prosim

Like Copilot CLI, but now Copilot also has a desktop app. Next to github.com, GitHub Desktop, GitHub Mobile, and Copilot in VS Code, somebody will explain the strategy of this... one day.

tl;dr: Vuln only possible by placing Copilot into YOLO mode. And it's fixed with the August Patch Tuesday release.

To quote from the article: "These repositories, belonging to more than 16,000 organizations, were originally posted to GitHub as public, but were later set to private [..]" Once things are public, they will forever remain public (in some form). That's how the internet works.

Flagged yesterday already. Still a non-story today: https://news.ycombinator.com/item?id=43183333

tl;dr Bing indexed and cached a public repository, then made it available to its AI chat. Later, the repository author switched the repository to private and understood how the internet works. And the story gets only better as the author is the founder of a “cybersecurity” company.

Is this a fork of https://github.com/intitni/CopilotForXcode? OSS under MIT license, which CoderKit is not.

He started at GitHub 3 years after the article was written. Don't think GitHub's interview process takes that long. ;)

Except the article is dated in URL and sidebar to July 5, 2021.

Depends on how you define "embrace". Services like Ubicloud violate the GitHub Terms of Service.

Footnote 1 on page 2 explicitly mentions the 3.5 model and the research in this paper is only about auto completion: https://arxiv.org/pdf/2306.15033.pdf

And this blog post states “beyond Codex”, again for auto completion: https://github.blog/2023-07-28-smarter-more-efficient-coding...

Lastly, OpenAI states on the original Codex page: “OpenAI Codex is a descendant of GPT-3; its training data contains both natural language and billions of lines of source code from publicly available sources, including code in public GitHub repositories.” - It included GitHub repos, but it never was only GitHub repos. https://openai.com/blog/openai-codex

Update: GitHub Community Manager confirms it here: https://github.com/orgs/community/discussions/56975#discussi...

That’s no longer true. Copilot uses the same ChatGPT-3.5 model as, well, ChatGPT. If it were trained on just GitHub projects, the chat features wouldn’t work at all.

They did not prompt at all. They used GitHub’s code search to find projects where the repo owner specified that the code was generated “by Copilot” and the authors took that at face value for all code in the project. Whether the code was actually suggested by Copilot is not at all analyzed in the paper. As such, the results are highly questionable.

Your private code is not used for any user other than you: https://docs.github.com/en/enterprise-cloud@latest/copilot/o...

Where does OpenAI state that they only train ChatGPT-3.5 or GPT-4 on code from GitHub? The model for GitHub Copilot X clearly has a (human) language understanding that you can't get from source code (or source code comments), so they are trained on much more data than GitHub has and there is no reason to believe OpenAI would limit themselves to that.

To hide the fact that this whole post is a marketing campaign with flat out wrong facts and examples that are nothing more than goading.

Copilot has a setting for this, and they announced attribution a while ago: https://github.blog/2022-11-01-preview-referencing-public-co...

It would be interesting if AWS actually does their attribution - how do they know which open source code was published in any public repo?

BigCode is such a project: https://www.bigcode-project.org/docs/about/mission/

It's back up.

tl;dr yes, but it needed manual intervention to fix the tests

HN post title is misleading. GitHub suspended (and not deleted) the 3 accounts of the org owners of the tornadocash org on GitHub. Going through the commit history, I have not found a single contributor (i.e. other than the 3 owners) which got suspended or deleted.

Heroku/SalesForce updated their status on https://status.heroku.com/incidents/2413:

"Salesforce continues to investigate this incident in coordination with GitHub and our retained third-party breach vendor. Once we identify how the threat actor gained access to customers' OAuth tokens, we will immediately take appropriate actions."

Sounds like they simply don't know yet how the actor got access and what else was exposed.

It's all about securing the software supply chain. Mark Russinovich had a keynote on the general topic at RSA 2020, especially the section on package managers from 0:29 onwards: https://www.rsaconference.com/industry-topics/presentation/c...

The comparison states that "With GitLab, you get even more features than GitHub Team" and then lists code owners, multiple issue and PR assignees, or standard support. All these features are included in GitHub Team for $4 per month, so this whole section of the blog post is misleading.

Also, you may want to point out that GitLab only offers annual billing, so the minimum charge on GitLab is $48. Some of my hobby projects only run a couple of months, so GitHub is the better choice.

It's a good article.

I would love to read more background on the acquisitions of MarsEdit, NNW, and Glassboard. MarsEdit 3.0 was released in 2010 and since then has only seen minor updates. NNW is dead in the water on OS X and completely gone on iOS. And Glassboard is losing significant amounts of money while the author spends more time on blog posts and podcasts than adding features to the app (not to talk about all those crashes).