17 ms·

So this makes it official... this post[0] and the comments on the announcement[1] concerned about licensing issues were absolutely correct... and this product h

So this makes it official... this post[0] and the comments on the announcement[1] concerned about licensing issues were absolutely correct... and this product has the possibility of getting you sued if you use it. Unfortunately for GitHub, there's no turning back the clocks. Even if they fix this, everyone that uses it has been put on notice that it copies code verbatim and enables copyright infringement. Worse, there's no way to know if the segment it's writing for you is copyrighted... and no way for you to comply with license requirements. Nice proof of concept... but who's going to touch this product now? It's a legal ticking time bomb. 0. https://news.ycombinator.com/item?id=27687450 https://news.ycombinator.com/item?id=27687450 1. https://news.ycombinator.com/item?id=27676266 https://news.ycombinator.com/item?id=27676266

eganist 5y ago
Adding to this: I run product security for a large enterprise, and I've already gotten the ball rolling on prohibiting copilot for all the reasons above. It's too big a risk. I'd be shocked if GitHub could remedy the negative impressions minted in the last day or so. Even with other compensating controls around open source management, this flies right under the radar with a c130's worth of adverse consequences.
- fragmede 5y ago
  Do you also block stack overflow and give guidance to never copy code from that website or elsewhere on the Internet? I'm legitimately curious - my org internally officially denounces the copying of stack overflow snippets. Thankfully for my role it's moot as I mostly work with an internal non-public language, for better or worse, and I have no idea how well that's followed elsewhere in the wider company.
  - mediaman 5y ago
    Who really copies stack overflow snippets verbatim? It's usually just easier to refer to it for help figuring out the right structure and then adapt it for your own needs. Usually it needs customization for your own application anyway (variables, class instances, etc).
    - canadev 5y ago
      Yeah! I've uh, ... never copied a bit of code into my repo verbatim, right? yeah right. I wish. (Not saying every dev does this)
      - TillE 5y ago
        I've copied plenty of Microsoft sample code verbatim, because the Win32 API sucks and their samples usually get the error handling right. But, I can't think of a single scenario where I've copied something from Stack Overflow. I'm searching for the idea of how to solve a problem, and typically the relevant code given is either too short to bother copying, or it's long and absolutely not consistent with how I want to write it.
        Noumenon72 5y ago
        "Too short to bother copying"? I copy single words of text to avoid typing and typos. I would never type out even a single line of code when I could paste and edit.
        alisonkisk 5y ago
        That's fair use.
        vanous 5y ago
        > "Too short to bother copying"? I copy single words of text to avoid typing and typos. I would never type out even a single line of code when I could paste and edit. Very honest suggestion: learn how to touch type. You can still copy if needed, but your typed input will be much faster.
        Noumenon72 5y ago
        I'm somewhere between 45-75 wpm. But Ctrl+C Ctrl+V can type 300wpm! Typing when you could paste is like having that Github Copilot put the right sentence right in front of you and you decide to type over it instead. Not only does it feel like wasted and robotic effort, typing everything leads to RSI. I'm not sure why people disagree. Another symptom is that I insist on aliases for everything while others type out all the commands every time. Maybe I get distracted by the words when I type and lose my train of thought?
  - samtheprogram 5y ago
    Anything posted to Stack Overflow has a specific (Creative Commons IIRC) license associated with it. The same is not true of GitHub Copilot, and in fact their FAQ doesn’t specify a license at all, probably because they are technically unable to since it is trained on a wide variety of code from differing licenses (and code not written by a human is currently a grey area for copyright). The FAQ simply says to use it at your own risk.
  - gunapologist99 5y ago
    Apples and oranges: Stack overflow snippets are explicitly granted under a permissive license, as long as you attribute. https://stackoverflow.com/help/licensing https://stackoverflow.com/help/licensing It appears that the code that copilot is using is created under a huge variety of licenses, making it risky. On the other hand, a small snippet in a function that is derived from many existing pieces of other code may fall under fair use, even if it is not under an open source license of some sort.
    - comex 5y ago
      Except that CC-BY-SA is not a permissive license; the SA part is a form of copyleft. It's just that nobody enforces it. From the text [1]: - "[I]f You Share Adapted Material You produce [..] The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License." - "Adapted Material means material [..] that is derived from or based upon the Licensed Material" (emphasis added) - "Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.' - "You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply." A program that includes a code snippet is unquestionably a derived work in most cases. That means that if you include a Stack Overflow code snippet in your program, and fair use does not apply, then you have to license the entire program under the CC-BY-SA. Alternately, you can license it under the GPLv3, because the license has a specific exemption allowing you to relicense under the GPLv3. For open source software under permissive licenses, it may actually be okay to consider the entire program as licensed under the CC-BY-SA, since permissive licenses are typically interpreted as allowing derived works to be licensed under different licenses; that's how GPL compatibility works. But you'd have to be careful you don't distribute the software in a way that applies any Effective Technological Measures, aka DRM. Such as via app stores, which often include DRM with no way for the app author to turn it off. (It may actually be better to relicense to the GPL, which 'only' prohibits adding additional terms and conditions, not the mere use of DRM. But people have claimed that the GPL also forbids app store distribution because the app store's terms and conditions count as additional restrictions.) For proprietary software where you do typically want to impose "different terms or conditions", this is a dead end. Note that copying extremely short snippets, or snippets which are essentially the only way to accomplish a task, may be considered fair use. But be careful; in Oracle v. Google, Google's accidental copying of 9 lines of utterly trivial code [2] was found to be neither fair use nor "de minimis", and thus infringing. Going back to Stack Overflow, these kinds of surprising results are why Creative Commons itself does not recommend using its licenses for code. But Stack Overflow does so anyway. Good thing nobody ever enforces the license! See also: https://opensource.stackexchange.com/questions/6777/can-i-use-source-code-licensed-under-cc-by-sa-for-commercial-closed-source-proje https://opensource.stackexchange.com/questions/6777/can-i-us... [1] https://creativecommons.org/licenses/by-sa/4.0/legalcode https://creativecommons.org/licenses/by-sa/4.0/legalcode [2] https://majadhondt.wordpress.com/2012/05/16/googles-9-lines/ https://majadhondt.wordpress.com/2012/05/16/googles-9-lines/
  - summerlight 5y ago
    Google (and most of other big techs I guess?) also explicitly prohibit employees from use of stack overflow code snippets.
    - Noumenon72 5y ago
      I tried Googling this and couldn't find it. I also don't want to believe it because it seems like the world suddenly turned into an apocalyptic hellscape with no place for developers like me. Do you have a source?
      - xen0 5y ago
        I work at Google. SO definitely comes up during copyright/IP training. The basic idea is 'reading SO answers to learn how to solve a problem is fine, copying/transcribing the code is not'. Google is quite paranoid re. copyright and licenses.
      - jhugo 5y ago
        I don't have a source to link, but I've also been told this by someone who works at Google. Is copy-pasting stuff verbatim from SO really that much of a thing? I use SO plenty, but have never considered taking anything verbatim.
      - summerlight 5y ago
        First, I work at Google and its onboard training explicitly mentions Stack Overflow as a forbidden example due to CC-BY-SA license (SA is the problematic part). The following link is the official reference. https://opensource.google/docs/thirdparty/licenses/#restricted https://opensource.google/docs/thirdparty/licenses/#restrict...
  - ljm 5y ago
    That's actually an attack vector: mirror SO using their open-sourced DB and inject malware into the suggestions, or change the text before it enters the clipboard. People blindly copy/pasting aren't going to notice.
- alblue 5y ago
  Same here. I’ve directed our teams and infra managers that we must be able to block the use of copilot for our firm’s code. Id be very surprised if the other large enterprises that I have worked at downs doing exactly the same thing. Too much legal risk, for practically no benefit.
sktrdie 5y ago
If they get rid of licensed stuff it should be ok no? I really want to use this and seems inevitable that we'll need it just as google translate needs all of the books + sites + comments it can get a hold of.
- deleted 5y ago
  [deleted]
- mmastrac 5y ago
  Well... the whole training set is licensed, so you can't really get rid of it. I think that the technology they are using for this is just not ready.
  - fragmede 5y ago
    Just retrain the model using properly licensed code? ("just" is doing a ton of heavy lifting, but let's be real, that's not impossibly hard)
    - deleted 5y ago
      [deleted]
    - michaelmrose 5y ago
      There is no such thing as properly licensed code because it is a function of the what is legally acceptable for your company and what it intends to do with the work.
    - Twirrim 5y ago
      There's not many licenses that let you reuse code without including the same headers / licensing blurb. You're in public domain, non-copyleft territory. WTFPL etc.
- runeb 5y ago
  How would they do that?
jpswade 5y ago
Not only this but a huge amount of publicly available code is truly terrible and should never really be used other than a point of reference, guidance.
__MatrixMan__ 5y ago
Is it still a legal concern if I'm just coding because I want to solve a problem and I'm not trying to use it to do business?
- maclockard 5y ago
  If you publish the code anywhere, potentially. You could be (unknowingly) violating the original license if the code was copied verbatim from another source. How much of a concern this is depends heavily on what the original source was.
  - lolinder 5y ago
    And the problem with copilot is that you have no way of knowing. If it changes even a little bit of the code, it's basically ungoogleable but still potentially in violation.
  - kevin_thibedeau 5y ago
    Distributing binaries to third parties is enough to trigger a license violation. For internal corporate tools, it would be less of an issue as "distribution" hasn't happened.
- saurik 5y ago
  Yes: not all code on GitHub is licensed in a way that lets you use it at all. People focus on GPL as if that were the tough case; but, in addition to code (like mine) under AGPL (which you need to not use in a product that exposes similar functionality to end users) there is code that is merely published under "shared source" licenses (so you can look, but not touch) and even literally code that is stolen and leaked from the internals of companies--including Microsoft!... this code often gets taken down later, but it isn't always noticed and either way: it is now part of Copilot :/--that, if you use this mechanism, could end up in your codebase.
  - gjs278 5y ago
    the gpl is never enforced. companies openly flaunt violations all the time.
deleted 5y ago
[deleted]
Kiro 5y ago
No-one cares about this. People have no clue about licenses and just copy-paste whatever. If someone gets access to their code and see all the violations they're screwed anyway.
- jerf 5y ago
  Ask your legal department about that. Sure, engineers don't care about licensing at all, but we are not the only players here.
  - syshum 5y ago
    Are legal departments in the habit of reviewing all code line by line? Seems like that would be cost prohibitive...
    - chipotle_coyote 5y ago
      Obviously they aren't, but just as obviously, "the legal department didn't review this, therefore it's safe to assume it's legal" would not pass muster with said legal department. :) Kiro's comment ("if someone gets access to their code and sees all the violations they're screwed anyway") is probably technically accurate, even if in practice you're unlikely to get caught. As other people have noted elsewhere in the comments here, the Google v. Oracle case over Java definitely suggests that verbatim copying of just a few lines, even for trivial functions, is enough to get you in trouble if those lines aren't licensed in a way that lets you do that.
    - harry8 5y ago
      No legal come up to you and say stuff like: "You guys aren't using any free software are you? Because you can't do that." "You mean copying software source code without respecting the license, right? Because we absolutely respect all licenses fully." "No I mean you can't use Free software! It's a clear management directive! What are you doing?!?" "Is that an apple laptop you're using there? Ever had a look at the software licenses for it?" Legal are generally idiotically ignorant about the real issues. Whose fault that is we can argue about.
eximius 5y ago
Seems like the liability should also be on Copilot itself, as a derivative work.
skybrian 5y ago
It seems like the risk is somewhat exaggerated because even when people get bad autocomplete results, they mostly won’t use them.
- Cyberdog 5y ago
  That's optimistic. The people who would rely heavily on this sort of thing are going to be the worst at detecting what a "bad autocomplete result" would look like. But even if you are capable of judging that you've got a good one, it still doesn't inform you of the obvious potential licensing issues with any bit of code. Surely somebody working on this project foresaw this problem…
gjs278 5y ago
nobody fucking cares
thesz 5y ago
I think that proper coding assistant should help with not writing code (and I stress that it is "not writing code") - how to rearrange your code base for new requirements, for example. Code not written does not have defects, does not need support and, as you point it out, is not a liability.
root_axis 5y ago
The practical utility will outweigh the legal concerns. Engineers using this are going to be more productive and this is a competitive advantage that companies won't eschew.
- voakbasda 5y ago
  If the legal concerns are well-known, then what you are describing might be viewed as criminal negligence (at worst) and or insufficient duty of care (at best). Such engineers should be held fully responsible and accountable for their actions.

eganist 5y ago

Adding to this: I run product security for a large enterprise, and I've already gotten the ball rolling on prohibiting copilot for all the reasons above. It's too big a risk. I'd be shocked if GitHub could remedy the negative impressions minted in the last day or so. Even with other compensating controls around open source management, this flies right under the radar with a c130's worth of adverse consequences.

fragmede 5y ago
Do you also block stack overflow and give guidance to never copy code from that website or elsewhere on the Internet? I'm legitimately curious - my org internally officially denounces the copying of stack overflow snippets. Thankfully for my role it's moot as I mostly work with an internal non-public language, for better or worse, and I have no idea how well that's followed elsewhere in the wider company.
- mediaman 5y ago
  Who really copies stack overflow snippets verbatim? It's usually just easier to refer to it for help figuring out the right structure and then adapt it for your own needs. Usually it needs customization for your own application anyway (variables, class instances, etc).
  - canadev 5y ago
    Yeah! I've uh, ... never copied a bit of code into my repo verbatim, right? yeah right. I wish. (Not saying every dev does this)
    - TillE 5y ago
      I've copied plenty of Microsoft sample code verbatim, because the Win32 API sucks and their samples usually get the error handling right. But, I can't think of a single scenario where I've copied something from Stack Overflow. I'm searching for the idea of how to solve a problem, and typically the relevant code given is either too short to bother copying, or it's long and absolutely not consistent with how I want to write it.
      - Noumenon72 5y ago
        "Too short to bother copying"? I copy single words of text to avoid typing and typos. I would never type out even a single line of code when I could paste and edit.
        alisonkisk 5y ago
        That's fair use.
        vanous 5y ago
        > "Too short to bother copying"? I copy single words of text to avoid typing and typos. I would never type out even a single line of code when I could paste and edit. Very honest suggestion: learn how to touch type. You can still copy if needed, but your typed input will be much faster.
        Noumenon72 5y ago
        I'm somewhere between 45-75 wpm. But Ctrl+C Ctrl+V can type 300wpm! Typing when you could paste is like having that Github Copilot put the right sentence right in front of you and you decide to type over it instead. Not only does it feel like wasted and robotic effort, typing everything leads to RSI. I'm not sure why people disagree. Another symptom is that I insist on aliases for everything while others type out all the commands every time. Maybe I get distracted by the words when I type and lose my train of thought?
- samtheprogram 5y ago
  Anything posted to Stack Overflow has a specific (Creative Commons IIRC) license associated with it. The same is not true of GitHub Copilot, and in fact their FAQ doesn’t specify a license at all, probably because they are technically unable to since it is trained on a wide variety of code from differing licenses (and code not written by a human is currently a grey area for copyright). The FAQ simply says to use it at your own risk.
- gunapologist99 5y ago
  Apples and oranges: Stack overflow snippets are explicitly granted under a permissive license, as long as you attribute. https://stackoverflow.com/help/licensing https://stackoverflow.com/help/licensing It appears that the code that copilot is using is created under a huge variety of licenses, making it risky. On the other hand, a small snippet in a function that is derived from many existing pieces of other code may fall under fair use, even if it is not under an open source license of some sort.
  - comex 5y ago
    Except that CC-BY-SA is not a permissive license; the SA part is a form of copyleft. It's just that nobody enforces it. From the text [1]: - "[I]f You Share Adapted Material You produce [..] The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License." - "Adapted Material means material [..] that is derived from or based upon the Licensed Material" (emphasis added) - "Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.' - "You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply." A program that includes a code snippet is unquestionably a derived work in most cases. That means that if you include a Stack Overflow code snippet in your program, and fair use does not apply, then you have to license the entire program under the CC-BY-SA. Alternately, you can license it under the GPLv3, because the license has a specific exemption allowing you to relicense under the GPLv3. For open source software under permissive licenses, it may actually be okay to consider the entire program as licensed under the CC-BY-SA, since permissive licenses are typically interpreted as allowing derived works to be licensed under different licenses; that's how GPL compatibility works. But you'd have to be careful you don't distribute the software in a way that applies any Effective Technological Measures, aka DRM. Such as via app stores, which often include DRM with no way for the app author to turn it off. (It may actually be better to relicense to the GPL, which 'only' prohibits adding additional terms and conditions, not the mere use of DRM. But people have claimed that the GPL also forbids app store distribution because the app store's terms and conditions count as additional restrictions.) For proprietary software where you do typically want to impose "different terms or conditions", this is a dead end. Note that copying extremely short snippets, or snippets which are essentially the only way to accomplish a task, may be considered fair use. But be careful; in Oracle v. Google, Google's accidental copying of 9 lines of utterly trivial code [2] was found to be neither fair use nor "de minimis", and thus infringing. Going back to Stack Overflow, these kinds of surprising results are why Creative Commons itself does not recommend using its licenses for code. But Stack Overflow does so anyway. Good thing nobody ever enforces the license! See also: https://opensource.stackexchange.com/questions/6777/can-i-use-source-code-licensed-under-cc-by-sa-for-commercial-closed-source-proje https://opensource.stackexchange.com/questions/6777/can-i-us... [1] https://creativecommons.org/licenses/by-sa/4.0/legalcode https://creativecommons.org/licenses/by-sa/4.0/legalcode [2] https://majadhondt.wordpress.com/2012/05/16/googles-9-lines/ https://majadhondt.wordpress.com/2012/05/16/googles-9-lines/
- summerlight 5y ago
  Google (and most of other big techs I guess?) also explicitly prohibit employees from use of stack overflow code snippets.
  - Noumenon72 5y ago
    I tried Googling this and couldn't find it. I also don't want to believe it because it seems like the world suddenly turned into an apocalyptic hellscape with no place for developers like me. Do you have a source?
    - xen0 5y ago
      I work at Google. SO definitely comes up during copyright/IP training. The basic idea is 'reading SO answers to learn how to solve a problem is fine, copying/transcribing the code is not'. Google is quite paranoid re. copyright and licenses.
    - jhugo 5y ago
      I don't have a source to link, but I've also been told this by someone who works at Google. Is copy-pasting stuff verbatim from SO really that much of a thing? I use SO plenty, but have never considered taking anything verbatim.
    - summerlight 5y ago
      First, I work at Google and its onboard training explicitly mentions Stack Overflow as a forbidden example due to CC-BY-SA license (SA is the problematic part). The following link is the official reference. https://opensource.google/docs/thirdparty/licenses/#restricted https://opensource.google/docs/thirdparty/licenses/#restrict...
- ljm 5y ago
  That's actually an attack vector: mirror SO using their open-sourced DB and inject malware into the suggestions, or change the text before it enters the clipboard. People blindly copy/pasting aren't going to notice.
alblue 5y ago
Same here. I’ve directed our teams and infra managers that we must be able to block the use of copilot for our firm’s code. Id be very surprised if the other large enterprises that I have worked at downs doing exactly the same thing. Too much legal risk, for practically no benefit.

sktrdie 5y ago

If they get rid of licensed stuff it should be ok no? I really want to use this and seems inevitable that we'll need it just as google translate needs all of the books + sites + comments it can get a hold of.

deleted 5y ago
[deleted]
mmastrac 5y ago
Well... the whole training set is licensed, so you can't really get rid of it. I think that the technology they are using for this is just not ready.
- fragmede 5y ago
  Just retrain the model using properly licensed code? ("just" is doing a ton of heavy lifting, but let's be real, that's not impossibly hard)
  - deleted 5y ago
    [deleted]
  - michaelmrose 5y ago
    There is no such thing as properly licensed code because it is a function of the what is legally acceptable for your company and what it intends to do with the work.
  - Twirrim 5y ago
    There's not many licenses that let you reuse code without including the same headers / licensing blurb. You're in public domain, non-copyleft territory. WTFPL etc.
runeb 5y ago
How would they do that?

jpswade 5y ago

Not only this but a huge amount of publicly available code is truly terrible and should never really be used other than a point of reference, guidance.

__MatrixMan__ 5y ago

Is it still a legal concern if I'm just coding because I want to solve a problem and I'm not trying to use it to do business?

maclockard 5y ago
If you publish the code anywhere, potentially. You could be (unknowingly) violating the original license if the code was copied verbatim from another source. How much of a concern this is depends heavily on what the original source was.
- lolinder 5y ago
  And the problem with copilot is that you have no way of knowing. If it changes even a little bit of the code, it's basically ungoogleable but still potentially in violation.
- kevin_thibedeau 5y ago
  Distributing binaries to third parties is enough to trigger a license violation. For internal corporate tools, it would be less of an issue as "distribution" hasn't happened.
saurik 5y ago
Yes: not all code on GitHub is licensed in a way that lets you use it at all. People focus on GPL as if that were the tough case; but, in addition to code (like mine) under AGPL (which you need to not use in a product that exposes similar functionality to end users) there is code that is merely published under "shared source" licenses (so you can look, but not touch) and even literally code that is stolen and leaked from the internals of companies--including Microsoft!... this code often gets taken down later, but it isn't always noticed and either way: it is now part of Copilot :/--that, if you use this mechanism, could end up in your codebase.
- gjs278 5y ago
  the gpl is never enforced. companies openly flaunt violations all the time.

deleted 5y ago

[deleted]

Kiro 5y ago

No-one cares about this. People have no clue about licenses and just copy-paste whatever. If someone gets access to their code and see all the violations they're screwed anyway.

jerf 5y ago
Ask your legal department about that. Sure, engineers don't care about licensing at all, but we are not the only players here.
- syshum 5y ago
  Are legal departments in the habit of reviewing all code line by line? Seems like that would be cost prohibitive...
  - chipotle_coyote 5y ago
    Obviously they aren't, but just as obviously, "the legal department didn't review this, therefore it's safe to assume it's legal" would not pass muster with said legal department. :) Kiro's comment ("if someone gets access to their code and sees all the violations they're screwed anyway") is probably technically accurate, even if in practice you're unlikely to get caught. As other people have noted elsewhere in the comments here, the Google v. Oracle case over Java definitely suggests that verbatim copying of just a few lines, even for trivial functions, is enough to get you in trouble if those lines aren't licensed in a way that lets you do that.
  - harry8 5y ago
    No legal come up to you and say stuff like: "You guys aren't using any free software are you? Because you can't do that." "You mean copying software source code without respecting the license, right? Because we absolutely respect all licenses fully." "No I mean you can't use Free software! It's a clear management directive! What are you doing?!?" "Is that an apple laptop you're using there? Ever had a look at the software licenses for it?" Legal are generally idiotically ignorant about the real issues. Whose fault that is we can argue about.

eximius 5y ago

Seems like the liability should also be on Copilot itself, as a derivative work.

skybrian 5y ago

It seems like the risk is somewhat exaggerated because even when people get bad autocomplete results, they mostly won’t use them.

Cyberdog 5y ago
That's optimistic. The people who would rely heavily on this sort of thing are going to be the worst at detecting what a "bad autocomplete result" would look like. But even if you are capable of judging that you've got a good one, it still doesn't inform you of the obvious potential licensing issues with any bit of code. Surely somebody working on this project foresaw this problem…

gjs278 5y ago

nobody fucking cares

thesz 5y ago

I think that proper coding assistant should help with not writing code (and I stress that it is "not writing code") - how to rearrange your code base for new requirements, for example. Code not written does not have defects, does not need support and, as you point it out, is not a liability.

root_axis 5y ago

The practical utility will outweigh the legal concerns. Engineers using this are going to be more productive and this is a competitive advantage that companies won't eschew.

voakbasda 5y ago
If the legal concerns are well-known, then what you are describing might be viewed as criminal negligence (at worst) and or insufficient duty of care (at best). Such engineers should be held fully responsible and accountable for their actions.