't mean that it is good or useful. Doing this once would be a fun learning experience. Doing it more than once is a useless chore.
What the heck are you talking about?
The only work you'd have to do "for every single repository" is the single git command.
Getting a server, managing access and discoverability, setting it up for browser access, setting up backups, those are things you would do once.
If that's a waste of four hours, valid argument, but it's not a waste of four hundred hours. You're grossly exaggerating the cost.
Oh and you didn't mention keeping the server updated but that's probably ten minutes of effort once a month.
> Doing this once would be a fun learning experience. Doing it more than once is a useless chore.
Then there's no problem.
As for myself, I don’t like GitHub UI, which is slow, has low information density, and is generally lollipop-like; and its social media aspect, which often turns the bug tracker into a Twitter equivalent with viral bugs, emojis to cheer and boo people.
So I set up a cgit instance for myself. Patches can be sent over mail as attachments generated with git format-patch (attaching files to mails isn’t hard). Issues can similarly be sent over mail and described in a BUGS file.
That’s sufficient for my single person projects. Probably also for n-person projects for small values of n (let’s say 7). Past that I’d set up a Gerrit instance, which IMO has the best UX of all code review tools available, free or not; and a Redmine for ticket tracking.
I compare it to using gmail as your professional email. It's a bad idea; even if it never bites you, because the cost is so little and the harm is so great if it ever screws up.
Except I can see why average joe user might not think about it, and I don't think developers have that excuse. You should know and understand that tech is risky enough. Same reason there was no excuse for the kik zero padding debacle. The fact that a LOT of people did a lazy dumb thing doesn't make it not dumb or lazy.
Because too many open source projects rely on it. Projects like crates.io force you to have a github account to use it. Most (neo)vim plugin managers give preferential treatment to github over other forges.
But if you've been watching, literally the only reason they don't hate it now is because they lost the open source v. proprietary battle.
Why is this type of argument even valid? Isn't this fundamentally saying, "The cost of not infringing copyright is massive, so we will glibly infringe!"
So it is not okay to infringe copyright at a small scale but okay to do it in a large scale? How can such a line of argument be sensible in court? But apparently infringers are using this line of argument. So how? Is it not absurd?
it is.
"Your honor, I've been drink-driving so many times I honestly can't tell you an accurate estimate any more so in both our interests let's agree it was basically uncountable, or 0."
wait a minute...
"Your honor, it would have been onerous to ask each account owner if we could have their tokens so we just took all of them at once"
And that would make sense and it would be argued on its own merit. The judge/jury will decide if this argument is correct and legal.
But the article implies that there are lawyers and infringers out there who are arguing that they could not have possibly afforded the cost of not infringing, so they were justified in their infringement. Since when did the massive cost of avoiding infringement become a valid reason to carry on with infringement? This seems just plain absurd by common sense. How do lawyers and infringers make this argument? How is it even entertained in court? What am I missing?
Humans are allowed to be unoriginal, uncreative, boring, mediocre, and all sorts of things. But they’re not copying whole cloth the way copilot is.
Stack Overflow content is CC-BY-SA 4.0 yet I can bet most corporate codebases include tons of code snippets without a link or citation to the original answer
From what I've seen it is producing fairly generic boilerplate that has been modified based on the rest of the code in my repo so that it works with the other functions and even incorporates other pieces of my code in the same style that I'm using. The boilerplate aspect makes sense because this would be the most common sequence of tokens that it observed during training. It's somewhat miraculous that it can incorporate code on the fly from my repo. I've never seen anything that looks like a direct copy paste from elsewhere though. If you have a different observation I'd love to see it.
Probably helps that this is from a codebase that's been forked quite a bit.
This is also easily solved by checking the box in Copilot that says not to produce any code matching public code.
I don't know whether copilot is giving me infringing content or not. I'm always at risk that my question was one of the ones that trigger infringing replies.
It might not be that easy, I think Wine developers are not allowed to read code related to Windows, even if this code is published on GitHub. The fact you looked at the code was decided to be a risk.
You also have cases with a NN producing an identical output, so you either prove your NN NEVER produces copyrighted code or you have to have a second process that is 100% correct and double checks the NN output and check for plagiarism.
I am against Microsoft in this case because they decided not to put their proprietary code in the NN , would have been funny to have the AI write an open source Windows re-implementation when you feed it the Win APi documentation.
That's why I don't believe "but that's like humans doing X" is a strong argument.
I dony think Microsoft wants to go down this path
Simply reading the leaked source code of Windows makes you not eligible to contribute to wine.
Why is Windows source code so much more important than mine?
The other thing is that copilot is not a human, so it doesn't matter anyways.
Humans are a special exception with laws, because they are intended to protect and benefit humans while also being fair. I don't think you can just substitute something in and assume that the same rules apply.
That's the neat part, they don't. It's essentially a self-imposed limitation which contradicts actual court rulings on the matter such as Sony v. Connectix, in which the court commented on clean-room being "inefficient" and the kind of inefficiency that fair use was "designed to prevent".
You realise that they haven’t actually used that line of argument, right? The article author speculated that it might be part of the defence and then said they didn’t find it compelling. Set up a straw man and then knocked it down in virtually the same breath.
Don’t waste your time complaining about legal arguments that have not been made except in the imagination of one author.
No, I think you're missing the "transformative" part.
The line of argument isn't "we're going to resell millions of codebases as-is for pure profit", which would be undisputed copyright infringement.
The argument is that something highly transformative (e.g. training models) isn't infringement at all, because transformative works are covered by fair use. And that, if we still wanted to explore interpreting/changing the law to force opt-in for highly transformative things, it's logistically unreasonable, to such an extent that the transformative thing couldn't occur at all. So that it's a waste of time to even be discussing asking for permission as some kind of potential compromise or requirement. If it's transformative and therefore fair use, asking for permission is an irrelevant distraction.
That's why this type of argument is valid. I'm not saying whether the argument will/should win in this particular case, but I'm definitely saying there's nothing absurd whatsoever about it.
In the extreme case, the model's output might be a verbatim copy of a large portion of the original input ("training materials"); but even if it has been extensively modified, e.g. to conform to the coding style of a target repository or to follow a different language standard, this might not be "transformative".
(Compare: A translation of Harry Potter to French looks superficially quite different from the English original, yet it is still a derivative work; and if you're planning to publish one, Ms Rowling (or her publisher) may want a word with you. And that would apply whether you translated it "manually" or pushed it through Google Translate.)
Copyright is not a natural human right; it's a construct invented and conferred by governments in order to achieve certain objectives. (It's more like a state license than a right, to be honest; using "right" was a historical masterstroke from the original inventors).
As such, if those objectives can be provably achieved in a better way without copyright (or rather cutting copyright a bit smaller), there might well be a case for foregoing punishment.
It's an exceptionally-hard argument to make, but it's not illogical.
(and with the deep pockets GH/MS have, it doesn't really matter if the case eventually loses on a big principle - it's just a case of dragging it long enough that, some time through the whole process of appeals, the plaintiff will get broke enough to give up or accept a deal. This line is likely just one of many that defendants will employ.)
I don't know of a better definition for "natural human right" than "a right/privilege/protection given to everyone automatically, even if they don't know about it or claim it, unless they specifically opt out of it." We get to decide what our "natural human rights" are, and we've decided that you automatically get copyright on your creative works even if you don't know what copyright is. Seems like a good thing, and a natural human right.
> We get to decide what our "natural human rights" are
https://en.m.wikipedia.org/wiki/Natural_rights_and_legal_rig...
That's not what copyright was, when it entered the legal landscape; and it still isn't in so many countries. And even where your definition is somewhat accepted, people disagree on what exactly it means (How long should it last? Can it be inherited? Does it apply to this or that? Etc etc). Even simply the fact that it can literally be bought and sold would indicate that it is not a human right at all - those are typically unalienable. It is a commercial right at best.
"It has been pretended by some, (and in England especially,) that inventors have a natural and exclusive right to their inventions, and not merely for their own lives, but inheritable to their heirs. But while it is a moot question whether the origin of any kind of property is derived from nature at all, it would be singular to admit a natural and even an hereditary right to inventors. It is agreed by those who have seriously considered the subject, that no individual has, of natural right, a separate property in an acre of land, for instance. By an universal law, indeed, whatever, whether fixed or movable, belongs to all men equally and in common, is the property for the moment of him who occupies it, but when he relinquishes the occupation, the property goes with it. Stable ownership is the gift of social law, and is given late in the progress of society."
(https://press-pubs.uchicago.edu/founders/documents/v1ch16s25...)
>[The Congress shall have power] “To promote the progress of science and useful arts, by securing for limited times to authors and inventors the exclusive right to their respective writings and discoveries.”
As I see it, the only leg GitHub can possibly stand on is the “fair use” exemption of copyright law—that the license is irrelevant, because they weren’t using it under that license.
So then you get to the last paragraph of the article, and the “fair use” claim is finally mentioned—as something the plaintiffs seem to be seeking to avoid bringing into it because that would make things messy. But… GitHub’s defence must be “fair use”, I can see no other response. Yes, the plaintiffs “chose to focus on something that is beyond factual dispute”, but how are GitHub ever going to do anything other than bring fair use into it? So I don’t see how they could expect it to “still provide the same damages” without bringing fair use into it. (And I can’t imagine GitHub will settle for anything other that total vindication here—even settlement would doom Copilot.)
Returning to the title: I cannot imagine any way that We May Learn Something About Creative Commons Licensing from this suit. About the interactions between copyright law and machine learning, maybe. But about CC-*, GPL, Apache-2.0, MIT, whatever? Nah, there’s nothing interesting about them in the suit, because if they were involved, it’d be cut and dried.
Fair use is only allowed if the work you're doing is purely for the greater good. I might be wrong though, IANAL.
https://en.wikipedia.org/wiki/Fair_use, lots of good reading there.
It might seem stupid, but I worry that if copyright begins applying to "mining" then the next thing is that it applies to humans watching things.
Of course, if an AI re-creates copyrighted content, copyright should apply. Just like it applies when I redraw and sell the Mona Lisa, but not when I store it in my memory. I would pass on the responsibility to users. I don't fear my use of Github Copilot because it's far from infringing any reasonable copyright... then again, I'm assuming the most likely way to infringe copyright with GPT is to use a prompt that almost explicitly requests it.
[1] 35% chance of success on https://manifold.markets/JeffKaufman/will-the-github-copilot...
The current understanding of screen scraping is that it is allowed, despite what is in the websites terms. Effectively if a human can access the content freely without having to actively agree to a license or terms you can scrape the content. You can't republish verbatim, but you can data mine and perform an analysis and publish that. This is how the legal status of all AI training data scraped from the web is being interpreted.
When it comes to open source code I suspect it will be found to be similar, if the code is freely visible on the web by a human without an active agreement to view it, then it will be possible to "scrape" it. I don't think the license the code is under will apply if that is the case.
Obviously in this case is GitHub "scraping" its own site for the training data? Probably not, that may come back to bite them.
This then also opens up all sorts of interesting questions of whether you can copy paste code from a website and use it internally (not republishing), despite the license attached to the code. If it is freely visible.
Clearly a test case, this one, is needed to clarify the situation. And just because it's legal, it doesn't mean it's moral or ethical.
We may yet see the outcome of this case change the current interpolation of legal screen scraping, it's going to be an interesting time.
On top of all this there is then the question of an AI model reproducing code (or and image or music) verbatim. That obviously needs to be clarified by the courts too.
I don't see the scraping case applying here -- the idea that all human-readable code accessible on the public internet can be ingested into such a system without regard for its license would effectively mean that anything posted to the public internet is entered into the public domain, which seems ridiculous on its face (especially when the author(s) is including an explicit license alongside that code, which the scraper can theoretically also read and account for).
"In the style of" killed copyright in 2022.
I want to have chatGPT answer my questions, and reference materials when doing that. For example I could paste an article and start asking probing questions, debating it, asking for summary, ELI5, etc.
It would be a research assistant and tutor.
Some people will want to read the AI generated knockoff. That number of people will usually be much smaller than the number of people who want to read the original and many of those people interested in the AI generated knockoff will also read the original.
For example, one obvious observation from looking at fan fiction creations is that 'shipping' is popular, that certain people would strongly prefer certain characters to have romantic relations - and AI generated Lord of the Rings lookalike could have the story with the particular relationships that particular reader would prefer, based on an AI analysis of their earlier reactions to other books; this is not something that we have working today (as far as I know) but we're not that far from it becoming real.
I'd then make a new combined copyright/patent system. You would get 1 year on anything creative. You can double the remaining time if you publish all the info necessary to easily recreate what you did. For software, that would be the source code. For music, the score and source recordings. For paintings, the source material and types of paint used, etc. For toys, the 3d design files, etc.
1/2 years of head start is plenty of head start to get your business going. I might make say a 10 year attribution requirement. I'd leave trademark law mostly as-is.
Edit: If you doubt this, notice that co-pilot was trained on public, open-source code on Github. Not on Microsoft's/Github's own proprietary code. If co-pilot is truly so transformative that copyright doesn't apply, why not feed it all of Microsoft's code to train it better?
Presumably because there might be trade secrets in there that they don't want to leak. That seems entirely separate to copywrite to me.
I hear this argument a lot but I think the answer is actually pretty mundane: the model behind Copilot was trained by OpenAI, not Microsoft. Microsoft has a large investment in OpenAI, but they don't own the company, and AFAICT OpenAI did all of the scraping for Copilot on their own, without any special access to MS code.
It clearly isn't in public domain. But if we define something new, public knowledge domain. This being material it is legal for a human to look at and learn from. They gain no rights to copyright or IP, but they can learn from it and use it per the existing limits of copyright and IP. Saying that anything posted online gets entered into public knowledge domain seem agreeable. Few things wouldn't be allowed here, generally material that is agreed upon to be illegal world wide (and some countries may have tighter limits, like a theocracy banning someone from learning anything from material deemed blasphemous).
Then it is a question of if an AI can also learn off of such material as long as it doesn't produce works that violate existing copyright or IP laws, same as a human. This doesn't seem, on its face, inherently ridiculous. There are still corner cases and potential for abuse, but those also exist with copyright law yet we don't throw the whole system away and just ban all forms of copying or selling the right to copy.
IMO that second case is a FAR more interesting question.
Screen scraping is essentially a question of whether or not the actions constitute something akin to hacking, which is almost completely orthogonal to copyright. The main intersection you get is that many screen scraping scenarios are about things that aren't copyrightable (the US doesn't recognize "sweat of the brow" doctrine, so databases aren't copyrightable). When Google was scraping lyrics off of lyric sites--lyrics being totally and clearly copyrightable--it was dinged pretty hard for that.
Was google dinged for scraping the lyrics or publishing them verbatim? My understanding is that it was the latter.
Would this apply to books? I can walk into a library or book store and OCR countless pages of countless books without agreeing to any license.
But republishing large chunks of the content, whether verbatim or in a "derivative" form such as a translation, would generally not be allowed without explicit permission.
How much "fair use" allows when it comes to copilot spitting out copies of functions it saw in somebody's repo.... well, that's a line that hasn't been defined yet, afaik.
If Github Co-Pilot includes GPL code then produced works should have GPL too, right? It is known that it produces verbatim copies of sections of code, so the 'derivative' explanation doesn't hold water.
Alternatives may be to copy CC0-only (which can't be guaranteed, also who'd believe you lol) or target license-only - as in, if my project is MIT, go with MIT projects to source from, if I'm GPL, include GPL and so on.
Maybe they chose the Uber strategy of 'What we are doing is bordering on illegal but by the time the bell rings we'll be valuable enough to write the law ourselves'.
The decision to only train it on "open" repositories was one of self preservation.
For reference it's been shown to cough up code from Quake verbatim. This from John Carmack(?) also includes his profanity laden comments:
This happens only rarely, like under 1% of the time. It happens mostly for well replicated code and not so much for code that only appears once. It can be filtered out with search and bloom filters of ngram hashes.
But the prompter can goad the model into copyright infringement by quoting the start of a copyrighted text verbatim, and asking for completion. The longer and more precise the prompt, the higher the chance of regurgitation. So, when it happens, we're often "asking for it".
Both regurgitation and hallucination seem to be LM problems we can tackle. They are complementary - in one we don't want the model to replicate the training data exactly (be creative), in the other we don't want the model to invent facts out of thin air (be factual). Both can be tackled by using search for reference testing.
The fact that Microsoft is wary of providing it with things like the Windows source code says all we need to know about how much it can be trusted.
No.
It's not like copilot made you use the code, copilot didn't commit or release the app with the code.
Copilot didn't breach the copyright, you did. It's a tool. You used it. You released it.
Maybe there's a product which you can include to see what code of yours violates copyright in the future?
Innovation in code should be heralded but if in the majority of cases the coder using Copilot and similar tools is just saving time on bog standard functions they could write themselves, it's difficult to understand why that needs to be attributed.
But instead of either of these views that focus on selfishness, it's much more productive to instead think about what benefits society as a whole.
It's so bizarre to see these prima facie bad arguments being used by someone who isn't being paid by Microsoft to make them. If Microsoft puts all of their code in, requires anyone who uses copilot to share their code with the algorithm, and allows anyone to run the model on their own platform complete with updates, you'll see all of the FOSS objections dry up in an instant.
The fact of the matter is that some companies have made a paid service by violating the copyright of individuals. That's fundamentally not okay.
The fact is as a society we have decided to reward creators with copyright as a means to commercialise their creation and get compensation. Who is to say programmers are not creators and the compensation they want for open source licenses is attribution?
Microsoft really should have known better than to touch OpenAI without a 10 feet barge pole.
Most coding is not innovative, and that is the kind of code that these tools are producing and derived from in most cases.
So your requirements are pseudo-code which you simply have ti translate. I see. No creativity required. Jepp.
> Most coding is not innovative, and that is the kind of code that these tools are producing and derived from in most cases.
I see what you want to suggest. Then it woulnb't be required to learn on these datasets and simply build a "fair use" product which covers these cases with a snippet engine.
Don't be naive.
If programming is nothing but translating unoriginal old algorithms, then you should train copilot on those. Nobody would complain. The fact that they don't is an unassailable proof of the unsurprising fact that programmers add value to programs.
Literally no one objects to people like you donating your code to Microsoft.
I don't know if you watch YouTube, but this is probably how every creator hit with a bullshit DMCA claim for 5s of audio from a song feels. Why does OpenAI's work demand special consideration here? Or to put it another way - if we're going to be ignoring copyright, everyone should be able to do it.
Yes, yesss. You're getting to the logical conclusion. Now I don't think Microsoft have become 'based' and want to break the copyright system but I hope they have inadvertently done so through their actions.
Mind-bogglingly entitled.
I'm in the first category; I'm guessing by your abusive response you are in the second?
First one: Uses of attribution and copyleft licenses are just ego-boosting, instead of legitimate protection of authorship against corporate piracy.
Second: Criticism of said corporate exploitation of community work is the actual entitled behaviour. Oh, it's also abusive.
Third strawmen: that people who oppose CoPilot in its current form just want to defend copyright around boilerplate stack-overflowish type code.
All false.
I can only assume... You're either too young and inexperienced to remember the early days of the copyleft, free software, and open source movements and why these licenses exist (and still need to exist)... or your values are so backwards that you just think it's Ok to harvest other people's hard work for your own (or your employer's) own profit.
To be clear: There is no heuristic at work in something like CoPilot that can distinguish between boilerplate code and genuine innovation. It has been shown multiple times to just freely copy and paste novel, copyrighted code; without attribution or conforming to license restrictions. That is unacceptable and deserving of legal countermeasures.
I would have no problem with CoPilot copying only the code of people who have opened their code for that kind of use. But that's not what it does.
Notable that Microsoft, its owner, is not training CoPilot on its own massive corpus of code. Just other people's code.
No. You are being abusive when you throw out insults to a commenter who argues something you disagree with - please don't try and obfuscate what you were doing, and check the HN guidelines before commenting further, as you are repeating the hostile and condescending tone and should know better.
However, as I started the thread with a comment that I guess was more provocative (and perhaps more personally felt by others here) than I intended, I'll accept your criticism and bow out.
Given how insane copyright laws are I would be pleased if they for once worked in my favour.
Why can't they train on code that they own, such as the windows source code?
Why doesn't copyright law apply to open source code but applies strongly to windows source code?
After reading the comments here, apparently everyone is a genius with code so special and unique, it would be unfathomable for two or more people to arrive at the same exact outcome.
Would anyone have been able to sell a car if faster horses were already clogging up the streets?
If you want idea protection you need to look at patents.
This is what I would argue if I was Microsoft's lawyer. You can't win a copyright lawsuit over one bar of music, one dance move, or a few words. Similarly, copilot can't be considered to be infringing on anyone's copyright because the snippets it might copy verbatim are too short to be copyrightable.
Actually... The smallest successful copyright claim is I believe over 10 words or so.
However, this definitely pushed the boundaries of copyright law. Audi never appealed the $1m verdict, so it's hardly settled case law.
Actually, Kraftwerk did
https://www.factmag.com/2019/07/30/kraftwerk-sample-lawsuit-...
There are bands that are giving all of the profits of entire albums to the people whose sample they failed to clear on a single song.
Arguing that AI is mining ideas and not expressions is going to be a lot less successful when you've got a large pool of expert witnesses who are going to be able and willing to say that AI is only capable of mimicking the form of what it sees.
Yes, when you train on a human generated corpus you're going to get an interpolative AI. But when you train on a dataset generated by AI, you can surpass human level.
AlphaZero started, as the name says, from zero. No examples of how we play the game. In just three days of self-play it surpassed the best human. How was that possible? We got a 2000 year head start, larger brains, and many players, not just one model. AlphaZero did it by creating its own training data.
Here is an example of using code language models for this kind of dataset-creation by play.
> Evolution through Large Models
https://arxiv.org/abs/2206.08896
By the way, GPT-3 and chatGPT are not simple interpolative language models. They have also been trained on many tasks, problems, and codes, which is the kind of data that will awaken the skills of the model to a whole new level. What I am saying is that we can auto-generate more problem data and increase their skills.
If Bob wrote a program that took Sally's dataset and produced source code from prompts, that too would in principle not violate copyright and he could sell that.
But you're suggesting that if one person did both at once, that would violate copyright?
https://en.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_....
No. You can't.
https://www.legalzoom.com/articles/can-you-patent-an-idea
'A machine sucking dust from a surface in order to clean it' is an idea.
Dyson design is an invention.
https://www.dyson.com/vacuum-cleaners/cordless/v15/detect/ye...
Here a broad description of differences between copyright and patent (trademark included):
https://copyrightalliance.org/faqs/difference-copyright-pate...
None of them covers the principle of idea.
And if you want an example of a dubious (in my opinion) attempt to patent an idea (patent troll):
https://patents.google.com/patent/EP3811791A1/en
While is it a patent trolling attempt (in my opinion) ?
Because it's basically an idea (adding a natural compound in ecigarette eliquids as sweetener) with an extensive list of layers covering general principles of everything related to ecigarette and ecigarette eliquid to pretend it's a specific formula (which is not) or an invention (which is neither because it's a natural compound known for its sweetener properties since 19th century).
One hopes Oracle et al are not further inspired by such an outcome.
Isn't this the reason for clean room implementations?
The problem here ends up being that code, especially in popular languages, will always looks similar when you're doing something like finding the best implementation for an algorithm. So if you invoke CoPilot for a common problem, chances are it can pull the exact code it needs from is dataset, but it also could've generated that same code snipped had the solution not existed in its training dataset. And when you start out solving a problem then ask it to continue writing more code, it just assumes you're solving the exact same problem that the original source code was solving.
This could probably be remedied if CoPilot spit out a "this is % similar to <x> source code from the internet" so that you can know just how unique CoPilot is being. Legally, copyright is just a mess and was not ready for the scale of the internet nor the advancements in ML when there are machines that have a 50% chance of infringing on someone's copyright and 50% chance of creating something new.
Unfortunately this is frequently abused where researchers build a model under the exemptions, and then others use that model commercially, even if they wouldn’t be allowed to build that model directly themselves.
Anyways, the scientific progress would continue, but products would halt until product developers get some kind of agreements with content creators (eg maybe people start adopting a new kind of open-ish license).
“Artificial Intelligence’ is referred to herein as ‘AI’. AI is defined for the purposes of this Complaint as a computer program that algorithmically simulates human reasoning or inference, often using statistical methods. Machine Learning (‘ML’) is a subset of AI in which the behavior of the program is derived from studying a corpus of material called training data.”
There is no difference between the two. Given that another project called Dance Diffusion was trained on public domain music and audio and permission by musicians, it is clear that Stability knew that they would be sued to the ground if Dance Diffusion was trained on copyrighted music. [3] They already seem to have admitted and felt guilty into trampling over the copyright and watermarks of images and knowingly avoided doing the same with music.
My point is, use and train on public domain content only and content that has the permission of the creator. This applies to all of them; DALL-E, Copilot, Stable Diffusion. Clearly wasn't a problem to use public domain music with Dance Diffusion was it?
[0] https://venturebeat.com/ai/stability-ai-to-honor-artist-opt-...
[1] https://platform.stability.ai/
[2] https://twitter.com/EMostaque/status/1603147709229170695
[3] https://techcrunch.com/2022/10/07/ai-music-generator-dance-d...
Not at all. You need to bait it really hard and push it into a corner for it to reproduce anything. At that point you might just as well go to the repo and copypaste the code directly.
I've used Copilot since day one and still haven't seen anything that felt like a 1 to 1 copy of something. It's highly contextual and all about using the code I have already written to craft its suggestions. Even if I ask it explicitly for a known algorithm it will use my code style, patterns and naming conventions to write it.
More specifically, if Copilot breaks the "rules," so too does (probably--IANAL) pretty much every generative AI project out there. Restricting training to public domain datasets would be very limiting.
Some might. But FOSS licenses can exist because of copyright. So if, hypothetically, there weren't software copyrights, anyone could take any code and monetize it however they wanted with no restrictions. That might or might not be a big deal--the general trend has been towards more permissive licenses anyway.
Maybe something like this could be a propellant for legitimate copyright reform.
Eg
Effectively you can't even use the code since it has trampled on licenses which are incompatible with each other. But it is more of a problem for Copilot.
Like, we’re all swooning about ChatGPT, but how can chatGPT be legal if this isn’t? I literally can ask it “write me a song about cryptocurrency in the style of Taylor swift” and it will. It can’t do that it it didn’t train with Taylor Swift song lyrics.
Doesn’t this kill chatGPT? Doesn’t this law suit potentially kill lots of training models?
I'm curious to see how this will be litigated because of that. The difference here seems to be how publicly Copilot's use of user generated content has been, the wide range of licensing that content falls under and the fact this is an entirely new product produced by a third party with a partnership versus a 1st party tool.
There's a prediction market on this suit's success, which is currently at 35% (https://manifold.markets/JeffKaufman/will-the-github-copilot...).
That doesn't include not giving me credit.
[1] https://www.cnet.com/tech/tech-industry/fact-and-fiction-in-...
The lawsuit against Microsoft, GitHub and OpenAI that could change rules of AI - https://news.ycombinator.com/item?id=33546009 - Nov 2022 (5 comments)
An open source lawyer’s view on the copilot class action lawsuit - https://news.ycombinator.com/item?id=33542813 - Nov 2022 (175 comments)
Microsoft sued for open-source piracy through GitHub Copilot - https://news.ycombinator.com/item?id=33485544 - Nov 2022 (288 comments)
We've filed a lawsuit against GitHub Copilot - https://news.ycombinator.com/item?id=33457063 - Nov 2022 (781 comments)
GitHub Copilot may steer Microsoft into a copyright lawsuit - https://news.ycombinator.com/item?id=33278726 - Oct 2022 (11 comments)
GitHub Copilot investigation - https://news.ycombinator.com/item?id=33240341 - Oct 2022 (1219 comments)
What Copilot means for open source - https://news.ycombinator.com/item?id=31878290 - June 2022 (137 comments)
Should GitHub be sued for training Copilot on GPL code? - https://news.ycombinator.com/item?id=31847931 - June 2022 (300 comments)
So either this is about code authored by people who did not use GitHub (in which case GitHub would be immediately liable, though they could try to sue whoever uploaded that code to GitHub for damages) or it's going to have to argue that the terms of service can't smuggle in a provision that effectively sidesteps even the most permissive open source licenses.
But given that implicitly or explicitly GitHub users act more like users of a commercial service (remember: commercial doesn't mean paid or b2b), things might be different given that consumer protections don't necessarily apply.
Personally I'd love to see the same "you can't hide surprises in your ToS to obtain 'consent'" yardstick be applied here though, commercial service or not.
Your response is not very helpful beyond telling me I lack information I'm unaware of and couldn't find.
Rather, GitHub have consistently cited “fair use”, as also noted in the suit, including in the summary at https://unicourt.com/case/pc-db5-doe-1-et-al-v-github-inc-et.... I also don’t believe GitHub have ever claimed to only use GitHub repositories, though I know of no obvious evidence of them having fetched from other sources, and they may well not have simply because it’s more convenient not to and they’ve got enough already, even if it honestly weakens their position (“if you’re relying on ‘fair use’, why haven’t you added closed-source software like the GitHub backend to show you mean it?”).
There are a huge number of motivated developers that want this to exist, the techniques themselves are not novel, and the code itself cannot be kept from whomever wants to train a model. It's a lost cause.
Interestingly, Matthew Butterick (of Practical Typography fame) is co-counsel on this. Programmer, lawyer and typesetting expert, damn. https://matthewbutterick.com/
It'll be interesting to see how this plays out, to my understanding, these language models are strictly statistical in nature so they aren't creating a database of code that they paste snippets from. They're looking at all the examples and encoding the statistical likelihood that one token follows another and are then just feeding in the pre-amble (the code you wrote) and generating the chain of tokens that most likely follows that. It seems like it would be the same process if a person were to read a lot of code, identify patterns e.g. an <a> tag has an href= attribute or other more complex configurations, and then writes code based on that understanding. If you can prove that is infringing then you could potentially prove that the act of reading other people's code and then writing your own based on what you have learnt is infringement even if it doesn't exactly match the code that other people have written! I hope this can be effectively explained in court.
It will be a long list, but just a list.
https://github.com/search?q=license%3Acc0-1.0&type=Repositor...
All repos with a particular license.
s/mute/moot/; moot: having little or no practical relevance, typically because the subject is too uncertain to allow a decision.
This popup appears within a half second of the page loading. It's so abrupt and disruptive to my mind. My eyes have JUST located where to start reading and then BAM THIS GIANT POPUP TAKES OVER THE SCREEN.
I'm exiting your page immediately. I don't care if you have a free recipe for alchemy. I wish I had an easy way to outright block the domain so I could keep track of the offenders.
Popups and overlays have ruined the modern web.
who cares man
just build stuff
if you don't want people to learn off your code just don't share it!
> if you don't want people to learn off your code
"Learn" is a strange verb to use here. No one at Microsoft or OpenAI was scraping all of GitHub so that they could learn. They took people's licensed works, fed it into a very sophisticated copy-paste machine, and started making money off of it.
> just don't share it!
It's almost like licenses and copyright exist to protect the rights of their holders or something.
The entire point of licenses is to be able to share your work in a way that respects your wishes. "Just don't share it" is completely non-productive.
tl;dr it gives specific permissions as to what derivative works are and are not permitted while making the source available for others. The key being: you can be as permissive or as limited as you want in how your code is used.
[1] https://github.com/cheatcode/joystick/blob/development/LICEN...
> Does the attribution need to be included in the data set at every stage?
The above two questions seem identical. My gut feeling is no; you don't need to intentionally train on attributions nor do you need to ensure that the data set columns have attribution data in them when provided to your training code. The attribution requirement of CC-BY and CC-BY-SA triggers when you do any of the things copyright law says you have to get permission in order to do, and the license further restricts that requirement to public instances of such. So privately shoving Creative Commons data into a neural net trainer is probably fine. Not having attribution on the data the model sees does not foreclose the possibility of providing attribution alongside the model at the time of publication.
> Does the result of the mining need to include attribution, even if hundreds of thousands of CC BY works were mined and the output does not include content from individual works?
This is an active legal question.
My personal opinion is that if you can draw a line from a particular output to something in the training set, then you're either copying or creating a derivative work, and you need to follow any relevant licenses. Generative models are capable of outputting their training set data, especially if overfit; so using them exposes you to the licensing requirements of anything the model saw that matches its output domain.
I'm actually considering this as part of PD-Diffusion; which is my attempt at building an art generator trained on public-domain images. Since I'm scraping Wikimedia Commons to get both images and labels, the labels are CC-BY-SA[0]. This means that my trained models will also need to be CC-BY-SA and ship with a very, very long text file listing attributions for all the labels I used[1]. But, notably, because this is an art generator and not a label generator, I don't need to worry about attributing model outputs. None of the label data will make its way into the final image.
If I did have a reliable way to attribute model outputs, then I could make "CC-Diffusion", trained on all CC-BY and CC-BY-SA images on Wikimedia Commons. But even then there's noncopyright ethical concerns with doing that. I'm not even using the full public domain as-is, just the PD-Old category, because Wikimedia Commons has a lot of uncopyrighted Italian images of living people that I do not want in my model.
> Also sued were a confusing mishmash of for profit and non-profit related entities all using a variation of the name OpenAI (OpenAI, Inc., OpenAI, LLC, OpenAI Startup Fund GP I, L.L.C.; you get the picture). OpenAI received one billion dollars in funding from Microsoft although they seem “officially unrelated.”
OpenAI's ownership structure is hilariously convoluted, even by the standards of, say, Mozilla having separate 501(c)(3) and for-profit arms. The goal of the company is to launder noncommercial research into commercial products, and they even have a laughable "capped profit corporation" explanation for this.
[0] There are two exceptions to this:
- Structured data, i.e. the caption field and Wikidata, is considered to be copyright-free and explicitly has a CC0 license applied to it.
- Some public domain images have contradicting copyright terms applied to their wikitext; i.e. CC-BY-NC-SA. Those will need to be detected and filtered out of the label set, but I haven't written the code to do this yet. That's also why I haven't released any trained models.
[1] Currently this is going to be in the form of Wikimedia Commons usernames, specifically all the users that were in the revision history for the images. I believe there are also some wikitext attributions that I need to write code to find and reproduce.
How can anyone even enforce this? Why can't I take some code, create a SaaS product for drug dealers, and then go sell it to my Opp Daquavion Marshawn III down the block? Who will ever find out?
In case you're interested in more: https://en.wikipedia.org/wiki/Open_source_license_litigation
[0] https://www.gnu.org/philosophy/enforcing-gpl.en.html
[1] https://www.theverge.com/2021/12/20/22847213/tiktoks-live-st...