7 ms·

What happens when someone puts code up on GitHub with a license that says "This code may not be used for training a code generation model"? - Is GitHub actuall

What happens when someone puts code up on GitHub with a license that says "This code may not be used for training a code generation model"? - Is GitHub actually going to pay any attention to that, or are they just going to ingest the code and thus violate its license anyway? - If they go ahead and violate the code's license, what are the legal repercussions for the resulting model? Can a model be "un-trained" from a particular piece of code, or would the whole thing need to be thrown out?

invokestatic 5y ago
By uploading your content to GitHub, you’ve granted them a license to use that content to “improve the Service over time”, as specified in the ToS[1]. That effectively “overrides” any license or term that you’ve specified for your repository, since you’ve already licensed the content to GitHub under different terms. Of course, people who are not GitHub are beholden to the terms you specify. [1] https://docs.github.com/en/github/site-policy/github-terms-of-service#g-intellectual-property-notice https://docs.github.com/en/github/site-policy/github-terms-o...
- antattack 5y ago
  That does not mean that you give them license to your code. In fact some or all of the code may not be yours to give in a first place.
- jordemort 5y ago
  I think more specifically, the relevant bit is here: https://docs.github.com/en/github/site-policy/github-terms-of-service#4-license-grant-to-us https://docs.github.com/en/github/site-policy/github-terms-o... > We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. But, it goes on to say: > This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service, except that as part of the right to archive Your Content, GitHub may permit our partners to store and archive Your Content in public repositories in connection with the GitHub Arctic Code Vault and GitHub Archive Program. I'm not a lawyer, but it seems ambiguous to me if this ToS is sufficient to cover CoPilot's butt in corner cases; I bet at least one lawyer is going to make some money trying to answer the question.
  - yaitsyaboi 5y ago
    Wait so does this mean a “private repo” is meaningless and GitHub can share any code in any repo with anyone?
    - sandyarmstrong 5y ago
      Why do you think people care so much about end-to-end encrypted messaging? Yes, the concept of a "private" repo is enforced only by GitHub's service. A bug in their auth code could lead to others having access. A warrant could lead to others having access. Etc.
    - cercatrova 5y ago
      Of course. A "private" repo is still on their servers. It's only private from other GitHub users, not the actual site administrators. This is the same in any website, of course the admins can see everything. If you truly want privacy, use your own git servers.
    - ocdtrekkie 5y ago
      Fun fact: Every major cloud provider has a similar blanket term. For example, Google doesn't need to license music to use for promotional content, because YouTube's terms grant them a worldwide license to use uploaded content for purposes including promoting their services, and music labels can't afford to not be on YouTube. (It's probable even uploading content to protect it, as in Content ID, would arguably cause this term to apply.) It all comes down to the nuance of whether the usage counts as part of protecting or improving (or promoting) their services and what other terms are specified.
    - vageli 5y ago
      No. > GitHub may permit our partners to store and archive Your Content in public repositories in connection
    - z3ncyberpunk 5y ago
      Hey... want to take a guess why Microsoft lets you have unlimited free private repos when they bought GitHub? ;)
- joeyh 5y ago
  Anyone can upload someone else's freely licensed code to github. Without giving them such a license. I do not upload my code to github, or give them any special permissions, and I am confident my code was included in the model's corpus.
- amelius 5y ago
  > By uploading your content to GitHub, you’ve granted them a license to use that content to “improve the Service over time”, as specified in the ToS. That's nonsense because they could claim that for almost any reason. E.g. assume Google put the source code of Google search in Github. Then Github copies that code and uses it in their own search, since that "improves the service". Would that be legal? It's like selling a pen and claiming the rights to anything written with it.
  - invokestatic 5y ago
    If the pen was sold with a contract that said the seller has the rights to anything written with it, then yes. These types of contracts are actually quite common, for example an employment contract will almost certainly include an IP grant clause. Pretty much any website that hosts user-generated content as well. IANAL, but quite familiar with business law.
    - joepie91_ 5y ago
      > These types of contracts are actually quite common, for example an employment contract will almost certainly include an IP grant clause. In the US, maybe. In most of the rest of the world, these sorts of overreaching "we own everything you do anywhere" clauses are decidedly illegal.
- diffeomorphism 5y ago
  How is this different from uploading a hollywood movie to youtube? Just because there is a passage in the terms that the uploader supposedly gave them those rights, this does not mean they actually have the power to do that.
  - macinjosh 5y ago
    Not sure how much it would matter but the main difference I see is that if I upload my own code to GitHub I have the ability to give away the IP, but if I upload Avengers End Game to YouTube I don't have the right to give that away.
    - makeitdouble 5y ago
      I wonder how it would work if we consider you flagged your code as GPL before it hits Github. We could end up in the same situation as the Hollywood movie even if you are also the one setting the original license on the work. Basically you have a right to change the license, but it doesn’t mean you do.
      - im3w1l 5y ago
        A very plausible scenario: Alice creates GPL project. Bob forks it and uploads to github. Bob does not have a right to relicense Alices' parts.
  - jcranmer 5y ago
    You can't give Github or Youtube or anybody else copyright rights if you don't have them in the first place. This is what ultimately torpedoed "Happy Birthday" copyright claims: while it's pretty undisputed that the Hill sisters gave their copyright to (ultimately) Warner/Chapelle, it was the case that they actually didn't invent the lyrics, and thus Warner/Chapelle had no copyright over the lyrics. So if someone uploads a Hollywood movie to Youtube, Youtube doesn't get the rights to play that movie from them because they didn't have the rights in the first place. Of course, if the actual copyright owner uploads it, it's now permissible for Youtube to play it, even if it's the copy that someone else provided. [This has torpedoed a few filesharing lawsuits.]
- Hamuko 5y ago
  I sort of doubt that GitHub could include GPL code in a piece of closed-source program that they distribute that "improves the service" and claim that this gives them the right.
- lucideer 5y ago
  The use of the definition Your Content may make GitHub's own ToS legally invalid in a large number of cases as it implies that the uploader must be the sole author and "owner" of the code being uploaded. From the definitions section in the same doc: > "Your Content" is Content that you create or own. That will definitely exclude any mirrored open-source projects, any open-source project that has ever migrated to Github from another platform, and also many forked projects.
- 2OEH8eoCRo0 5y ago
  It's aggravating that there is no escape. If you host somewhere else it will be scraped. If you pay for the service it will be used.
- sipos 5y ago
  Seems like a good reason to never use GitHub, and encourage other people not to.
- nitwit005 5y ago
  I rather suspect judges would not see "improving the Service over time" as permission to create derivative works without compensation. The person uploading files to github is also not necessarily doing so with permission from the rights holder, which might be a violation of the terms of service, but would mean there's no agreement in place.
- carlosperate 5y ago
  Good point, to me that explains why this is a GitHub product instead of a Microsoft (or VSCode) product.
rjp0008 5y ago
I would bet this as applicable as the Facebook posts of my parents friends something like, 'All my content on this page is mine alone and I expressly forbid Facebook INC usage of it for any purpose.'
- jordemort 5y ago
  I'm not sure why it would be any less binding than any other license term, except for possibly the ToS loophole that invokestatic points out below.
  - willseth 5y ago
    It's not binding because the other party hasn't agreed. You agree to terms when you use the site. One party can't unilaterally change the agreement without consent of the other party.
    - Avamander 5y ago
      Someone might have published a project I've contributed to, on GitHub. There's no permission.
    - jordemort 5y ago
      I see where you're coming from but it's not quite the same thing; Facebook doesn't encourage people to choose a license for the content that they post there, so there's no expectation that there are any terms aside from those in Facebook's ToS. OTOH GitHub has historically very strongly encouraged users to add a LICENSE to their repositories, and also encouraged users to fork other people's code and and push it to GitHub. That GitHub would be exempt from the licensing terms of the code pushed to it, except for the obvious minimal extent they might need to be in order to provide their services, seems like an extremely surprising interpretation.
      - willseth 5y ago
        It has nothing to do with GitHub being exempt from anything. It's that users are bound by the terms they agreed to in a ToS. If there is a conflict between a user-created license and a site's ToS, the burden is on the user to resolve it. To be clear, I'm not suggesting this is some kind of loophole GitHub is using to trample on users' licenses, even though maybe they could. It's probably completely legal for GitHub to use even the most super-extra-double-GPL-licensed code because copyright law allows it. The author of the Twitter post's suggestion that Copilot's output must be a derivative work is based on a naive understanding of "derivative" as it's defined in copyright law. It's not hard to find clear explanations of how this stuff works, and it's obvious she didn't bother to do any homework. Several criteria would appear to rule out GitHub's use as infringement. e.g.: 'In essence, the comparison is an ad hoc determination of whether the protectable elements of the original program that are contained in the second work are significant or important parts of the original program.' https://copyleft.org/guide/comprehensive-gpl-guidech5.html https://copyleft.org/guide/comprehensive-gpl-guidech5.html
vbezhenar 5y ago
I expect them to check /LICENSE file and if it deviates from standard open source license, they'll skip that repository.
- jordemort 5y ago
  They haven't made any public statements on if they're looking at LICENSE or not; I'd sure appreciate it if they did!
- cxr 5y ago
  The existence of a LICENSE file is neither necessary nor sufficient to determine the terms that apply to a given work.
  - diffeomorphism 5y ago
    Why not? If it does not exist you treat it as proprietary (copyrighted by default) and if it does exist at least the author claims that the given license is an option (possibly their mistake, not mine)
    - junon 5y ago
      Because individual source files might have license headers that override the root license file in the repository.
- anfelor 5y ago
  They don't do that it seems. In the footnotes of https://docs.github.com/en/github/copilot/research-recitation https://docs.github.com/en/github/copilot/research-recitatio... they mention two repositories from the training set none of which specify a license.
all_rights_rsvd 5y ago
I post my code publicly, but with an "all rights reserved" licence. I don't mind everyone reading my code freely, but you can't use it for anything but learning. If I found out they were ingesting my code I would be angry. It's like training your replacement. I don't use GitHub, anyways, but now I'll definitely never even think about it.
- toyg 5y ago
  Technically then I'm infringing as soon as I clone your repo, possibly even as soon as a webserver sends your files to my browser. "All rights reserved" makes sense on final items, like books or physical records, that require no copy or change after owner-approved manufacturing has taken place. It doesn't really make sense on digital artefacts.
  - all_rights_rsvd 5y ago
    So don't clone it, read it online. I reserve all rights, but I do give license to my host to make a "copy" to let you view it. I do that specifically to prevent non-biological entities like corporations or AI from using my code. If you're a biological entity, I specify you can email me to get a license for my code for a specific, defined purpose. I have a conversation with that person, then I send them a record number and the terms of my license for them in which I grant some rights which I had reserved. Also, in your example, the copyright for the book or dvd is for the content, not the physical item. You can do anything you want with that item but not the content. My code is similar, I'm licensing my provider to serve you a visual representation of the files so you can experience the content, not giving you a license to run that code or use it otherwise.
    - deleted 5y ago
      [deleted]
    - uchiga 5y ago
      If it is public, its no longer your code. Its ai training material.
    - 5y ago
cortesoft 5y ago
Also, how would you know if your code was included in the training or not? Then, let’s say the AI generates some new code for someone, and it is nearly identical to some bit of code that you wrote in your project. If they didn’t use your code in the model, then the generated code is clearly not a copyright violation, since it was effectively a “clean room” recreation. If your code was included in the model, is it therefore a violation? But then again, it comes down to how can someone prove their code was included or not? What if the creators don’t even know? If you wrote your model to say, randomly grab 50% of all public repos to use in the model, then no one would know if a specific repo was used in the training.
- BlueTemplar 5y ago
  They "just" have to comply with all the licenses for all the code that the program was trained on ? I suppose that for most open source licences this at the very least involves attribution for all the people that produced the code that the program was trained on ?

invokestatic 5y ago

By uploading your content to GitHub, you’ve granted them a license to use that content to “improve the Service over time”, as specified in the ToS[1]. That effectively “overrides” any license or term that you’ve specified for your repository, since you’ve already licensed the content to GitHub under different terms. Of course, people who are not GitHub are beholden to the terms you specify. [1] https://docs.github.com/en/github/site-policy/github-terms-of-service#g-intellectual-property-notice https://docs.github.com/en/github/site-policy/github-terms-o...

antattack 5y ago
That does not mean that you give them license to your code. In fact some or all of the code may not be yours to give in a first place.
jordemort 5y ago
I think more specifically, the relevant bit is here: https://docs.github.com/en/github/site-policy/github-terms-of-service#4-license-grant-to-us https://docs.github.com/en/github/site-policy/github-terms-o... > We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. But, it goes on to say: > This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service, except that as part of the right to archive Your Content, GitHub may permit our partners to store and archive Your Content in public repositories in connection with the GitHub Arctic Code Vault and GitHub Archive Program. I'm not a lawyer, but it seems ambiguous to me if this ToS is sufficient to cover CoPilot's butt in corner cases; I bet at least one lawyer is going to make some money trying to answer the question.
- yaitsyaboi 5y ago
  Wait so does this mean a “private repo” is meaningless and GitHub can share any code in any repo with anyone?
  - sandyarmstrong 5y ago
    Why do you think people care so much about end-to-end encrypted messaging? Yes, the concept of a "private" repo is enforced only by GitHub's service. A bug in their auth code could lead to others having access. A warrant could lead to others having access. Etc.
  - cercatrova 5y ago
    Of course. A "private" repo is still on their servers. It's only private from other GitHub users, not the actual site administrators. This is the same in any website, of course the admins can see everything. If you truly want privacy, use your own git servers.
  - ocdtrekkie 5y ago
    Fun fact: Every major cloud provider has a similar blanket term. For example, Google doesn't need to license music to use for promotional content, because YouTube's terms grant them a worldwide license to use uploaded content for purposes including promoting their services, and music labels can't afford to not be on YouTube. (It's probable even uploading content to protect it, as in Content ID, would arguably cause this term to apply.) It all comes down to the nuance of whether the usage counts as part of protecting or improving (or promoting) their services and what other terms are specified.
  - vageli 5y ago
    No. > GitHub may permit our partners to store and archive Your Content in public repositories in connection
  - z3ncyberpunk 5y ago
    Hey... want to take a guess why Microsoft lets you have unlimited free private repos when they bought GitHub? ;)
joeyh 5y ago
Anyone can upload someone else's freely licensed code to github. Without giving them such a license. I do not upload my code to github, or give them any special permissions, and I am confident my code was included in the model's corpus.
amelius 5y ago
> By uploading your content to GitHub, you’ve granted them a license to use that content to “improve the Service over time”, as specified in the ToS. That's nonsense because they could claim that for almost any reason. E.g. assume Google put the source code of Google search in Github. Then Github copies that code and uses it in their own search, since that "improves the service". Would that be legal? It's like selling a pen and claiming the rights to anything written with it.
- invokestatic 5y ago
  If the pen was sold with a contract that said the seller has the rights to anything written with it, then yes. These types of contracts are actually quite common, for example an employment contract will almost certainly include an IP grant clause. Pretty much any website that hosts user-generated content as well. IANAL, but quite familiar with business law.
  - joepie91_ 5y ago
    > These types of contracts are actually quite common, for example an employment contract will almost certainly include an IP grant clause. In the US, maybe. In most of the rest of the world, these sorts of overreaching "we own everything you do anywhere" clauses are decidedly illegal.
diffeomorphism 5y ago
How is this different from uploading a hollywood movie to youtube? Just because there is a passage in the terms that the uploader supposedly gave them those rights, this does not mean they actually have the power to do that.
- macinjosh 5y ago
  Not sure how much it would matter but the main difference I see is that if I upload my own code to GitHub I have the ability to give away the IP, but if I upload Avengers End Game to YouTube I don't have the right to give that away.
  - makeitdouble 5y ago
    I wonder how it would work if we consider you flagged your code as GPL before it hits Github. We could end up in the same situation as the Hollywood movie even if you are also the one setting the original license on the work. Basically you have a right to change the license, but it doesn’t mean you do.
    - im3w1l 5y ago
      A very plausible scenario: Alice creates GPL project. Bob forks it and uploads to github. Bob does not have a right to relicense Alices' parts.
- jcranmer 5y ago
  You can't give Github or Youtube or anybody else copyright rights if you don't have them in the first place. This is what ultimately torpedoed "Happy Birthday" copyright claims: while it's pretty undisputed that the Hill sisters gave their copyright to (ultimately) Warner/Chapelle, it was the case that they actually didn't invent the lyrics, and thus Warner/Chapelle had no copyright over the lyrics. So if someone uploads a Hollywood movie to Youtube, Youtube doesn't get the rights to play that movie from them because they didn't have the rights in the first place. Of course, if the actual copyright owner uploads it, it's now permissible for Youtube to play it, even if it's the copy that someone else provided. [This has torpedoed a few filesharing lawsuits.]
Hamuko 5y ago
I sort of doubt that GitHub could include GPL code in a piece of closed-source program that they distribute that "improves the service" and claim that this gives them the right.
lucideer 5y ago
The use of the definition Your Content may make GitHub's own ToS legally invalid in a large number of cases as it implies that the uploader must be the sole author and "owner" of the code being uploaded. From the definitions section in the same doc: > "Your Content" is Content that you create or own. That will definitely exclude any mirrored open-source projects, any open-source project that has ever migrated to Github from another platform, and also many forked projects.
2OEH8eoCRo0 5y ago
It's aggravating that there is no escape. If you host somewhere else it will be scraped. If you pay for the service it will be used.
sipos 5y ago
Seems like a good reason to never use GitHub, and encourage other people not to.
nitwit005 5y ago
I rather suspect judges would not see "improving the Service over time" as permission to create derivative works without compensation. The person uploading files to github is also not necessarily doing so with permission from the rights holder, which might be a violation of the terms of service, but would mean there's no agreement in place.
carlosperate 5y ago
Good point, to me that explains why this is a GitHub product instead of a Microsoft (or VSCode) product.

rjp0008 5y ago

I would bet this as applicable as the Facebook posts of my parents friends something like, 'All my content on this page is mine alone and I expressly forbid Facebook INC usage of it for any purpose.'

jordemort 5y ago
I'm not sure why it would be any less binding than any other license term, except for possibly the ToS loophole that invokestatic points out below.
- willseth 5y ago
  It's not binding because the other party hasn't agreed. You agree to terms when you use the site. One party can't unilaterally change the agreement without consent of the other party.
  - Avamander 5y ago
    Someone might have published a project I've contributed to, on GitHub. There's no permission.
  - jordemort 5y ago
    I see where you're coming from but it's not quite the same thing; Facebook doesn't encourage people to choose a license for the content that they post there, so there's no expectation that there are any terms aside from those in Facebook's ToS. OTOH GitHub has historically very strongly encouraged users to add a LICENSE to their repositories, and also encouraged users to fork other people's code and and push it to GitHub. That GitHub would be exempt from the licensing terms of the code pushed to it, except for the obvious minimal extent they might need to be in order to provide their services, seems like an extremely surprising interpretation.
    - willseth 5y ago
      It has nothing to do with GitHub being exempt from anything. It's that users are bound by the terms they agreed to in a ToS. If there is a conflict between a user-created license and a site's ToS, the burden is on the user to resolve it. To be clear, I'm not suggesting this is some kind of loophole GitHub is using to trample on users' licenses, even though maybe they could. It's probably completely legal for GitHub to use even the most super-extra-double-GPL-licensed code because copyright law allows it. The author of the Twitter post's suggestion that Copilot's output must be a derivative work is based on a naive understanding of "derivative" as it's defined in copyright law. It's not hard to find clear explanations of how this stuff works, and it's obvious she didn't bother to do any homework. Several criteria would appear to rule out GitHub's use as infringement. e.g.: 'In essence, the comparison is an ad hoc determination of whether the protectable elements of the original program that are contained in the second work are significant or important parts of the original program.' https://copyleft.org/guide/comprehensive-gpl-guidech5.html https://copyleft.org/guide/comprehensive-gpl-guidech5.html

vbezhenar 5y ago

I expect them to check /LICENSE file and if it deviates from standard open source license, they'll skip that repository.

jordemort 5y ago
They haven't made any public statements on if they're looking at LICENSE or not; I'd sure appreciate it if they did!
cxr 5y ago
The existence of a LICENSE file is neither necessary nor sufficient to determine the terms that apply to a given work.
- diffeomorphism 5y ago
  Why not? If it does not exist you treat it as proprietary (copyrighted by default) and if it does exist at least the author claims that the given license is an option (possibly their mistake, not mine)
  - junon 5y ago
    Because individual source files might have license headers that override the root license file in the repository.
anfelor 5y ago
They don't do that it seems. In the footnotes of https://docs.github.com/en/github/copilot/research-recitation https://docs.github.com/en/github/copilot/research-recitatio... they mention two repositories from the training set none of which specify a license.

all_rights_rsvd 5y ago

I post my code publicly, but with an "all rights reserved" licence. I don't mind everyone reading my code freely, but you can't use it for anything but learning. If I found out they were ingesting my code I would be angry. It's like training your replacement. I don't use GitHub, anyways, but now I'll definitely never even think about it.

toyg 5y ago
Technically then I'm infringing as soon as I clone your repo, possibly even as soon as a webserver sends your files to my browser. "All rights reserved" makes sense on final items, like books or physical records, that require no copy or change after owner-approved manufacturing has taken place. It doesn't really make sense on digital artefacts.
- all_rights_rsvd 5y ago
  So don't clone it, read it online. I reserve all rights, but I do give license to my host to make a "copy" to let you view it. I do that specifically to prevent non-biological entities like corporations or AI from using my code. If you're a biological entity, I specify you can email me to get a license for my code for a specific, defined purpose. I have a conversation with that person, then I send them a record number and the terms of my license for them in which I grant some rights which I had reserved. Also, in your example, the copyright for the book or dvd is for the content, not the physical item. You can do anything you want with that item but not the content. My code is similar, I'm licensing my provider to serve you a visual representation of the files so you can experience the content, not giving you a license to run that code or use it otherwise.
  - deleted 5y ago
    [deleted]
  - uchiga 5y ago
    If it is public, its no longer your code. Its ai training material.
  - 5y ago

cortesoft 5y ago

Also, how would you know if your code was included in the training or not? Then, let’s say the AI generates some new code for someone, and it is nearly identical to some bit of code that you wrote in your project. If they didn’t use your code in the model, then the generated code is clearly not a copyright violation, since it was effectively a “clean room” recreation. If your code was included in the model, is it therefore a violation? But then again, it comes down to how can someone prove their code was included or not? What if the creators don’t even know? If you wrote your model to say, randomly grab 50% of all public repos to use in the model, then no one would know if a specific repo was used in the training.

BlueTemplar 5y ago
They "just" have to comply with all the licenses for all the code that the program was trained on ? I suppose that for most open source licences this at the very least involves attribution for all the people that produced the code that the program was trained on ?