5 ms·

By uploading your content to GitHub, you’ve granted them a license to use that content to “improve the Service over time”, as specified in the ToS[1]. That eff

By uploading your content to GitHub, you’ve granted them a license to use that content to “improve the Service over time”, as specified in the ToS[1]. That effectively “overrides” any license or term that you’ve specified for your repository, since you’ve already licensed the content to GitHub under different terms. Of course, people who are not GitHub are beholden to the terms you specify. [1] https://docs.github.com/en/github/site-policy/github-terms-of-service#g-intellectual-property-notice https://docs.github.com/en/github/site-policy/github-terms-o...

antattack 5y ago
That does not mean that you give them license to your code. In fact some or all of the code may not be yours to give in a first place.
jordemort 5y ago
I think more specifically, the relevant bit is here: https://docs.github.com/en/github/site-policy/github-terms-of-service#4-license-grant-to-us https://docs.github.com/en/github/site-policy/github-terms-o... > We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. But, it goes on to say: > This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service, except that as part of the right to archive Your Content, GitHub may permit our partners to store and archive Your Content in public repositories in connection with the GitHub Arctic Code Vault and GitHub Archive Program. I'm not a lawyer, but it seems ambiguous to me if this ToS is sufficient to cover CoPilot's butt in corner cases; I bet at least one lawyer is going to make some money trying to answer the question.
- yaitsyaboi 5y ago
  Wait so does this mean a “private repo” is meaningless and GitHub can share any code in any repo with anyone?
  - sandyarmstrong 5y ago
    Why do you think people care so much about end-to-end encrypted messaging? Yes, the concept of a "private" repo is enforced only by GitHub's service. A bug in their auth code could lead to others having access. A warrant could lead to others having access. Etc.
  - cercatrova 5y ago
    Of course. A "private" repo is still on their servers. It's only private from other GitHub users, not the actual site administrators. This is the same in any website, of course the admins can see everything. If you truly want privacy, use your own git servers.
  - ocdtrekkie 5y ago
    Fun fact: Every major cloud provider has a similar blanket term. For example, Google doesn't need to license music to use for promotional content, because YouTube's terms grant them a worldwide license to use uploaded content for purposes including promoting their services, and music labels can't afford to not be on YouTube. (It's probable even uploading content to protect it, as in Content ID, would arguably cause this term to apply.) It all comes down to the nuance of whether the usage counts as part of protecting or improving (or promoting) their services and what other terms are specified.
  - vageli 5y ago
    No. > GitHub may permit our partners to store and archive Your Content in public repositories in connection
  - z3ncyberpunk 5y ago
    Hey... want to take a guess why Microsoft lets you have unlimited free private repos when they bought GitHub? ;)
joeyh 5y ago
Anyone can upload someone else's freely licensed code to github. Without giving them such a license. I do not upload my code to github, or give them any special permissions, and I am confident my code was included in the model's corpus.
amelius 5y ago
> By uploading your content to GitHub, you’ve granted them a license to use that content to “improve the Service over time”, as specified in the ToS. That's nonsense because they could claim that for almost any reason. E.g. assume Google put the source code of Google search in Github. Then Github copies that code and uses it in their own search, since that "improves the service". Would that be legal? It's like selling a pen and claiming the rights to anything written with it.
- invokestatic 5y ago
  If the pen was sold with a contract that said the seller has the rights to anything written with it, then yes. These types of contracts are actually quite common, for example an employment contract will almost certainly include an IP grant clause. Pretty much any website that hosts user-generated content as well. IANAL, but quite familiar with business law.
  - joepie91_ 5y ago
    > These types of contracts are actually quite common, for example an employment contract will almost certainly include an IP grant clause. In the US, maybe. In most of the rest of the world, these sorts of overreaching "we own everything you do anywhere" clauses are decidedly illegal.
diffeomorphism 5y ago
How is this different from uploading a hollywood movie to youtube? Just because there is a passage in the terms that the uploader supposedly gave them those rights, this does not mean they actually have the power to do that.
- macinjosh 5y ago
  Not sure how much it would matter but the main difference I see is that if I upload my own code to GitHub I have the ability to give away the IP, but if I upload Avengers End Game to YouTube I don't have the right to give that away.
  - makeitdouble 5y ago
    I wonder how it would work if we consider you flagged your code as GPL before it hits Github. We could end up in the same situation as the Hollywood movie even if you are also the one setting the original license on the work. Basically you have a right to change the license, but it doesn’t mean you do.
    - im3w1l 5y ago
      A very plausible scenario: Alice creates GPL project. Bob forks it and uploads to github. Bob does not have a right to relicense Alices' parts.
- jcranmer 5y ago
  You can't give Github or Youtube or anybody else copyright rights if you don't have them in the first place. This is what ultimately torpedoed "Happy Birthday" copyright claims: while it's pretty undisputed that the Hill sisters gave their copyright to (ultimately) Warner/Chapelle, it was the case that they actually didn't invent the lyrics, and thus Warner/Chapelle had no copyright over the lyrics. So if someone uploads a Hollywood movie to Youtube, Youtube doesn't get the rights to play that movie from them because they didn't have the rights in the first place. Of course, if the actual copyright owner uploads it, it's now permissible for Youtube to play it, even if it's the copy that someone else provided. [This has torpedoed a few filesharing lawsuits.]
Hamuko 5y ago
I sort of doubt that GitHub could include GPL code in a piece of closed-source program that they distribute that "improves the service" and claim that this gives them the right.
lucideer 5y ago
The use of the definition Your Content may make GitHub's own ToS legally invalid in a large number of cases as it implies that the uploader must be the sole author and "owner" of the code being uploaded. From the definitions section in the same doc: > "Your Content" is Content that you create or own. That will definitely exclude any mirrored open-source projects, any open-source project that has ever migrated to Github from another platform, and also many forked projects.
2OEH8eoCRo0 5y ago
It's aggravating that there is no escape. If you host somewhere else it will be scraped. If you pay for the service it will be used.
sipos 5y ago
Seems like a good reason to never use GitHub, and encourage other people not to.
nitwit005 5y ago
I rather suspect judges would not see "improving the Service over time" as permission to create derivative works without compensation. The person uploading files to github is also not necessarily doing so with permission from the rights holder, which might be a violation of the terms of service, but would mean there's no agreement in place.
carlosperate 5y ago
Good point, to me that explains why this is a GitHub product instead of a Microsoft (or VSCode) product.

antattack 5y ago

That does not mean that you give them license to your code. In fact some or all of the code may not be yours to give in a first place.

jordemort 5y ago

I think more specifically, the relevant bit is here: https://docs.github.com/en/github/site-policy/github-terms-of-service#4-license-grant-to-us https://docs.github.com/en/github/site-policy/github-terms-o... > We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. But, it goes on to say: > This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service, except that as part of the right to archive Your Content, GitHub may permit our partners to store and archive Your Content in public repositories in connection with the GitHub Arctic Code Vault and GitHub Archive Program. I'm not a lawyer, but it seems ambiguous to me if this ToS is sufficient to cover CoPilot's butt in corner cases; I bet at least one lawyer is going to make some money trying to answer the question.

yaitsyaboi 5y ago
Wait so does this mean a “private repo” is meaningless and GitHub can share any code in any repo with anyone?
- sandyarmstrong 5y ago
  Why do you think people care so much about end-to-end encrypted messaging? Yes, the concept of a "private" repo is enforced only by GitHub's service. A bug in their auth code could lead to others having access. A warrant could lead to others having access. Etc.
- cercatrova 5y ago
  Of course. A "private" repo is still on their servers. It's only private from other GitHub users, not the actual site administrators. This is the same in any website, of course the admins can see everything. If you truly want privacy, use your own git servers.
- ocdtrekkie 5y ago
  Fun fact: Every major cloud provider has a similar blanket term. For example, Google doesn't need to license music to use for promotional content, because YouTube's terms grant them a worldwide license to use uploaded content for purposes including promoting their services, and music labels can't afford to not be on YouTube. (It's probable even uploading content to protect it, as in Content ID, would arguably cause this term to apply.) It all comes down to the nuance of whether the usage counts as part of protecting or improving (or promoting) their services and what other terms are specified.
- vageli 5y ago
  No. > GitHub may permit our partners to store and archive Your Content in public repositories in connection
- z3ncyberpunk 5y ago
  Hey... want to take a guess why Microsoft lets you have unlimited free private repos when they bought GitHub? ;)

joeyh 5y ago

Anyone can upload someone else's freely licensed code to github. Without giving them such a license. I do not upload my code to github, or give them any special permissions, and I am confident my code was included in the model's corpus.

amelius 5y ago

> By uploading your content to GitHub, you’ve granted them a license to use that content to “improve the Service over time”, as specified in the ToS. That's nonsense because they could claim that for almost any reason. E.g. assume Google put the source code of Google search in Github. Then Github copies that code and uses it in their own search, since that "improves the service". Would that be legal? It's like selling a pen and claiming the rights to anything written with it.

invokestatic 5y ago
If the pen was sold with a contract that said the seller has the rights to anything written with it, then yes. These types of contracts are actually quite common, for example an employment contract will almost certainly include an IP grant clause. Pretty much any website that hosts user-generated content as well. IANAL, but quite familiar with business law.
- joepie91_ 5y ago
  > These types of contracts are actually quite common, for example an employment contract will almost certainly include an IP grant clause. In the US, maybe. In most of the rest of the world, these sorts of overreaching "we own everything you do anywhere" clauses are decidedly illegal.

diffeomorphism 5y ago

How is this different from uploading a hollywood movie to youtube? Just because there is a passage in the terms that the uploader supposedly gave them those rights, this does not mean they actually have the power to do that.

macinjosh 5y ago
Not sure how much it would matter but the main difference I see is that if I upload my own code to GitHub I have the ability to give away the IP, but if I upload Avengers End Game to YouTube I don't have the right to give that away.
- makeitdouble 5y ago
  I wonder how it would work if we consider you flagged your code as GPL before it hits Github. We could end up in the same situation as the Hollywood movie even if you are also the one setting the original license on the work. Basically you have a right to change the license, but it doesn’t mean you do.
  - im3w1l 5y ago
    A very plausible scenario: Alice creates GPL project. Bob forks it and uploads to github. Bob does not have a right to relicense Alices' parts.
jcranmer 5y ago
You can't give Github or Youtube or anybody else copyright rights if you don't have them in the first place. This is what ultimately torpedoed "Happy Birthday" copyright claims: while it's pretty undisputed that the Hill sisters gave their copyright to (ultimately) Warner/Chapelle, it was the case that they actually didn't invent the lyrics, and thus Warner/Chapelle had no copyright over the lyrics. So if someone uploads a Hollywood movie to Youtube, Youtube doesn't get the rights to play that movie from them because they didn't have the rights in the first place. Of course, if the actual copyright owner uploads it, it's now permissible for Youtube to play it, even if it's the copy that someone else provided. [This has torpedoed a few filesharing lawsuits.]

Hamuko 5y ago

I sort of doubt that GitHub could include GPL code in a piece of closed-source program that they distribute that "improves the service" and claim that this gives them the right.

lucideer 5y ago

The use of the definition Your Content may make GitHub's own ToS legally invalid in a large number of cases as it implies that the uploader must be the sole author and "owner" of the code being uploaded. From the definitions section in the same doc: > "Your Content" is Content that you create or own. That will definitely exclude any mirrored open-source projects, any open-source project that has ever migrated to Github from another platform, and also many forked projects.

2OEH8eoCRo0 5y ago

It's aggravating that there is no escape. If you host somewhere else it will be scraped. If you pay for the service it will be used.

sipos 5y ago

Seems like a good reason to never use GitHub, and encourage other people not to.

nitwit005 5y ago

I rather suspect judges would not see "improving the Service over time" as permission to create derivative works without compensation. The person uploading files to github is also not necessarily doing so with permission from the rights holder, which might be a violation of the terms of service, but would mean there's no agreement in place.

carlosperate 5y ago

Good point, to me that explains why this is a GitHub product instead of a Microsoft (or VSCode) product.