Hacker News Reader

Comment by dspillett | Hacker News Reader

> Copyright is not something that can be signed over by a terms-of-use change of a hosting provider

Agreeing to GitHub's terms doesn't try to assign copyright over your code, it grabs licence to use your code however they see fit which is¹ legally quite different.

Of course the real fun comes if someone agrees to their terms then uploads some of my code which they have to right to assign the licence to GitHub for. What come-back do I get in that case if I don't want my stuff used that way?

It seems odd to me that MS² who for many years strongly spoke against touching anything with the remotest whiff of GPL because of what it could legally do to your release requirements, are now more than happy to hoover up all the GPL covered code in GitHub and potentially mix it into their users' work output via copilot.

----

[1] in my not-at-all-legally-trained understanding

[2] current owners of GitHub, for those not paying attention

View on HN

> Agreeing to GitHub's terms doesn't try to assign copyright over your code, it grabs licence to use your code however they see fit which is¹ legally quite different.

I disagree, IANAL, and I'm happy they are getting sued. The fact that they are are foremost a code hosting/collaboration company and the terms of service we all agreed to when creating our accounts was to have them host our code, and use it however they need in order to provide the service. The fact that they changed, post agreement, the service provided (from mere hosting/collaboration to feeding it into Copilot) should be an opt-in. I hope it's tested in court what the service is, because if you have a feature that (let's say) 1% of your users use, that's not the service, is it?

The service is displaying code... also I'm unaware of any TOS/EULA that cannot be amended or changed post agreement.

Not really about disallowing amendments, but at least sending out a notice of the changing terms. Like you get with your privacy policy.

I'm pretty sure I didn't receive one about them using my public (although unpopular) open source code into their NN mixer.

Edit: Anyway a bit outside the point. It being, when your ever expanding set of services incorporate your ownership in ways unforseen when the agreement was made, opt-in would have been the agreeable aproach in my opinion. Even ignoring over the licensing woes, as that's something to be tested in courts with this lawsuit, and interesting to follow.

They didn't change the terms, you can't expect privacy when you're out in public. I'm also curious how you're certain your project was used?

> you can't expect privacy when you're out in public

This isn't about privacy, it is about licensing (and possibly copyright). mhitza mentioned privacy as another policy, that you agree to upon sign-up like the terms of service, one for which updates are regularly announced.

> I'm also curious how you're certain your project was used?

Hasn't it been suggested that all public repositories at least could have been used? It makes sense to give the training pool as much information as possible.

> This isn't about privacy, it is about licensing (and possibly copyright). mhitza mentioned privacy as another policy, that you agree to upon sign-up like the terms of service, one for which updates are regularly announced.

The terms of service say you grant GitHub an implicit license to display your code. They also say:

"We may modify this agreement, but we will give you 30 days' notice of material changes."

Are you claiming that hasn't happened?

> Hasn't it been suggested that all public repositories at least could have been used? It makes sense to give the training pool as much information as possible.

Has it? I don't like to make assumptions.

> > "We may modify this agreement, but we will give you 30 days' notice of material changes."

> Are you claiming that hasn't happened?

Your post that I replied to explicitly stated that it hasn't.

Is that the case or was that one if the assumptions you don't like to make?

it grabs licence to use your code however they see fit

Not your code. Anyone's code that's uploaded to github by any third party. Under open source licenses, that's expressly permitted. However, it seems you're arguing that Github is not bound by the license under which they (and their users) acquired the code because of their TOS.

How many projects on github are put there by the original copyright holders? Perhaps it's more than 50%, but it certainly is less than 100%. So where is github's legal paperwork that shows that they're only processing the code that's copyrighted by the user who uploaded it, or that they received permission from third-party rights holders that did not agree to their TOS?

This is a good point. If I vendor my dependencies and upload to Github, does that give them a licence to use that code however they wish?

It's interesting, because Github certainly have the right to set whatever terms they like on their website. The dependency authors certainly have the right to set the licence terms on their code, and that gives me the right to vendor their work and include it in my upload to Github. But I, obviously, don't have the right to agree to Github's terms on behalf of the dependency authors.

I think the problem here is that Github assumes that everything I upload is my property, and that I have the ability to assign a licence to what I upload. This is not true for any project that vendors its dependencies.

> So where is github's legal paperwork that shows that they're only processing the code that's copyrighted by the user who uploaded it

Under other circumstances they don't need it. But if CoPilot is creating a derivative work including parts of that code without including the licence terms or attribution (as required by many licences) things are far more grey, or possible full black.

Some argue that the AI is unaware of the terms so can't be held responsible. Two possible counters for that: 1. it is the licence that gives you the right to use the copyrighted code, if you are unaware of the licence then why assume you have the righ tto use the code? 2. if I found some useful code that happened unbeknownst to me to be from MS, and used it in a way that I wasn't licensed to, and MS noticed, it is a pretty safe bet that they'd state ignorance of the copyright terms doesn't mean you can't be held to them.

Or another angle: the tool is allowing, even encouraging, people to use code or other materials in a way that infringes copyright (again: you don't have the right to use the code under most licences unless you give correct attribution and such) – the very conditions often stated as reasons for trying to ban other tools.

Plus of course the general argument: if this is entirely a non-issue, why is no Windows, Office, or SQL Server code in the training set? Surely they are great examples of how to do things to train the AI with?

You would need to agree for every copyrighted work that you intend to allow them to use it for different purposes. Since GitHub can be completely invisible from the point of a contributor I highly doubt that clears the bar for such an invasive and irrevocable act.

It seems a lot of this stems from how the DMCA does not require that these hosting providers actually check for code ownership at submission, or maybe just how they don't have an explicit checkbox for "I affirm that I can license this code to GitHub" every time someone is uploading code.

If it is shown that the license in the TOS is valid, the legal question might boil down to "is the TOS License broad enough to where nobody thought that it allowed their code to be used in for-profit ML models?"

A checkbox would make no difference in the case where the uploaded has not been granted the right to agree to such terms with respect to the code in question, leaving the matter in the same situation.

I'd like to propose a "golden rule" test. If Copilot was truly not at risk of regurgitating large blocks of code verbatim, why didn't Microsoft train it on proprietary Microsoft code as well? Why was it limited to user-submitted code on GitHub? If there is any argument pointing to licensing or copyright or patents, it stands to reason those concerns would apply to any corpus of user-submitted code since users could easily misrepresent the licensing.

Precisely. I made this exact point a while ago, how come Microsoft didn't submit the source code to Windows as part of the training data, that is at least code that they can plausibly claim they have the rights to.

There's a good point made over here: https://news.ycombinator.com/item?id=34282407 that it might accidentally spit out some kind of secret that is much smaller than a copyrightable piece of code. That's not a risk for code in public repositories.

Perhaps you want to check the comment section here: https://lwn.net/Articles/914150/

user bluca works at microsoft, but i think their opinions are their own.

> how the DMCA does not require that these hosting providers actually check for code ownership at submission

How does one check who owns a work if the work does not include the authorship information? (or if the work has been altered to have incorrect authorship information)

That's the tough part, and the technological infeasibility is probably why the DMCA has no such provision. Even for Video, only YouTube has come up with a system that is "mostly right" for "most content" they have to deal with, that being Content ID, and it takes a lot of horsepower and a lot of money to run (and it requires that every rights holder must upload their content to the service for scanning; quite a feat).

How did you type the superscript footnotes?

Edit: Wow, this is game changing. Markdown parsers need to implement superscript ascii character support!

Lowercase ⁽ᵃ⁾ Uppercase ⁽ᴬ⁾ Numbers ⁽⁹⁹⁾

There are Unicode characters for superscripted digits; you can probably find them in some kind of character-map application, depending on the platform you're using.

They are available in most fonts with reasonable-or-better Unicode coverage (https://en.wikipedia.org/wiki/Unicode_subscripts_and_supersc...). 1, 2 and 3 are available in ISO-8859-1 so can sometimes be used in 8-bit-only text, but I'd use them with care in that context.

To type them easily you'll usually need composition (sometimes called chording) support. Some Linux (and other Unix) distributions still have this built in by default, though last time I used Linux for much desktop use it seemed to be fading from common availability, otherwise you'll have to hunt for another method. On Windows I use http://wincompose.info/ (here [atlgr][^][1] produces “¹”, for instance, in the default settings) which is useful for a number of other things (I first started using it for accented characters like á on a UK keyboard). If you have a keyboard with programmable function keys then you could use its customisation tool to map some of them to produce the super-script (or sub-script, or other) characters you commonly want.

For less convenient typing, use your OS's Character Map or similar tool.

On Android, unless you have a different keyboard in use which doesn't support this of course, long press on the number on the touch keyboard gives superscripts as an option.

> On Android, unless you have a different keyboard in use which doesn't support this of course, long press on the number on the touch keyboard gives superscripts as an option

chucks iPad out the window

We only get the standard shift character as an option. E.g. 1 shows !, 2 shows @, etc.

I’d use superscripts all the time if it was on the keyboard. Anyone know if MacOS can do it? Other than pressing the weird globe key and searching.

Easiest way I can think of is that you can use text substitution (System Settings -> Keyboard -> Text Replacements...) to set a string of characters that should substitute to the superscript characters (you can look it up with the globe key to set it up initially). So you could make e.g. [1] map to ¹, [2] map to ², etc. You could also use this trick on i(Pad)OS (Settings -> General -> Keyboard -> Text Substitutions). In fact, the substitutions should sync across if you're logged into the same Apple ID.

The “UniChar” app, among others, can be used as an alternative keyboard “language” to access Unicode symbols with an interface similar to the emoji picker. Includes “favorites” and “recently used” sections.

https://apps.apple.com/us/app/unichar-unicode-keyboard/id880...

> implement superscript ascii character support

They are _not_ in ASCII. A few are available in some 8-bit code-pages that expand on ASCII's 7-bit character set, otherwise you need to be working in a Unicode-supporting environment (which is most these days, thankfully).

I interpreted the phrase as superscript variants of characters that are in ASCII.

Reply on news.ycombinator.com